Changes from report parliamentary committee draft to report parliamentary committee draft

AddedArticle 26 – paragraph 1 a (new): 1.a The European Central Bank shall seek to ensure to the extent possible the interoperability of standards governing digital euro payment services with relevant standards governing private digital means of payment and especially those underpinning instant payments. The European Central Bank shall seek to enable, to the extent possible and where appropriate, private digital means of payment to use rules, standards and processes governing the digital euro payment services.

RemovedArticle 35 – paragraph 1 – point e: (e) in exceptional circumstances as defined in Article 31 (2), authorising payment service providers in switching Digital Euro wallets held with a payment services provider to another payment service providers designated by the Digital Euro user.

AddedArticle 26 – paragraph 2: For the purpose of the paragraph 1a, interoperability may be supported inter alia by the use of open standards.

RemovedArticle 35 – paragraph 4: 4. Personal data processed for tasks referred to in paragraph 1 shall be supported by appropriate technical and organisational measures including state-of-the-art security and privacy-preserving measures. This shall include the clear segregation of personal data to ensure that the European Central Bank and the national central banks cannot directly and indirectly identify individual Digital Euro users.

AddedArticle 27 – paragraph 1: 1. Without prejudice to the disputes concerning the lawfulness of the processing of personal data, disputes regarding online digital euro payment transactions as well as funding and defunding operations for the offline digital euro transactions shall be governed by the rules provided for in Directive (EU) 2015/2366. Directive (EU) 2020/1828 of the European Parliament and of the Council1a shall apply to the representative actions brought against infringements of provisions of this Regulation that harm or may harm the collective interests of consumers. / 1a Directive (EU) 2020/1828 of the European Parliament and of the Council of 25 November 2020 on representative actions for the protection of the collective interests of consumers and repealing Directive 2009/22/EC (OJ L 409, 4.12.2020, p.1, ELI: http://data.europa.eu/eli/dir/2020/1828/oj ).

RemovedArticle 38 – paragraph 2: 2. The power to adopt delegated acts referred to in Articles 11, 33, 34 and 35 shall be conferred on the Commission for an period of five years from [date of entry into force of this Regulation].

AddedArticle 27 – paragraph 3: 3. The European Central Bank shall act as the dispute-settlement body for disputes among payment service providers relating to the application of the Rulebook governing the operation of the digital euro. The role and functions of the European Central Bank in this capacity shall be established by contract between the European Central Bank and all payment service providers distributing the digital euro. To perform those functions, the European Central Bank shall adopt internal rules and a governance framework for dispute settlement that ensures no interference and full independence from the European Central Bank payment-system oversight functions. Decisions issued by the European Central Bank under this mechanism shall be final and binding on all participating payment service providers and directly enforceable vis-à-vis their users through the payment service providers’ contractual obligations without prejudice to the right to seek redress before judicial authorities in accordance with Union and national law.

RemovedArticle 38 – paragraph 3: deleted

AddedArticle 28 – paragraph 1 – subparagraph 1 – introductory part: Payment service providers distributing the digital euro may provide digital euro users with the front-end services developed by the European Central Bank to allow digital euro users to access and use digital euro payment services in accordance with Annexes II and IIa.

RemovedArticle 38 – paragraph 6: 6. A delegated act adopted pursuant to Articles 11, 33, 34 and 35 shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of three months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. . That period shall be extended by three months at the initiative of the European Parliament or of the Council.

AddedArticle 28 – paragraph 1 – subparagraph 1 – point a: deleted

RemovedArticle 38 a (new): Article 38a / Scrutiny procedure / The European Parliament, the Council, the Commission and the European Central Bank shall, after the European Central Bank has presented the technological structure of the Digital Euro, conduct a scrutiny procedure to assess the technology and ensure its suitability to serve Digital Euro users´ best interest. For this purpose, the European Central Bank shall advise the European Parliament, the Council and the Commission with due notice when the technological development has been concluded. The scrutiny procedure shall be conducted in a timely manner to allow for an orderly release of the Digital Euro by the European Central Bank, provided the scrutiny findings of the European Institutions are positive.

AddedArticle 28 – paragraph 1 – subparagraph 1 – point b: deleted

AddedArticle 28 – paragraph 1 – subparagraph 1 a (new): Payment service providers distributing the digital euro may offer their own front-end services or front-end services offered by other payment service providers.

AddedArticle 28 – paragraph 1 – subparagraph 2: deleted

AddedArticle 28 – paragraph 2: 2. Front-end services provided by the European Central bank referred to in paragraph 1 of this Article, shall not provide for customer relationships, that shall solely be provided by payment service providers in their role in the digital euro distribution as laid down in Article 13 and under Directive (EU) 2015/2366. The European Central Bank shall not have access to any personal data in relation to the front-end services developed by the European Central Bank and used by the payment services providers.

AddedArticle 28 – paragraph 3 – point a: (a) digital euro payment services use the official digital euro logo and comply with the technical and security standards set up or certified by the European Central Bank;

AddedArticle 28 – paragraph 3 a (new): 3a. The European Central Bank shall develop the technical, operational and security standards, including the certification process where applicable, to the offline digital euro devices and the digital euro payment accounts to ensure the resilient, safe and smooth execution of payments.

AddedArticle 28 – paragraph 3 b (new): 3b. For the purpose of Chapter VI, payment services providers outside the euro area shall distribute only offline digital euro devices certified by the European Central Bank pursuant to paragraph 3a or by the corresponding national central bank if that is provided for in the arrangements referred to in Articles 18(1) and 19(1).

AddedArticle 29 – paragraph 1: 1. Payment service providers executing online digital euro payment transactions shall verify whether any of their digital euro users are listed persons or entities. Payment service providers shall carry out such verifications immediately after the entry into force of any new or amended restrictive measures adopted in accordance with Article 215 TFEU providing for asset freeze or prohibition of making funds or economic resources available, and at least once every calendar day.

AddedArticle 29 – paragraph 2: 2. During the execution of an online digital euro payment transaction, the payer’s payment service provider and the payee’s payment service provider involved in the execution of that transaction shall not verify whether the payer or the payee whose digital euro payment accounts are used for the execution of that digital euro payment transaction are listed persons or entities in addition to carrying out verifications under paragraph 1.

AddedArticle 29 – paragraph 3: 3. A payment service provider that has failed to carry out the verifications referred to in paragraph 1 and executes an online digital euro payment transaction causing another payment service provider involved in the execution of that digital euro payment transaction to fail to freeze assets of listed persons or entities, or to make funds or economic resources available to such persons or entities, shall compensate the financial damage caused to the other payment service provider resulting from penalties imposed on that other payment service provider under restrictive measures adopted in accordance with Article 215 TFEU providing for asset freeze or prohibition of making funds or economic resources available.

AddedArticle 29 – paragraph 3 a (new): 3a. Payment service providers providing offline digital euro devices shall verify whether any of the persons requesting an offline digital euro device are listed persons or entities. Payment service providers shall carry out such verifications immediately after the entry into force of any new or amended restrictive measures adopted in accordance with Article 215 TFEU providing for asset freeze or prohibition of making funds or economic resources available, and at least once every calendar day.

AddedArticle 30 – paragraph 3: 3. Final settlement of offline digital euro payment transactions shall occur at the moment when the funds in the payer’s offline digital euro device are directly transferred to the payee’s offline digital euro device without any intermediation of any payment service provider or digital euro settlement infrastructure.

AddedArticle 31 – paragraph 1: 1. Payment service providers shall enable online digital euro users at their request to switch their digital euro payment accounts to other payment service providers while maintaining the same account number.

AddedArticle 31 – paragraph 2: 2. In exceptional circumstances where a payment service provider is operationally not in a position to provide online digital euro payment services to digital euro users for a prolonged period of time, or has lost the online digital euro payment account-related data concerned, the European Central Bank and national central banks may authorise the switching of digital euro payment accounts held with that payment service provider to another payment service provider designated by the digital euro user. That switching shall enable the new payment service provider to complete the switching without relying on the unavailable payment service provider.

AddedArticle 32 – paragraph 1: 1. The European Central Bank shall facilitate the fraud detection and prevention tasks that payment service providers shall perform under Directive (EU) 2015/2366 by establishing a general fraud detection and prevention mechanism for online digital euro transactions to ensure the smooth and efficient functioning of the digital euro. That general fraud detection and prevention mechanism may be operated directly by the European Central Bank or by the providers of support services designated by the European Central Bank.

AddedArticle 32 – paragraph 4: 4. For the purpose of this Article, payment service providers shall provide the fraud detection and prevention mechanism with information referred to in Annex V payment service providers shall implement appropriate technical and organisational measures including state-of-the-art security and privacy-preserving measures to ensure that the European Central Bank or the providers of support services shall not be able to directly or indirectly identify the digital euro users on the basis of the information provided to the fraud detection and prevention mechanism.

AddedArticle 32 – paragraph 4 a (new): 4a. The European Central Bank shall put in place state-of-the-art technical safety measures to ensure that for the digital euro the incidence of fraud is not higher than that observed for comparable digital means of payment and, specifically for the offline digital euro, the incidence of double spending or counterfeiting is not higher than for cash.

AddedArticle 33 – paragraph 1: 1. Without prejudice to Article 6 paragraph (7) of Regulation (EU) 2022/1925, original equipment manufacturers of mobile devices and providers of electronic communication services within the meaning of Article 2(1) Directive (EU) 2018/1972 of the European Parliament and of the Council47 shall allow providers of front end services and providers of European Digital Identity Wallets effective interoperability with, and access for the purposes of interoperability to, the hardware features and software features necessary for storing and transferring data to process online or offline digital euro transactions, on fair, reasonable and non-discriminatory terms. / 47 Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018, establishing the European Electronic Communications Code (OJ L 17.12.2018, p. 36).

AddedArticle 34 – title: Processing personal data by payment service providers

AddedArticle 34 – paragraph 1 – subparagraph 1 – point a: (a) the enforcement of limits, including the verification of whether prospective or existing digital euro users have an offline digital euro device or digital euro accounts with another payment service providers, as referred to in Article 16;

AddedArticle 34 – paragraph 1 – subparagraph 1 – point b: (b) funding and defunding as referred to in Article 13 (2) to (3), and digital euro payment transactions as referred to in Article 13(4);

AddedArticle 34 – paragraph 1 – subparagraph 1 – point c: (c) the provision of offline digital euro as referred to in point (c) of Annex I;

AddedArticle 34 – paragraph 2: 2. For the purposes referred to in paragraph 1 (a) to (c), of this Article, Annex V lays down the types of personal data.

AddedArticle 34 – paragraph 3 – subparagraph 1: The Commission is empowered to adopt delegated acts in accordance with Article 38 to update the types of personal data listed in Annex V.

AddedArticle 34 – paragraph 3 – subparagraph 2: Payment service providers shall be considered to be the controllers of personal data as regards the purposes referred to in paragraph 1 of this Article. Where an online digital euro payment account held by one payment service provider is linked with a non-digital euro payment account held by another payment service provider in accordance with Article 13(4), these payment service providers shall be joint controllers.

AddedArticle 34 – paragraph 4: 4. Payment service providers shall implement appropriate technical and organisational measures including state-of-the-art security and privacy-preserving measures to ensure that any data communicated to the European Central Bank and the national central banks or to providers of support services do not directly or indirectly identify individual digital euro users or link them to specific transactions.

AddedArticle 35 – paragraph 1 – point a: (a) provision of access for payment service providers to the online digital euro settlement infrastructure and support the exchange of messages between payment service providers;

AddedArticle 35 – paragraph 1 – point a a (new): (aa) provision of access for online digital euro users to the European Central Bank front-end services;

AddedArticle 35 – paragraph 1 – point c: (c) safeguarding the security, resilience and integrity of the digital euro settlement infrastructure of the online digital euro accounts and of local storage devices for the offline digital euro devices;

AddedArticle 35 – paragraph 1 – point d: (d) supporting verification by payment service providers of whether a prospective user already has online digital euro payment accounts with other payment service providers in order to prevent the circumvention of limits in accordance with Article 16;

AddedArticle 35 – paragraph 1 – point e: (e) in exceptional circumstances as defined in Article 31(2), authorising payment service providers in switching online digital euro payment accounts held with a payment services provider to another payment service providers designated by the online digital euro user.

AddedArticle 35 – paragraph 2: 2. For the purposes referred to in paragraph 1, Annex VI lays down the types of personal data.

AddedArticle 35 – paragraph 3: 3. The Commission is empowered to adopt delegated acts in accordance with Article 38 to update the types of personal data listed in Annex VI.

AddedArticle 35 – paragraph 4: 4. Personal data processed for tasks referred to in paragraph 1 shall be supported by appropriate technical and organisational measures including state-of-the-art security and privacy-preserving measures. This shall include the clear segregation of personal data to ensure that the European Central Bank and the national central banks cannot directly or indirectly identify individual digital euro users or link them to specific transactions.

AddedArticle 35 – paragraph 5: 5. The European Central Bank shall be considered the controller of personal data as regards to the purposes referred to in paragraphs 1 and 8 of this Article. When the European Central Bank carries out a task referred to in paragraphs 1 and 8 jointly with the national central banks, they shall be joint controllers for that task.

AddedArticle 35 – paragraph 7: 7. Where the European Central Bank decides not to confer tasks referred to in Articles 27 and 32 upon providers of support services, the European Central Bank may process the types of personal data referred to in Annex VII subject to the requirements referred to in paragraph 4 of this Article.

AddedArticle 35 – paragraph 8: 8. For purpose of supporting the task of payment service providers to enforce the limits in accordance to Article 16 and ensuring the emergency switching upon the request of the user in accordance with Article 31(2), the ECB may jointly with national central banks establish a single access point of digital euro user identifiers and the related digital euro holding limits as referred to in point (4) of Annex VI. The European Central Bank shall implement appropriate technical and organisational measures including state-of-the-art security and privacy-preserving measures to ensure that the identity of individual digital euro users cannot be inferred from the information accessed via the single access point by entities other than payment service providers whose customer or potential customer is the digital euro user.

AddedArticle 36 – title: Processing personal data by providers of support services

AddedArticle 36 – paragraph 1 – introductory part: 1. Where the European Central Bank decides to confer tasks referred to in Article 27 and 32 upon providers of support services, providers of support services shall provide payment-related services across payment service providers. In such a situation, payment service providers perform a task in the public interest, where they process personal data for the following purposes:

AddedArticle 36 – paragraph 2: 2. For the purposes referred to in paragraph 1, Annex VII lays down the types of personal data.

AddedArticle 36 – paragraph 3: 3. The Commission is empowered to adopt delegated acts in accordance with Article 38 to update the types of personal data listed in Annex VII.

AddedArticle 36 – paragraph 4: 4. The processing of personal data for the purposes referred to in paragraph 1 shall only take place when appropriate technical and organisational measures including state-of-the-art security and privacy-preserving measures are implemented to ensure that the providers of support services cannot directly or indirectly identify individual digital euro users or link them to specific transactions.

AddedArticle 36 – paragraph 5: 5. The providers of support services shall be considered to be the controllers of personal data as regards the purposes referred to in paragraph 1 of this Article. This paragraph is without prejudice to the European Central Bank and the national central banks appointing the operators of any payment-related services across payment service providers and auditing of the service performance level without processing any personal data.

AddedArticle 37 – paragraph 2: 2. Transaction data shall not be obtained or retained by payment service providers or by the European Central Bank and the national central banks.

AddedArticle 37 – paragraph 3: 3. Payment service providers shall obtain and retain data of funding and defunding for storing digital euros on payment instruments in accordance with Article 40 of Directive (EU) 2015/849 and national provisions transposing that Article. Payment service providers shall, upon request, make those data available to the Financial Intelligence Unit and other competent authorities as referred in Article 2(44) of Regulation 2024/1624.

AddedArticle 37 – paragraph 4 – point b: (b) the identifier of the offline digital euro device;

AddedArticle 37 – paragraph 4 – point d: (d) the digital euro payment accounts or non digital euro payment accounts numbers used for funding and defunding.

AddedArticle 37 – paragraph 5: 5. The Commission is empowered to adopt delegated acts setting additional offline digital euro payment transaction limits and holding limits due to AML/CFT considerations in addition to those referred to in Article 16 derived from financial stability considerations. / The applicable holding limit shall be the lower of: (i) the limit established pursuant Article 16, or (ii) any AML/CFT-related limit adopted by the Commission in accordance with the first subparagraph