Changes from report parliamentary committee draft to plenary report

Added1. Payment service providers shall offer any authentication method as defined in Article 3, point (59) of [PSR] for the purposes of the provision of digital euro. User authentication shall be possible with the European Digital Identity Wallets.

Added2. ▌ Payment service providers providing digital euro payment services shall offer their users the possibility to rely on the functionalities of their European Digital Identity Wallets in accordance with Article 5a of Regulation (EU) [please insert reference – proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 910/2014].

Added2 a. Where a provider of a European Digital Identity Wallet allows for the integration and use of payment instruments, payment service providers shall offer the possibility of integrating their digital euro payment account in their European Digital Identity Wallet, and ensure, upon request by the users, that those users are able to process and execute online and offline digital euro payment transactions via their European Digital Identity Wallets.

Added1. The European Central Bank shall seek to use to the extent possible ▌ and, where appropriate, the existing infrastructures, protocols and standards governing private digital means of payment, including the use of open standards.▌

Added▌

Added2. Where the European Central Bank concludes that there is a need to develop new infrastructures, protocols or standards for digital euro payment services, it shall ensure the interoperability of those infrastructures, protocols and standards to the extent possible by the use of open standards to allow their use by private digital means of payment.

Added1. Without prejudice to any disputes relating to the lawfulness of ▌ personal data processing, payment service providers shall establish and apply appropriate and effective procedures for handling and resolving any complaints received from digital euro users. Those procedures shall offer a level of protection that is at least equivalent to that available for comparable payment instruments. Directive (EU) 2020/1828 of the European Parliament and of the Council shall apply to the representative actions concerning infringements of provisions of this Regulation that harm or may harm the collective interests of consumers.

Added2. The European Central Bank and the national central banks shall ensure that mechanisms are available ▌ to facilitate the exchange of messages between payment service providers for the resolution of pre-disputes and disputes, including commercial disputes, related to digital euro payment transactions inducing but not limited to, technical and fraud-related disputes, as referred to in Article 5(3). Those mechanisms may be operated directly by the European Central Bank and the national central banks or by the providers of support services designated by the European Central Bank. Dispute settlement mechanisms shall be easily accessible and usable for digital euro users. The European Central Bank and the national central banks shall not bear liability in commercial fraud or fraud-associated disputes related to digital euro payment transactions.

Added3. The European Central Bank shall ▌ act as the dispute-settlement body for disputes among payment service providers relating to the application of the rulebook governing the operation of the digital euro. The role and functions of the European Central Bank in that capacity shall be established by contract between the European Central Bank and all payment service providers distributing the digital euro. To perform those functions, the European Central Bank shall adopt internal rules and a governance framework for dispute settlement that ensures no interference and full independence from the European Central Bank payment-system oversight functions. Decisions issued by the European Central Bank under this mechanism shall be final and binding on all participating payment service providers and directly enforceable vis-à-vis their users through the payment service providers’ contractual obligations without prejudice to the right to seek redress before judicial authorities in accordance with Union and national law.

Added3 a. The European System of Central Banks shall bear liability for any loss or damage attributable to its actions or omissions in relation with the infrastructure or functionalities operated by the European Central Bank or the national central banks governing the operation of the digital euro. The provision of the digital euro user interface by payment service providers in their role in the digital euro distribution as laid down in Article 13 of this Regulation and under Directive (EU) 2015/2366, shall be without prejudice to any right of recourse or indemnification of payment service providers against the European System of Central Banks for any loss or damage attributable to the digital euro user interface provided by the European Central Bank.

Added3 b. In the event of any system outage, technical malfunction, or disruption of the digital euro settlement infrastructure, the liability of the European Central Bank to the user is unaffected. No loss of online digital euro holdings shall be borne by the user as a result of such disruptions.

Added1. Payment service providers distributing the digital euro shall provide digital euro users with at least one option of digital euro user interface, whether made available by the European Central Bank, their own digital euro user interfaces or digital euro user interfaces offered by other payment service providers to allow digital euro users to access and use basic digital euro payment services in accordance with Annex II.

AddedDesignated payment service providers as referred to in Article 14(3) shall provide digital euro users with the user interface made available by the European Central Bank. They may also offer additional digital euro user interfaces.

Added▌Digital euro user interfaces made available by payment service providers shall comply with the standards referred to in Article 22, and shall allow users to access in a single place all digital euro services, including both the online and offline digital euro payment functionalities.

Added(b) ▌

Added▌

Added2. ▌The European Central Bank shall not have access to any personal data in relation to the digital euro user interfaces developed by the European Central Bank and used by the payment services providers.

Added3. Payment service providers distributing the digital euro shall ensure that:

Added(a) digital euro payment services use the official digital euro logo;

Added(b) digital euro payment accounts can be quickly and easily accessed to and used by digital euro users.

Added1. Payment Service Providers offering digital euro payment transactions shall verify whether any of their digital euro users are ▌ persons or entities subject to targeted financial restrictive measures. Payment service providers shall carry out such verifications immediately after the entry into force of any new ▌ restrictive measures, and immediately after the entry into force of any amendment to such targeted financial measures, and at least once every calendar day.

Added1 a. Paragraph 1 is without prejudice to actions taken by payment service providers in order to comply with:

Added(a) restrictive measures, other than targeted financial restrictive measures, adopted in accordance with Article 215 TFEU;

Added(b) restrictive measures that are not adopted in accordance with Article 215 TFEU; or

Added(c) Union law on the prevention of money laundering and countering the financing of terrorism.

Added1 b. In the event of an undue interruption, restriction or denial of access to digital payments affecting a natural person or legal persons, resulting from the extra-territorial application of legislation adopted by a third country, or actions based thereon or resulting therefrom, as specified in the Annex to Council Regulation (EC) No 2271/96, the Commission may, upon request of a Member State, and after consultation of the European Central Bank, adopt temporary and proportionate exceptional measures offered by designated payment service providers as referred to in Article 14(3) of this Regulation, where necessary to restore or to safeguard effective access to digital euro payment services for those persons.

Added1 c. Requests for exceptional measures referred to in paragraph 1b shall include evidence that the affected natural or legal person falls within the scope of paragraph 1 and of the interruption, restriction or denial of access to digital payment services. The Commission shall assess the request and adopt a decision within a reasonable timeframe with a view to ensuring continued access to digital euro payment services.

Added1 d. Exceptional measures as referred to in paragraph 1b shall be strictly limited in scope and duration, shall apply only to the affected natural person or legal person, and shall not exceed what is necessary to protect Union operators from the effects of the extra-territorial application of sanctions listed in the Annex to Regulation (EC) No 2271/96. The exceptional measures shall be renewed only where the conditions justifying their adoption persist.

Added1 e. The exceptional measures as referred to in paragraph 1b shall comply with the principles of necessity, proportionality, financial stability, and the applicable requirements on data protection and cybersecurity, anti-money laundering and countering the financing of terrorism.

AddedThe exceptional measures shall be without prejudice to any Union restrictive measures and shall not permit the circumvention of any sanctions adopted by the Union.

Added2. During the execution of a digital euro payment transaction, the payer’s payment service provider and the payee’s payment service provider involved in the execution of that transaction shall not verify whether the payer or the payee whose digital euro payment accounts are used for the execution of that digital euro payment transaction are ▌persons or entities subject to targeted financial restrictive measures in addition to carrying out verifications under paragraph 1.

Added3. A payment service provider that has failed to carry out the verifications referred to in paragraph 1 and executes a digital euro payment transaction causing another payment service provider involved in the execution of that digital euro payment transaction to fail to freeze assets of listed persons or entities, or to make funds or economic resources available to such persons or entities, shall compensate the financial damage caused to the other payment service provider resulting from penalties imposed on that other payment service provider under restrictive measures adopted in accordance with Article 215 TFEU providing for asset freeze or prohibition of making funds or economic resources available.

Added1. Online and offline digital euro payment transactions shall be settled instantaneously.

Added2. Final settlement of online digital euro payment transactions shall occur at the moment of recording the transfer of the digital euros concerned from the payer to the payee in the digital euro settlement infrastructure approved by the Eurosystem. The settlement infrastructure shall be designed in such a way that neither the European Central Bank nor the national central banks are able to identify a specific digital euro user.

Added3. Final settlement of offline digital euro payment transactions shall occur at the moment when the funds in the payer’s local storage device are directly transferred to the payee’s local storage device. The transfer shall be without any intermediation of any payment service provider and without any need for a centralised digital euro settlement infrastructure for final settlement.

Added1. Payment service providers shall, either at the user’s request or with the user’s consent, switch the provision of digital euro payment services to other payment service providers without undue delay. When switching is carried out in accordance with this Article, the digital euro payment account number shall be maintained.

Added1 a. In cases where the digital euro payment account is held jointly by two or more legal account holders, request for switching shall be made by all of them.

Added2. In exceptional circumstances as referred to in Article 24a where a payment service provider is operationally not in a position to provide digital euro payment services to digital euro users ▌, or has lost the digital euro payment account-related data concerned, the European Central Bank or the relevant national central bank may authorise, with the user’s consent, the switching of digital euro payment accounts held with that payment service provider to another payment service provider designated by the digital euro user. That switching shall enable the new payment service provider to complete the switching without relying on the unavailable payment service provider. The switching service shall not result in additional data being collected by the European Central Bank and the national central banks other than the data to which they already have access.

Added1. Before the issuance of the digital euro, the European Central Bank shall ensure that a general fraud detection and prevention mechanism for online digital euro transactions is in place in order to facilitate and support the fraud detection and prevention tasks that payment service providers are required to perform under the [PSR] and to ensure the smooth and efficient functioning of the digital euro, while providing necessary safeguards to make the processing compliant with the principles of necessity and proportionality and to respect appropriate storage limitation. That general fraud detection and prevention mechanism may be operated directly by the European Central Bank and the national central banks or by the providers of support services designated by the European Central Bank.

Added2. The European Central Bank shall consult the European Data Protection Supervisor and AMLA prior to developing the details on the technical and operational elements of the fraud detection and prevention mechanism.

Added3. The fraud detection and prevention mechanism shall:

Added(a) assess the exposure to fraud risk of online digital euro transactions in real-time at the exclusive use of payment service providers before the transaction is introduced into the digital euro settlement infrastructure and provide early warning alerts to anticipate and mitigate risks;

Added(b) support payment service providers in securing payment information and in detecting fraudulent transactions in online digital euro payment transactions that have been settled.

Added(b a) offer an information sharing arrangement in accordance with Articles 83(3) and (4) of Regulation [PSR];

Added(b b) proactively provide aggregated intelligence anonymised data and regular reports on fraud patterns and on coordinated or emerging threats across the digital euro ecosystem;

Added(b c) enable the implementation of state-of-the-art technical features, including risk-based control triggers, that enhance the security and usability of online digital euro transactions, while ensuring that any automated measures are strictly limited to fraud prevention purposes.

Added4. For the purpose of this Article, payment service providers shall provide the fraud detection and prevention mechanism with information referred to in Annex V. Payment service providers shall implement appropriate technical and organisational measures including state-of-the-art security and privacy-preserving measures to ensure that the European Central Bank or the providers of support services shall not be able to ▌identify the digital euro users on the basis of the information provided to the fraud detection and prevention mechanism.

Added4 a. The European Central Bank shall put in place state-of-the-art technical safety measures that aim to ensure that for the digital euro the incidence of fraud is not higher than that observed for comparable digital means of payment and, specifically for the offline digital euro, the incidence of double spending or counterfeiting is not higher than for cash.

Added4 b. When implementing the technical and organisational measures referred to in paragraphs 4 and 4a of this Article, payment service providers and the European Central Bank shall take into account the principles of data protection by design and by default, as defined in Regulation (EU) 2016/679, ensuring that the processing of personal data is carried out in such a manner that the personal data can no longer be attributed to an individual digital euro user without the use of additional information.

Added4 c. By three years from the first issuance of the digital euro, the European Central Bank shall submit a report to the European Parliament and to the Council assessing the use of the digital euro in fraudulent or illicit transactions, as well as the effectiveness of safeguards and mitigation measures applied.

Added1. Without prejudice to Article 6 ▌ (7) of Regulation (EU) 2022/1925▌, original equipment manufacturers of mobile devices and providers of electronic communications services as defined in ▌ Article 2(4) of Directive (EU) 2018/1972 shall ensure that providers of the digital euro user interface and European Digital Identity Wallets, as well as third-party technical service providers acting on their behalf, are able to interoperate effectively with, and obtain, access for ▌interoperability purposes to, the hardware features and software functionalities, including those existing functionalities already in use for other digital means of payment, required for the secure processing and execution of online or offline digital euro payment transactions, on fair, reasonable and non-discriminatory terms.

Added2. As part of the detailed measures, rules and standards referred to in Article 5(2) and Article 23a, the European Central Bank, shall adopt the reference standards, technical specifications and procedures within six months of the authorisation of the issuance of the digital euro referred to in Article 4(1) of this Regulation. ▌

Added3. For the purpose of applying fair, reasonable and non-discriminatory terms pursuant to paragraph 1, original equipment manufacturers of mobile devices and providers of electronic communication services referred to in paragraph 1 shall publish general conditions of effective interoperability and access. Such general conditions shall include a European Union-based alternative dispute settlement mechanism. The dispute settlement mechanism shall be without prejudice to the right to seek redress before judicial authorities in accordance with Union and national law.

Added3 a. For the purpose of ensuring effective interoperability and access for providers of front-end services, providers of European Digital Identity Wallets and third-party technical support providers acting on their behalf in accordance with paragraph 1, the Commission, with the technical assistance of the European Central Bank, is empowered to adopt implementing acts, specifying the measures that the original equipment manufacturers of mobile devices and providers of electronic communication services referred to in paragraph 1 are to implement in order to effectively comply with the obligations laid down in that paragraph. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 39. The Commission shall adopt implementing acts within six months of the authorisation of the issuance of the digital euro referred to in Article 4(1).

Added3 b. Original equipment manufacturers of mobile devices and providers of electronic communication services referred to in paragraph 1 shall comply with the standards, technical specifications and procedures referred to in paragraph 2 and with the implementing acts referred to in paragraph 3a.

Added1. Payment service providers shall comply with a legal obligation under Article 6(1)(c) GDPR where they process personal data that is strictly necessary for the following purposes:

Added(a) the enforcement of limits, including the verification of whether prospective or existing digital euro users have digital euro accounts with another payment service provider, as referred to in Article 16;

Added(b) funding and defunding as referred to in Article 13 (2a), ▌(2b), and digital euro payment transactions as referred to in Article 13(4);

Added(c) the provision of offline digital euro ▌ local storage devices as referred to in point (ga) of Annex II;

Added(d) compliance with Union sanctions as referred to in Article 29;