Legalize / European Union / Decision

Decision (EU) 2019/1349 of the European Central Bank of 26 July 2019 on the procedure and conditions for exercise by a competent authority of certain powers in relation to oversight of systemically important payment systems (ECB/2019/25)

Type Decision

Publication 2019-08-16

Last updated 2021-05-25

State In force

Department European Central Bank

Source EUR-Lex

articles 13

Reform history JSON API

Article 1

Definitions

The terms used in this Decision shall have the same meaning as the terms defined in Regulation (EU) No 795/2014 (ECB/2014/28) and the following definitions shall also apply:

(1) ‘independent expert’ means a natural or a legal person which has no relationship that raises a conflict of interest regarding the SIPS or the SIPS operator or its controlling shareholders and has specific expertise in conducting investigations and reviews of financial market infrastructures with a focus on financial regulation, information systems and communication technology, risk management, financial reporting or auditing;

(2) ‘independent review’ means an evaluation of the operation of a SIPS the purpose of which is to provide: insight into any risks and vulnerabilities; assurance on the progress made by a SIPS operator to mitigate any risks and vulnerabilities; and validation of the effectiveness of a SIPS operator's policies, procedures and controls to mitigate any risks and vulnerabilities;

(3) ‘investigation’ means an examination and analysis of facts, documents, information and events, and an interpretation of the findings thereof, using known and commonly used investigative methods;

(4) ‘on-site inspection’ means an examination taking place at the location of the SIPS operator or at a relevant location related to the activities of a SIPS operator, including at the location of a critical service provider insofar as the contractual arrangements between the SIPS operator and that critical service provider allow for such an inspection, the purpose of which is to provide an in-depth analysis of, amongst other things, business models or governance, different risks and internal control systems;

(5) ‘on-site inspection team’ means a group of experts from the competent authority or its delegate or, as the case may be, another Eurosystem central bank, led by a head of team, the purpose of which is to conduct an on-site inspection;

(6) ‘critical service provider’ means a service provider that has a direct contractual arrangement with a SIPS operator to provide, on a continuous basis, services to that SIPS operator, and potentially to the participants in the SIPS, which are essential for ensuring information confidentiality and integrity and service availability, as well as the smooth functioning of the core operations of the SIPS;

(7) ‘another authority’ means an authority responsible for oversight of a SIPS, other than the competent authority or the central banks overseeing or supervising the critical service providers of a SIPS, to which the power of conducting on-site inspections may be delegated.

Article 2

General principles

This Decision sets out the procedure a competent authority shall follow and the conditions it shall comply with in exercising its powers under Article 21(1) of Regulation (EU) No 795/2014 (ECB/2014/28).

1a. Where two Eurosystem central banks are designated as competent authorities in relation to a given SIPS for the purposes of Regulation (EU) No 795/2014 (ECB/2014/28), and unless otherwise specifically provided for in the decision pursuant to Article 1(2) of that Regulation that identifies the relevant payment system as a SIPS, the following principles shall apply:

(a) the powers and rights of a competent authority as set out in this Decision may be exercised either individually by either one of the two Eurosystem central banks designated as competent authorities or jointly by both;

(b) any obligation of the competent authority to act in a prescribed manner or undertake a certain action in relation to the exercise of a given power as set out in this Decision shall be an obligation of the Eurosystem central bank that exercises the given power or, where the given power is exercised by both Eurosystem central banks as designated competent authorities jointly, shall be an obligation of each of them;

(c) the two Eurosystem central banks designated as competent authorities shall coordinate between themselves any interactions with, and any requests addressed to, the operator of the SIPS concerned;

(d) any obligation of a SIPS operator, or of an independent expert – as the case may be – to a competent authority pursuant to this Decision shall be an obligation to each of the two Eurosystem central banks designated as competent authorities, and a response to any request of either or both of them pursuant to this Decision shall be submitted to eachof them.

When exercising its powers under Article 21(1) of Regulation (EU) No 795/2014 (ECB/2014/28), a competent authority shall:

(a) have regard to the objectives of Regulation (EU) No 795/2014 (ECB/2014/28) and their applicability to the circumstances of the case and only exercise such powers as are proportional to those objectives and the circumstance of the case in order to avoid any unnecessary burden on a SIPS operator;

(b) either apply the same requirements consistently to similar SIPS operators or justify the different treatment of SIPS operators.

Without prejudice to Article 11, the competent authority shall notify a SIPS operator in writing of its decision to exercise either of the powers set out in points (b) or (c) of Article 21(1) of Regulation (EU) No 795/2014 (ECB/2014/28).

The decision referred to in paragraph 3 shall set out the following:

(a) its legal basis and a statement of reasons;

(b) the power to be exercised;

(d) if the power to be exercised is the power to conduct on-site inspections and the written notification to the SIPS operator concerned is omitted in accordance with Article 11, the reasons for proceeding without informing the SIPS operator in advance;

(e) the grounds on which the SIPS operator may challenge the decision.

The independent expert or on-site inspection team, as applicable, shall have the following powers:

(a) the right to require the submission of information and documents in accordance with Article 3;

(b) the right to examine the books and records of the SIPS operator and take copies or extracts from such books and records, including those related to services performed by critical service providers of the SIPS insofar as the respective contractual arrangements between the SIPS operator and a critical service provider allow;

(c) the right to obtain written or oral explanations from any representative or member of staff of the SIPS operator or its critical service providers (in the latter case only insofar as the respective contractual arrangements between the SIPS operator and a critical service provider allow and in relation to the services provided by that critical services provider to the SIPS);

(d) interview any other person that is legally or contractually obliged to provide information for the purpose of collecting information relating to the subject matter of the investigation, independent review or on-site inspection.

On conclusion of an investigation or independent review, the independent expert shall provide its draft report to the SIPS operator and the competent authority and subsequently its final report to the competent authority in the format and structure specified by the latter. The independent expert shall ensure that all findings within the report are evidence-based and, to the best of its knowledge and belief, accurate.

On conclusion of an on-site inspection, the competent authority shall provide its draft report to the SIPS operator.

The SIPS operator shall have the opportunity to comment in writing on a draft report provided by an independent expert or the competent authority. The SIPS operator's management board shall approve and sign the final report prior to submitting it or returning it to the competent authority or the independent expert, as applicable.

The obligation of professional secrecy shall apply to all persons with respect to their work in connection with investigations, independent reviews or on-site inspections. All the information exchanged under this Decision shall be treated as confidential, except where its disclosure is required by Union law or national law.

10.

Findings resulting from investigations, independent reviews or on-site inspections under Article 21 of Regulation (EU) No 795/2014 (ECB/2014/28) may be published by the competent authority either at a level of detail which does not identify an individual system or operator, or, otherwise, with the consent of the SIPS operator.

Article 3

Exercise of a competent authority's power to obtain information and documents

The competent authority may require a SIPS operator to provide all information and documents necessary for the efficient and effective conduct of the oversight functions conferred on it by Regulation (EU) No 795/2014 (ECB/2014/28), including information and documents to be provided at recurring intervals and in specified formats for oversight purposes.

When requiring a SIPS operator to provide information and documents in accordance with point (a) of Article 21(1) of Regulation (EU) No 795/2014 (ECB/2014/28), the competent authority shall specify the following:

(a) the information or document to be provided;

(b) the format of, and the process for the provision of, the information or document;

(c) the time limit for provision of the information or document and, if applicable, the intervals at which it is to be provided, without prejudice to the general obligation of a SIPS operator to respond without undue delay.

The SIPS operator shall provide the information or document within the time limit and, if applicable, at the intervals requested unless it can provide evidence to the competent authority that one of the following circumstances applies:

(a) the information or document is not immediately available;

(b) the information or document is not solely owned by the SIPS operator, or does not solely relate to its activity, and consent must therefore be obtained from a third party for providing that information or document to the competent authority.

If the competent authority is satisfied with the evidence that one of the circumstances applies, it may grant to the SIPS operator additional time to provide the relevant information or document.

The SIPS operator and its staff shall not be exempted from complying with their obligations under this Decision to provide information or documents on the grounds of professional secrecy.

The SIPS operator shall include clauses in its contractual arrangements with third parties, including with critical service providers, allowing for the sharing of information and documents with the competent authority, the independent expert and the on-site inspection team in relation to the service provided by these third parties to the SIPS.

Article 4

Exercise of a competent authority's power to require the appointment of an independent expert

The competent authority may require the SIPS operator to appoint an independent expert to conduct either an investigation in accordance with Article 5 or an independent review in accordance with Article 6. The competent authority shall notify a SIPS operator of its decision that the SIPS operator shall appoint an independent expert in accordance with Article 2(4). The SIPS operator shall bear all costs related to the appointment of an independent expert.

When appointing an independent expert, the SIPS operator shall consult with its critical service provider where relevant.

The competent authority shall ensure that the decision by which it requires the SIPS operator to appoint an independent expert shall include at least the following requirements and information:

(a) that the independent expert to be appointed by the SIPS operator has not been directly or indirectly involved in the past two years in the operation or oversight of the relevant SIPS, and has the specific expertise needed for the purposes of the investigations and independent reviews, including, for example, expertise in financial market infrastructures, financial regulation, information systems and communication technology, risk management, financial reporting or auditing;

(b) details of the role, duties, powers and required field of expertise, ability and knowledge of the independent expert;

(c) that the SIPS operator ensure that the independent expert has the requisite qualifications, ability and knowledge and carries out its functions free of any conflict of interest and in accordance with the requirements set out in paragraphs 5 to 7 of this Article;

(d) the time limit by which the independent expert shall be appointed;

(e) that the SIPS operator inform the competent authority how the requirements imposed by the competent authority have been satisfied and provide any relevant guidance in this respect;

(f) that the SIPS operator provide the contact details of the independent expert for the purposes of paragraph 13 of this Article.

The decision by which the competent authority requires the SIPS operator to appoint an independent expert may contain requirements in addition to those set out in paragraph 3 above. The SIPS operator shall annex the decision by which the competent authority requires it to appoint an independent expert to its contractual arrangement with the independent expert.

In the performance of its functions, an independent expert shall have all the powers referred to in Article 6(3).

The SIPS operator shall ensure that the independent expert appointed to carry out an investigation or independent review has the following minimum qualifications:

(a) a completed university degree or an equivalent level of qualification; or

(b) a certificate or diploma granted or recognised by an EU Member State of professional competence in one of the fields in which the independent expert is required to have expertise for the purposes of the investigation or independent review.

Where necessary to ensure practical experience in addition to the qualifications required under paragraph 6, the competent authority may also require the SIPS operator to ensure that the independent expert has experience (preferably of 3 years or more) of performing similar investigations or independent reviews or equivalent examinations for firms within the financial sector. However, before imposing any additional requirement for practical experience the competent authority shall take into account the potential novelty of the investigation or independent review and the restrictions to potential future experts such additional requirements may impose. The SIPS operator shall ensure that the independent expert is subject to principles of professional ethics, covering at least its public-interest function, its integrity and objectivity and its professional competence and due care.

When recruiting the independent expert, the SIPS operator shall require sufficient proof of the qualifications and experience referred to in paragraphs 6 and 7. It shall inform the competent authority of the identity of the independent expert selected and, if the competent authority so requests, of how the appointment of the independent expert complies with the requirements in paragraphs 6 and 7. The competent authority shall retain the right to require the SIPS operator to appoint a different independent expert, if it deems that the requirements set out in this Decision or in the decision requiring the appointment of the independent expert are not met by the independent expert chosen by the SIPS operator.

Unless specified by the competent authority, the SIPS operator may agree with the independent expert the exact timing for the start and the duration of the investigation or independent review, depending on the scope provided by the competent authority, including in those cases where the competent authority requests the independent review to be made periodically.

10.

The SIPS operator shall ensure that the independent expert has access to all the documents and information necessary for the purposes of the investigation or independent review in accordance with Articles 5 and 6 throughout the whole duration of the investigation or independent review. With regard to point (c) of Article 2(5), the SIPS operator shall include clauses in its contractual arrangements with its critical service providers which allow for the independent expert to have access to the explanations of representatives or members of staff of the critical service providers and for transmitting information to the central bank overseeing or supervising the critical service provider in accordance with Article 9(4).

11.

The SIPS operator shall allow the independent expert to conduct investigations or independent reviews at the SIPS operator's premises, whenever the competent authority assesses that this will achieve the efficient and effective conduct of the investigations or independent reviews.

12.

The SIPS operator shall ensure that the contractual arrangements for the provision of the independent expert's services in respect to conducting investigations or independent reviews provides for the obligation of the independent expert to answer the questions of the competent authority on the findings after the end date to perform the independent review or the investigation has expired.

13.

The competent authority may communicate with the independent expert directly giving prior notice to the SIPS operator.

Article 5

Exercise of a competent authority's power to require the conduct of an investigation

The competent authority may require the SIPS operator to appoint an independent expert in accordance with Article 4 to conduct an investigation, if it considers that it is necessary to achieve the objectives set out in Regulation (EU) No 795/2014 (ECB/2014/28).

Article 6

Exercise of a competent authority's power to require the conduct of an independent review

The competent authority may require the SIPS operator to appoint an independent expert in accordance with Article 4 to conduct an independent review, if it considers that it is necessary to achieve the objectives set out in Regulation (EU) No 795/2014 (ECB/2014/28).

The competent authority may require an independent review to take place on a one off basis or, in exceptional cases, at periodic intervals within a pre-defined scope, linked to operational, security, risk management, business or legal grounds. If the competent authority requires an independent review at periodic intervals, then it shall specify and justify the frequency of those intervals and the scope of such independent review as well as its end date.

The scope of the independent review may cover one or more matters, chosen by the competent authority upon due justification. The independent expert shall have the power to collect any information from the SIPS that it deems necessary to provide a comprehensive understanding of the matter or matters within the scope of the independent review.

Article 7

Exercise of a competent authority's power to conduct on-site inspections

The competent authority may conduct an on-site inspection, or delegate the carrying out of on-site inspections to another authority in accordance with Article 8, if it considers that it is necessary to achieve the objectives set out in Regulation (EU) No 795/2014 (ECB/2014/28).

Without prejudice to Article 2(4) of this Decision, when the competent authority exercises the power to conduct on-site inspections, the inspection decision shall at a minimum specify:

(a) the subject matter and the purpose of the on-site inspection;

(b) the fact that any obstruction to the on-site inspection by the legal person subject thereto shall constitute a breach of Regulation (EU) No 795/2014 (ECB/2014/28), without prejudice to national law.

The competent authority shall notify the entity subject to an on-site inspection of the decision, and of the identity of the members of the on-site inspection team, at least 10 working days before the start of the on-site inspection.

The competent authority shall ensure that the on-site inspection is conducted within a predefined scope and timeframe which it determines in cooperation with the entity subject to an on-site inspection. However, if it deems necessary, the competent authority may extend the scope and timeframe of the on-site inspection during the inspection by a revised decision, which shall be notified to the entity subject to an on-site inspection.

The SIPS operator shall include clauses in its contractual arrangements with critical service providers, which allow for the on-site inspection to also take place at the location of the critical service provider. Such clauses shall allow the competent authority to involve the central bank overseeing or supervising the critical service provider in the on-site inspection process, including for the exchange of relevant information. The SIPS operator shall ensure that those contractual arrangements also allow for the competent authority to have access to written or oral explanations of representatives or members of staff of the critical service providers in relation to the service these provide to the SIPS. The SIPS operator shall also include clauses in the contractual arrangements with its critical service providers which give the competent authority access to information and findings from previous on-site inspections of the critical service provider of the same scope and nature which have already been performed by the central bank overseeing or supervising the critical service provider.

Article 8

Delegation of power to conduct on-site inspections

Subject to the conditions set out in the relevant applicable national law and the internal procedural rules of the competent authority, the competent authority may delegate the power to conduct on-site inspections to another authority provided that that authority and its inspection team both keep the information and documents obtained from the SIPS operator confidential and abide by the relevant principles of Article 7 as well as further internal organisational rules for an on-site inspection, and that the delegating competent authority shall retain full power over, and liability in respect of, the inspection.

The competent authority, another authority and the SIPS operator shall respect the confidentiality of the on-site inspection proceedings.

Article 9

Cooperation with authorities

The competent authority for a SIPS shall exercise the powers referred to in points (b) and (c) of Article 21(1) of Regulation (EU) No 795/2014 (ECB/2014/28) on the basis of a decision taken by it. If the competent authority is a national central bank, it shall inform the Eurosystem of such decision upon its adoption.

If a SIPS operator's staff obstruct an on-site inspection required by a competent authority in accordance with this Decision, the national central bank of the participating Member State concerned shall afford the members of the inspection team the necessary assistance in accordance with national law. To the extent necessary for the on-site inspection, this assistance shall include the sealing of any business premises and books or records. Where that power is not available to the national central bank concerned, it shall use its powers to request the necessary assistance of other national authorities.

If an on-site inspection or the assistance to be provided in accordance with paragraph 2 of this Article require authorisation by a judicial authority according to applicable national law, then the authority performing the on-site inspection shall apply for such authorisation.

When, as part of the investigation or independent review of the SIPS operator, the independent expert is required to exercise the rights set out in Article 2(5) with respect to the critical service providers of a SIPS, the competent authority shall inform the central bank overseeing or supervising the critical service provider of the intention to exercise those rights and may inform that central bank of the findings of the investigation or independent review after it is performed.

When an on-site inspection is deemed necessary to take place also at the location of a critical service provider of a SIPS, the competent authority shall inform the central bank overseeing or supervising the critical service provider of the intended on-site inspection prior to notifying the SIPS operator.

To the extent an on-site inspection of the same scope and nature was already performed by the central bank overseeing or supervising the critical service provider of a SIPS, the competent authority for the SIPS may choose to rely on the findings of such on-site inspection or perform an on-site inspection of its own. In this regard, the competent authority may ask the critical service provider to give access to the respective information and the findings which are available to it or to consent to the competent authority having access to these findings at the central bank. If there has been no on-site inspection performed yet or not one of the same scope and nature, the SIPS competent authority may, at its discretion, also perform the on-site inspection at the location of the critical service provider. In doing so, the competent authority, having regard to the powers and responsibilities of central banks, may involve the central bank overseeing or supervising the critical service provider in the process of the on-site inspection and may inform that central bank of the findings of the on-site inspection after it has been performed.

If the on-site inspection is deemed necessary to take place also at the location of a critical service provider of a SIPS, the competent authority shall also notify the critical service provider of the inspection at the same time as the SIPS operator in accordance with Article 2(4).

Article 10

Right to be heard and access to information

The independent expert or the on-site inspection team, as the case may be, shall take into account comments submitted by the SIPS operator during an independent review, an investigation or an on-site inspection and shall base their findings on facts on which the SIPS operator concerned has had the opportunity to comment.

When submitting the findings report to the competent authority, the independent expert or the on-site inspection team shall notify the SIPS operator. The SIPS operator shall be entitled to have access to the report, subject to the legitimate interest of other persons and legal entities in the protection of their business secrets. The right of access to the report shall not extend to confidential information affecting third parties.

Article 11

Unannounced on-site inspections

Notwithstanding Article 7(3), a competent authority is not obliged to inform an entity subject to an on-site inspection of such inspection in advance if there are indications that there exist facts of a serious nature that threaten the smooth functioning of the SIPS or that informing that entity of the need to proceed with an on-site inspection may undermine its results. In this case, the decision to proceed with an on-site inspection shall indicate the reasons to proceed without informing that entity in advance and shall be provided to that entity only once the inspection has started.

Article 12

Language regime between the competent authority and the SIPS operator

Any document which a SIPS operator subject to oversight pursuant to Regulation (EU) No 795/2014 (ECB/2014/28) sends to the competent authority according to Article 3 of this Decision may be drafted in any one of the official languages of the Union, chosen by the SIPS operator.

The SIPS operator subject to oversight may agree to exclusively use one Union official language in their written communication with the competent authority. The SIPS operator may revoke such agreement on the use of one language or may choose to waive this right occasionally and for certain written communications in order to accelerate the process, with no effect on future procedures. The revocation shall only affect the aspects of the oversight procedure which have not yet been carried out.

The SIPS operator may request the investigation, independent review or on-site inspection to be carried out in a Union official language other than the language agreed for the oversight process. If it intends to do so, the SIPS operator shall give sufficient advance notice of this intention to the competent authority or independent expert prior to the commencement of the investigation, independent review or on-site inspection so that necessary arrangements can be made.

Article 13

Final provisions

This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Reading this document does not replace reading the official text published in the Official Journal of the European Union. We assume no responsibility for any inaccuracies arising from the conversion of the original to this format.

This text is published under EUR-Lex's own terms of reuse, not a Legalize or public-domain licence. EUR-Lex
Creative Commons Attribution 4.0 International (CC BY 4.0)
© European Union, https://eur-lex.europa.eu — Source: EUR-Lex (Publications Office of the European Union). Reused under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Only EU legislation published in the printed Official Journal of the European Union is deemed authentic; consolidated texts are reproduced here for documentation purposes and have been reformatted to Markdown.