(7)A change in an interest or exchange rate which is more favourable to the payment service user concerned may be applied by a payment service provider without giving notice to the payment service user.
\n
(8)A change in an interest or exchange rate used in a payment transaction shall be implemented and calculated in a neutral manner that does not discriminate against payment service users.
\n
Termination
\n
Section 79
\n
79.(1) A payment service user may terminate a framework contract at any time, unless the parties have agreed on a period of notice.
\n
(2)The period of notice referred to in paragraph (1) shall not exceed 1 month.
\n
(3)Termination of a framework contract shall be free of charge for the payment service user except where the contract has been in force for less than 6 months.
\n
(4)Charges, if any, for termination of a framework contract shall be appropriate and in line with costs.
\n
(5)If agreed in a framework contract, a payment service provider may terminate a framework contract concluded for an indefinite period by giving not less than 2 months’ notice in the same manner as information is to be provided in accordance with Regulation 75(1) and (2).
\n
(6)Where a framework contract is terminated, charges for payment services levied on a regular basis shall be— (a) payable by the payment service user only proportionally up to the termination of the contract, and (b) where such charges are paid in advance, reimbursed proportionally.
\n
(7)Nothing in this Regulation affects the operation of any other law governing the rights of the parties to a framework contract to declare the contract unenforceable or void.
\n
Information before execution of individual payment transactions
\n
Section 80
\n
80.Where an individual payment transaction under a framework contract is initiated by the payer, the payment service provider concerned shall, at the payer’s request for the payment transaction, provide explicit information on all of the following: (a) the maximum execution time; (b) the charges payable by the payer; (c) where applicable, a breakdown of the amounts of any charges.
\n
Information for the payer on individual payment transactions
\n
Section 81
\n
81.(1) After the amount of an individual payment transaction is debited from a payer’s account or, where the payer does not use a payment account, after receipt of the payment order, the payer’s payment service provider shall provide the payer, without undue delay and in the same manner as information is to be provided in accordance with Regulation 75(1) and (2), with all of the following information: (a) a reference enabling the payer to identify each payment transaction and, where appropriate, information relating to the payee; (b) the amount of the payment transaction in the currency in which the payer’s payment account is debited or in the currency used for the payment order; (c) the amount of any charges for the payment transaction and, where applicable, a breakdown of the amounts of such charges, or the interest payable by the payer; (d) where applicable, the exchange rate used in the payment transaction by the payer’s payment service provider, and the amount of the payment transaction after that currency conversion; (e) the debit value date or the date of receipt of the payment order.
\n
(2)A framework contract shall include a condition that the payer may require the information referred to in paragraph (1) to be provided or made available periodically, at least once a month, free of charge and in an agreed manner which allows the payer to store and reproduce information unchanged.
\n
Information for the payee on individual payment transactions
\n
Section 82
\n
82.(1) After the execution of an individual payment transaction, the payee’s payment service provider shall provide the payee without undue delay, in the same manner as information is to be provided in accordance with Regulation 75(1) and (2), with all of the following information: (a) a reference enabling the payee to identify the payment transaction and the payer, and any information transferred with the payment transaction; (b) the amount of the payment transaction in the currency in which the payee’s payment account is credited; (c) the amount of any charges for the payment transaction and, where applicable, a breakdown of the amounts of such charges, or the interest payable by the payee; (d) where applicable, the exchange rate used in the payment transaction by the payee’s payment service provider, and the amount of the payment transaction before that currency conversion; (e) the credit value date.
\n
(2)A framework contract may include a condition that the information referred to in paragraph (1) is to be provided or made available periodically, at least once a month, free of charge and in an agreed manner which allows the payee to store and reproduce information unchanged.
\n
Chapter 4
\n
Common Provisions Currency and currency conversion
\n
Section 83
\n
83.(1) Payments shall be made in the currency agreed between the parties to a payment transaction or a framework contract, as the case may be.
\n
(2)Where— (a) a currency conversion service is offered prior to the initiation of a payment transaction, and (b) that currency conversion service is offered at an automated teller machine, at the point of sale or by a payee, the party offering the currency conversion service to a payer shall disclose to the payer all charges as well as the exchange rate to be used for converting the payment transaction.
\n
(3)Where the conditions specified in paragraph (2) apply, a payer accepting an offer to use the currency conversion service concerned shall be deemed to do so on the basis of the disclosed charges and exchange rate.
\n
Information on additional charges or reductions
\n
Section 84
\n
84.(1) Where, for the use of a given payment instrument, a payee requests a charge or offers a reduction, the payee shall inform the payer concerned prior to the initiation of the payment transaction.
\n
(2)Where, for the use of a given payment instrument, a payment service provider or another party involved in the transaction requests a charge, that payment service provider or other party shall inform the payment service user concerned prior to the initiation of the payment transaction.
\n
(3)A payer shall only be obliged to pay the charges referred to in paragraphs (1) and (2) if the full amount of the charges was made known prior to the initiation of the payment transaction concerned.
\n
PART 4
\n
Rights and Obligations in Relation to the Provision and use of Payment Services
\n
Chapter 1
\n
Common provisions Scope
\n
Section 85
\n
85.(1) Where a payment service user is not a consumer, the payment service user and the payment service provider concerned— (a) may agree that Regulation 86(1) and (2), Regulation 88(5) and (6), and Regulations 96, 98, 100, 101, 104 and 112 do not apply in whole or in part, and (b) may agree on time limits that are different from those laid down in Regulation 95.
\n
(2)This Part applies to a micro enterprise as it applies to a consumer.
\n
(3)For the purposes of this Part, an undertaking shall be taken to be a micro enterprise— (a) for the purposes of a payment transaction, where it satisfies the definition of a micro enterprise in the Commission Recommendation at the time of initiation of the transaction, and (b) for the purposes of a framework contract, where it satisfies the definition of a micro enterprise in the Commission Recommendation at the time of entering into the framework contract.
\n
(4)Nothing in these Regulations shall prevent a payment service provider proposing a new framework contract or amendments to an existing framework contract with a payment service user where that payment service user, having satisfied the definition of a micro enterprise in the Commission Recommendation at the time of entering into the existing framework contract, ceases to satisfy that definition prior to the expiry of that framework contract.
\n
Charges applicable
\n
Section 86
\n
86.(1) A payment service provider shall not charge a payment service user for the costs the provider incurs in complying with its information obligations or corrective and preventive measures under this Part, save in accordance with Regulation 103(3), Regulation 104(6) or Regulation 111(5).
\n
(2)Where charges are imposed in accordance with the provisions referred to in paragraph (1), they shall be agreed between the payment service user and the payment service provider and shall be appropriate and in line with the payment service provider’s actual costs.
\n
(3)Where— (a) a payment transaction is provided within the Union, and (b) both the payer’s and the payee’s payment service providers are, or the sole payment service provider in the payment transaction is, located in the Union, the payee shall pay the charges levied by his or her payment service provider and the payer shall pay the charges levied by his or her payment service provider.
\n
(4)A payment service provider shall not prevent a payee from— (a) requesting from a payer a charge, (b) offering a payer a reduction, or (c) otherwise encouraging a payer to use a particular payment instrument.
\n
(5)Where a payee applies a charge in accordance with paragraph (4), the charge applied shall not exceed the direct costs borne by the payee for the use of the payment instrument concerned.
\n
(6)A payee shall not request charges for— (a) the use of a payment instrument for which interchange fees are regulated under Chapter II of Regulation (EU) 2015/751 of the European Parliament and of the Council of 29 April 201516 , or (b) those payment services to which Regulation (EU) No 260/2012 of the European Parliament and of the Council of 14 March 201217 applies.
\n
Derogation for low-value payment instruments and electronic money
\n
Section 87
\n
87.(1) In this Regulation “low-value payment instrument” means a payment instrument that, in accordance with the relevant framework contract— (a) (i)is not prepaid, (ii) relates to payment transactions not wholly within the State, and (iii) (I) concerns only payment transactions none of which exceeds €30, (II) has a spending limit of €150, or (III) does not store more than €150 at any time, (b) (i) is not prepaid, (ii) relates to payment transactions wholly within the State, and (iii) (I) concerns only payment transactions none of which exceeds €60, (II) has a spending limit of €300, or (III) does not store more than €300 at any time, or (c) (i) is prepaid, and (ii) (I) concerns only payment transactions none of which exceeds €500, (II) has a spending limit of €500, or (III) does not store more than €500 at any time.
\n
(2)Where a payment instrument is a low-value payment instrument, the payment service provider concerned may agree with the payment service user concerned— (a) where the payment instrument cannot be blocked or its further use prevented, that Regulation 93(1) (b), Regulation 94(1) (c), (d) and (e), and Regulation 98(6) and (7) do not apply, (b) where the payment instrument is used anonymously or the payment service provider is not in a position, for reasons intrinsic to the payment instrument other than those referred to in subparagraph (a), to prove that a payment transaction was authorised, that Regulations 96 and 97, and Regulation 98(1), (2), (3), (6) and (7) do not apply, (c) by way of derogation from Regulation 103(1), where non-execution is apparent from the context, that the payment service provider is not required to notify the payment service user of the refusal of a payment order, (d) by way of derogation from Regulation 104, that the payer concerned may not revoke the payment order concerned after transmitting the payment order or giving consent to execute the payment transaction to the payee concerned, and (e) by way of derogation from Regulations 107 and 108, that other execution periods apply.
\n
(3)Regulations 97 and 98 shall also apply to electronic money, as defined in point (2) of Article 2 of Directive 2009/110/EC, except where a payer’s payment service provider does not have the ability to freeze the payment account on which the electronic money is stored or block the payment instrument concerned.
\n
Chapter 2
\n
Authorisation of payment transactions Consent and withdrawal of consent
\n
Section 88
\n
88.(1) A payment transaction is authorised by a payer only where the payer has given consent to execute the payment transaction.
\n
(2)A payment transaction may be authorised by a payer either— (a) prior to, or (b) where agreed between the payer and the payment service provider, after, the execution of the payment transaction.
\n
(3)Consent to execute a payment transaction or a series of payment transactions shall be given in the form agreed between the payer and the payment service provider concerned.
\n
(4)Consent to execute a payment transaction may be given via a payee or a payment initiation service provider.
\n
(5)Consent may be withdrawn by a payer until such time as the payment order concerned is irrevocable under Regulation 104.
\n
(6)Consent to execute a series of payment transactions may be withdrawn by a payer, in which case a payment transaction scheduled to be executed after the date the consent is withdrawn shall be unauthorised.
\n
(7)The procedure for giving consent shall be agreed between the payer and the payment service provider concerned.
\n
Confirmation on the availability of funds
\n
Section 89
\n
89.(1) An account servicing payment service provider shall, upon the request of a payment service provider issuing card-based payment instruments, immediately confirm whether an amount necessary for the execution of a card-based payment transaction is available on the payment account of the payer concerned, where all of the following conditions are met: (a) the payment account of the payer is accessible online at the time of the request; (b) the payer has given explicit consent to the account servicing payment service provider to respond to requests from a specific payment service provider to confirm that the amount corresponding to a particular card-based payment transaction is available on the payer’s payment account; (c) the consent referred to in subparagraph (b) has been given before the first request for confirmation is made.
\n
(2)A payment service provider issuing card-based payment instruments may request the confirmation referred to in paragraph (1) where all of the following conditions are met: (a) the payer concerned has given explicit consent to the payment service provider to request the confirmation referred to in paragraph (1) ; (b) the payer concerned has initiated the card-based payment transaction for the amount in question using a card-based payment instrument issued by the payment service provider; (c) the payment service provider authenticates itself to the account servicing payment service provider concerned before each confirmation request, and securely communicates with the account servicing payment service provider in accordance with the regulatory technical standards specifying the requirements referred to in point (d) of Article 98(1) of the Payment Services Directive.
\n
(3)The confirmation referred to in paragraph (1) shall consist of a simple ‘yes’ or ‘no’ answer only and not of a statement of the account balance.
\n
(4)The payment service provider concerned shall not— (a) store the confirmation referred to in paragraph (1), or (b) use the confirmation referred to in paragraph (1) for purposes other than for the execution of the card-based payment transaction concerned.
\n
(5)The confirmation referred to in paragraph (1) shall not be used by the account servicing payment service provider concerned as a reason for the blocking of funds on the payer’s payment account.
\n
(6)A payer may request an account servicing payment service provider to communicate to the payer the identification of the payment service provider concerned and the confirmation provided in accordance with paragraph (1) .
\n
(7)This Regulation does not apply to payment transactions initiated through card-based payment instruments on which electronic money, as defined in point (2) of Article 2 of Directive 2009/110/EC, is stored.
\n
(8)This Regulation does not apply where the payment service provider is a credit union.
\n
Rules on access to payment account in the case of payment initiation services
\n
Section 90
\n
90.(1) A payer shall have the right to use a payment initiation service provider to obtain payment services as referred to in paragraph 7 of the Schedule.
\n
(2)The right referred to in paragraph (1) shall not apply where the payment account concerned is not accessible online.
\n
(3)Where a payer gives its explicit consent for a payment to be executed in accordance with Regulation 88, the account servicing payment service provider shall perform the actions specified in paragraph (5) in order to ensure the payer’s right to use the payment initiation service.
\n
(4)A payment initiation service provider shall— (a) not, at any time, hold a payer’s funds in connection with the provision of a payment initiation service, (b) ensure that the personalised security credentials of a payment service user are not, with the exception of the user and the issuer of the personalised security credentials, accessible to other parties and that they are transmitted by the payment initiation service provider by safe and efficient means, (c) ensure that any other information about a payment service user, obtained when providing payment initiation services, is only provided to the payee concerned and only with the payment service user’s explicit consent, (d) on each occasion that a payment is initiated, identify itself to the account servicing payment service provider of a payer and communicate with the account servicing payment service provider, the payer and the payee concerned in a secure way, in accordance with the regulatory technical standards specifying the requirements referred to in point (d) of Article 98(1) of the Payment Services Directive, (e) not store sensitive payment data of a payment service user, (f) not request from a payment service user any data other than those necessary to provide the payment initiation service concerned, (g) not use, access or store any data for purposes other than for the provision of the payment initiation service concerned as explicitly requested by a payer, and (h) not modify the amount, the payee or any other feature of a transaction.
\n
(5)An account servicing payment service provider shall— (a) communicate securely with a payment initiation service provider in accordance with the regulatory technical standards specifying the requirements referred to in point (d) of Article 98(1) of the Payment Services Directive, (b) immediately after receipt of a payment order from a payment initiation service provider, provide or make available all information on the initiation of the payment transaction concerned and all information accessible to the account servicing payment service provider concerned regarding the execution of the payment transaction to the payment initiation service provider, and (c) not discriminate between payment orders transmitted through the services of a payment initiation service provider, in particular as regards timing, priority or charges in respect of payment orders transmitted directly by the payer, unless there are objective reasons for such discrimination.
\n
(6)The provision of a payment initiation service shall not be dependent on the existence of a contractual relationship between a payment initiation service provider and an account servicing payment service provider for that purpose.
\n
(7)This Regulation does not apply where the payment service provider is a credit union.
\n
Rules on access to and use of payment account information in the case of account information services
\n
Section 91
\n
91.(1) A payment service user has the right to make use of services enabling access to account information referred to in paragraph 8 of the Schedule.
\n
(2)The right referred to in paragraph (1) shall not apply where the payment account is not accessible online.
\n
(3)An account information service provider shall— (a) provide services only where a payment service user has given his or her explicit consent thereto, (b) ensure that the personalised security credentials of a payment service user— (i) are not, with the exception of the user and the issuer of the personalised security credentials, accessible to other parties, and (ii) are transmitted by the account information service provider by safe and efficient means, (c) for each communication session, identify itself to the account servicing payment service provider of the payment service user concerned and securely communicate with the account servicing payment service provider and the payment service user, in accordance with the regulatory technical standards specifying the requirements referred to in point (d) of Article 98(1) of the Payment Services Directive, (d) access information from payment accounts and associated payment transactions only in accordance with the explicit consent of the payment service user concerned, (e) not request sensitive payment data linked to the payment accounts of a payment service user, and (f) not use, access or store any data for purposes other than the performance of the account information service explicitly requested by a payment service user, in accordance with data protection rules.
\n
(4)An account servicing payment service provider shall, in respect of payment accounts— (a) communicate securely with an account information service provider in accordance with the regulatory technical standards specifying the requirements referred to in point (d) of Article 98(1) of the Payment Services Directive, and (b) not discriminate against data requests transmitted through the services of an account information service provider, unless there are objective reasons for so doing.
\n
(5)The provision of account information services shall not be dependent on the existence of a contractual relationship between an account information service provider and an account servicing payment service provider for that purpose.
\n
(6)This Regulation does not apply where the payment service provider is a credit union.
\n
Limits of the use of the payment instrument and of the access to payment accounts by payment service providers
\n
Section 92
\n
92.(1) Where a specific payment instrument is used for the purposes of giving consent, the payer concerned and the payer’s payment service provider may agree on spending limits for payment transactions executed through that payment instrument.
\n
(2)If agreed in a framework contract, the payment service provider concerned may reserve the right to block a payment instrument for objectively justified reasons relating to— (a) the security of the payment instrument, (b) the suspicion of unauthorised or fraudulent use of the payment instrument, or (c) in the case of a payment instrument with a credit line, a significantly increased risk that the payer concerned may be unable to fulfil its liability to pay.
\n
(3)Where a payment instrument is blocked in accordance with paragraph (2), the payment service provider concerned shall inform the payer concerned in an agreed manner of the blocking of the payment instrument and the reasons for it, where possible, before the payment instrument is blocked and at the latest immediately after it is blocked, unless providing such information would compromise objectively justified security measures or is unlawful.
\n
(4)Where a payment instrument is blocked in accordance with paragraph (2), the payment service provider concerned shall unblock the payment instrument or replace the instrument with a new payment instrument as soon as the reasons for blocking no longer apply.
\n
(5)An account servicing payment service provider may deny an account information service provider or a payment initiation service provider access to a payment account for objectively justified and duly evidenced reasons relating to unauthorised or fraudulent access to the payment account by that account information service provider or that payment initiation service provider, including the unauthorised or fraudulent initiation of a payment transaction.
\n
(6)Where access to a payment account is denied by an account servicing payment service provider in accordance with paragraph (5), the account servicing payment service provider shall inform the payer concerned— (a) that access to the payment account is denied, and (b) the reasons why access has been denied, in the form agreed.
\n
(7)An account servicing payment service provider shall provide the information referred to in paragraph (6) to the payer concerned, where possible, before access is denied and at the latest immediately after access is denied, unless providing such information would compromise objectively justified security measures or is unlawful.
\n
(8)Where access to a payment account is denied by an account servicing payment service provider in accordance with paragraph (5), the account servicing payment service provider shall allow access to the payment account as soon as the reasons for denying access no longer apply.
\n
(9)Where access to a payment account is denied by an account servicing payment service provider in accordance with paragraph (5), the account servicing payment service provider shall immediately report this to the Bank, including the reasons for denying access and other relevant details.
\n
(10)Where the Bank receives a report in accordance with paragraph (9), it shall assess the information received and shall, if necessary, take such measures, available to it under this or any other law of the State, as it considers appropriate in the circumstances.
\n
Obligations of the payment service user in relation to payment instruments and personalised security credentials
\n
Section 93
\n
93.(1) A payment service user entitled to use a payment instrument shall— (a) use the payment instrument in accordance with the terms governing the issue and use of the payment instrument, which must be objective, non-discriminatory and proportionate, and (b) notify the payment service provider concerned, or an entity specified by the latter for that purpose, without undue delay on becoming aware of the loss, theft, misappropriation or unauthorised use of the payment instrument.
\n
(2)For the purposes of paragraph (1) (a), the payment service user concerned shall, in particular, as soon as it is in receipt of a payment instrument, take all reasonable steps to keep its personalised security credentials safe.
\n
Obligations of the payment service provider in relation to payment instruments
\n
Section 94
\n
94.(1) A payment service provider issuing a payment instrument shall— (a) ensure that the personalised security credentials of the payment instrument are not accessible to parties other than the payment service user that is entitled to use the payment instrument, (b) refrain from sending an unsolicited payment instrument, except where a payment instrument already given to a payment service user is to be replaced, (c) ensure that appropriate means are available at all times to enable the payment service user concerned to make a notification pursuant to Regulation 93(1) (b) or to request the unblocking of a payment instrument pursuant to Regulation 92(4), (d) on request, provide the payment service user concerned with the means to prove, for 18 months after notification, that the payment service user made a notification referred to in subparagraph (c), (e) provide the payment service user concerned with an option to make a notification pursuant to Regulation 93(1) (b) free of charge and charge, if at all, only replacement costs directly attributed to the payment instrument, (f) prevent all use of the payment instrument concerned once notification pursuant to Regulation 93(1) (b) has been made.
\n
(2)A payment service provider shall bear the risk of sending a payment instrument or any personalised security credentials relating to it to a payment service user.
\n
(3)Paragraph (1) (a) is without prejudice to the obligations of the payment service user concerned under Regulation 93.
\n
Notification and rectification of unauthorised or incorrectly executed payment transactions
\n
Section 95
\n
95.(1) A payment service user is entitled to rectification of an unauthorised or incorrectly executed payment transaction from a payment service provider only where the payment service user notifies the payment service provider without undue delay on becoming aware of any such transaction giving rise to a claim, including a claim under Regulation 112, and no later than 13 months after the debit date.
\n
(2)The time limit for notification under paragraph (1) does not apply where the payment service provider concerned has failed to provide or make available the information on the payment transaction in accordance with Part 3.
\n
(3)Where a payment initiation service provider is involved in an unauthorised or incorrectly executed payment transaction, the payment service user concerned shall obtain rectification from the account servicing payment service provider concerned pursuant to paragraph (1), without prejudice to Regulation 97(2) and (3) and Regulation 112(1) to (8).
\n
Evidence on authentication and execution of payment transactions
\n
Section 96
\n
96.(1) Where a payment service user denies having authorised an executed payment transaction or claims that the payment transaction was not correctly executed, the burden shall be on the payment service provider concerned to prove that the payment transaction was authenticated, accurately recorded, entered in the accounts and not affected by a technical breakdown or some other deficiency of the service provided by the payment service provider.
\n
(2)Where a payment transaction is initiated through a payment initiation service provider, the burden shall be on the payment initiation service provider to prove that within its sphere of competence, the payment transaction was authenticated, accurately recorded and not affected by a technical breakdown or other deficiency linked to the payment service of which it is in charge.
\n
(3)Where a payment service user denies having authorised an executed payment transaction, the use of a payment instrument recorded by the payment service provider, including a payment initiation service provider as appropriate, shall in itself not necessarily be sufficient to prove either that the payment transaction was authorised by the payer or that the payer acted fraudulently or failed with intent or gross negligence to fulfil one or more of the obligations under Regulation 93.
\n
(4)A payment service provider, including, where appropriate, a payment initiation service provider, shall provide supporting evidence to prove fraud or gross negligence on the part of a payment service user.
\n
Payment service provider’s liability for unauthorised payment transactions
\n
Section 97
\n
97.(1) Notwithstanding Regulation 95 and subject to paragraph (2), where a payment transaction is not authorised, the payer’s payment service provider shall— (a) refund the payer the amount of the unauthorised payment transaction immediately, and in any event not later than the end of the business day immediately following the date that the payer’s payment service provider notes or is notified of the transaction, except where the payer’s payment service provider has reasonable grounds for suspecting fraud and communicates those grounds to the relevant national authority in writing, (b) where applicable, restore the debited payment account to the state in which it would have been had the unauthorised payment transaction not taken place, and (c) ensure that the credit value date for the payer’s payment account shall be no later than the date the amount was debited.
\n
(2)Where a payment transaction is not authorised and the payment transaction is initiated through a payment initiation service provider, the account servicing payment service provider concerned shall refund immediately, and in any event no later than by the end of the business day immediately following the date that the account servicing payment service provider notes or is notified of the transaction, the amount of the unauthorised payment transaction and, where applicable, restore the debited payment account to the state in which it would have been had the unauthorised payment transaction not taken place.
\n
(3)Where a payment initiation service provider is liable for an unauthorised payment transaction in respect of which an account servicing payment service provider has issued a refund in accordance with paragraph (2), the payment initiation service provider shall immediately compensate the account servicing payment service provider at its request for the losses incurred or sums paid as a result of the refund to the payer concerned, including the amount of the unauthorised payment transaction.
\n
(4)This Regulation does not affect any other right that the payer concerned may have to obtain compensation (including damages).
\n
Payer’s liability for unauthorised payment transactions
\n
Section 98
\n
98.(1) Notwithstanding Regulation 97 and subject to paragraph (3), a payer shall bear the losses relating to any unauthorised payment transactions, up to a maximum of €50, resulting from the use of a lost or stolen payment instrument or from the misappropriation of a payment instrument.
\n
(2)Paragraph (1) shall not apply where— (a) the loss, theft or misappropriation of a payment instrument was not detectable to the payer prior to a payment, except where the payer has acted fraudulently, or (b) the loss was caused by an act or omission of an employee, agent or branch of a payment service provider or of an entity to which its activities were outsourced.
\n
(3)Notwithstanding Regulation 97, a payer shall bear all of the losses relating to an unauthorised payment transaction where the losses were incurred by the payer— (a) acting fraudulently, or (b) failing to comply with its obligations under Regulation 93 either intentionally or as a result of gross negligence on its part.
\n
(4)Where a payer’s payment service provider does not require strong customer authentication, the payer shall not bear any financial losses relating to an unauthorised payment transaction unless the payer has acted fraudulently.
\n
(5)Where a payee or the payment service provider of the payee fails to accept strong customer authentication, it shall refund the financial damage relating to an unauthorised payment transaction caused to the payer’s payment service provider.
\n
(6)A payer shall not bear any financial consequences resulting from use of a lost, stolen or misappropriated payment instrument after notification in accordance with Regulation 93(1) (b), except where the payer has acted fraudulently.
\n
(7)Where a payment service provider does not provide appropriate means for the notification at all times of a lost, stolen or misappropriated payment instrument, as required under Regulation 94(1) (c), the payer shall not be liable for the financial consequences resulting from the use of that payment instrument, except where the payer has acted fraudulently.
\n
Payment transactions where the transaction amount is not known in advance
\n
Section 99
\n
99.(1) Where a payment transaction is initiated by or through a payee in the context of a card-based payment transaction and the exact amount is not known at the moment when the payer gives consent to execute the payment transaction, the payer’s payment service provider may block funds on the payer’s payment account only if the payer has given consent to the exact amount of the funds to be blocked.
\n
(2)The payer’s payment service provider shall release the funds blocked on the payer’s payment account under paragraph (1) without undue delay after receipt of information about the exact amount of the payment transaction and at the latest immediately after receipt of the payment order.
\n
Refunds for payment transactions initiated by or through a payee
\n
Section 100
\n
100.(1) A payer is entitled to a refund from the payment service provider concerned of an authorised payment transaction which was initiated by or through a payee and which has already been executed, where both of the following conditions are satisfied: (a) the authorisation did not specify the exact amount of the payment transaction when the authorisation was made; (b) the amount of the payment transaction exceeded the amount the payer could reasonably have expected taking into account the previous spending pattern, the conditions in the framework contract concerned and any other relevant circumstances.
\n
(2)At the payment service provider’s request, a payer shall bear the burden of proving the conditions referred to in paragraph (1) are satisfied.
\n
(3)A refund under paragraph (1) shall be of the full amount of the executed payment transaction.
\n
(4)The credit value date for the payment account of a payer refunded under paragraph (1) shall be no later than the date the amount was debited.
\n
(5)Without prejudice to paragraph (7), in addition to the rights referred to in paragraphs (1) to (4), for direct debits as referred to in Article 1 of Regulation (EU) No 260/2012 of the European Parliament and of the Council of 14 March 201218 , a payer has an unconditional right to a refund within the time limits laid down in Regulation 101.
\n
(6)For the purposes of paragraph (1) (b), a payer shall not rely on reasons relating to currency exchange if the reference exchange rate agreed with its payment service provider in accordance with Regulation 69(1) (d) and Regulation 76(c) (ii) was applied.
\n
(7)A payer and a payment service provider may agree in a framework contract that the payer has no right to a refund where— (a) the payer has given consent to execute the payment transaction directly to the payment service provider, and (b) where applicable, information on the future payment transaction was provided or made available in an agreed manner by the payment service provider or the payee to the payer not less than 4 weeks before the due date.
\n
Requests for refunds for payment transactions initiated by or through a payee
\n
Section 101
\n
101.(1) A payer may request a refund under Regulation 100 up to 8 weeks from the date on which the funds concerned were debited.
\n
(2)Within 10 business days of receiving a request for a refund, a payment service provider shall either refund the full amount of the payment transaction or provide reasons for refusing the refund and indicate the bodies to which the payer may refer the matter in accordance with Regulations 121, 124 and 125 if the payer does not accept the reasons provided.
\n
(3)A payment service provider’s right to refuse a refund under paragraph (2) shall not apply where a payer has a right to a refund in accordance with Regulation 100(5).
\n
Chapter 3
\n
Execution of payment transactions Receipt of payment orders
\n
Section 102
\n
102.(1) The time of receipt of a payment order by the payment service provider of the payer concerned is when the payment order is received by the payment service provider.
\n
(2)A payment service provider shall not debit the account of the payer concerned prior to receipt of a payment order.
\n
(3)Where the time of receipt of a payment order is not on a business day for the payment service provider of the payer concerned, the payment order shall be deemed to have been received on the following business day.
\n
(4)A payment service provider may establish a cut-off time near the end of a business day beyond which any payment order received shall be deemed to have been received on the following business day.
\n
(5)Where a payment service user initiating a payment order agrees with the payment service provider concerned that execution of the payment order shall start— (a) on a specific day, (b) at the end of a certain period, or (c) on the day on which the payer has put funds at the payment service provider’s disposal, the time of receipt for the purposes of Regulation 107 is deemed to be the day agreed upon.
\n
(6)Where the day agreed in accordance with paragraph (5) is not a business day for the payment service provider, the payment order shall be deemed to have been received on the following business day.
\n
Refusal of payment orders
\n
Section 103
\n
103.(1) Where a payment service provider refuses to execute a payment order or to initiate a payment transaction, the refusal and, if possible, the reasons for it and the procedure for correcting any factual mistakes that led to the refusal shall be notified to the payment service user, unless prohibited by law.
\n
(2)A payment service provider shall provide or make available the notification referred to in paragraph (1) in an agreed manner at the earliest opportunity, and in any case, within the periods specified in Regulation 107.
\n
(3)A framework contract may include a condition that the payment service provider concerned may charge a reasonable fee for a refusal referred to in paragraph (1) if the refusal is objectively justified.
\n
(4)Where all of the conditions set out in a payer’s framework contract are satisfied, the payer’s account servicing payment service provider shall not refuse to execute an authorised payment order irrespective of whether the payment order is initiated by a payer, including through a payment initiation service provider, or by or through a payee, unless prohibited by law.
\n
(5)For the purposes of Regulations 107 and 112 a payment order for which execution has been refused shall be deemed not to have been received.
\n
Irrevocability of a payment order
\n
Section 104
\n
104.(1) Subject to paragraphs (2) to (6), a payment service user shall not revoke a payment order after it has been received by the payer’s payment service provider.
\n
(2)Where a payment transaction is initiated by a payment initiation service provider or by or through a payee, the payer concerned shall not revoke the payment order concerned after the payer has given consent— (a) to the payment initiation service provider to initiate the payment transaction, or (b) to the payee to execute the payment transaction.
\n
(3)In the case of a direct debit and without prejudice to any right to a refund, a payer may revoke the relevant payment order at the latest by the end of the business day preceding the day agreed for debiting the funds.
\n
(4)Where Regulation 102(5) applies, the payment service user concerned may revoke a payment order at the latest by the end of the business day preceding the day agreed under that paragraph.
\n
(5)A payment order may only be revoked— (a) in a case in which a time limit specified in paragraphs (1) to (4) has been exceeded, but neither paragraph (2) nor paragraph (3) applies, where the payment service user and the relevant payment service provider agree to its revocation, or (b) in a case in which a time limit specified in paragraphs (1) to (4) has been exceeded and paragraph (2) or (3) applies, where the payment service user, the relevant payment service provider and the relevant payee agree to its revocation.
\n
(6)If agreed in a framework contract, the relevant payment service provider may charge for revocation.
\n
Amounts transferred and amounts received
\n
Section 105
\n
105.(1) Subject to paragraph (2), in the execution of a payment transaction, the payment service provider of the payer concerned, the payment service provider of the payee concerned and any intermediaries of the payment service providers shall transfer the full amount of the payment transaction and shall not deduct charges from the amount transferred.
\n
(2)A payee and a payment service provider may agree that the payment service provider may deduct its charges from the amount transferred before crediting it to the payee, in which case the full amount of the payment transaction and charges shall be separated in the information given to the payee.
\n
(3)Where any charges other than those referred to in paragraph (2) are deducted from an amount transferred, the payment service provider of the payer concerned shall ensure that the payee concerned receives the full amount of the payment transaction initiated by the payer.
\n
(4)Where a payment transaction is initiated by or through a payee, the payment service provider of the payee shall ensure that the full amount of the payment transaction is received by the payee.
\n
Scope of Regulations 107 to 110
\n
Section 106
\n
106.(1) Regulations 107 to 110 apply to— (a) payment transactions in euro, and (b) payment transactions involving only one currency conversion between the euro and the currency of a Member State outside the euro area, where— (i) the required currency conversion is carried out in that Member State, and (ii) in the case of a cross-border payment transaction, the cross-border transfer takes place in euro.
\n
(2)Regulations 107 to 109 apply to payment transactions not referred to in paragraph (1), unless otherwise agreed between the payment service user and the payment service provider.
\n
(3)Where, in the case of a payment transaction not referred to in paragraph (1) which is an intra-Union payment transaction, the payment service user and the payment service provider agree a period longer than that set out in Regulation 107, that period shall not exceed 4 business days following the time of receipt as referred to in Regulation 102.
\n
(4)Regulation 110 applies to payment transactions not referred to in paragraph (1) .
\n
Payment transactions to a payment account
\n
Section 107
\n
107.(1) Subject to paragraph (2), a payer’s payment service provider shall ensure that after the time of receipt referred to in Regulation 102 the amount of the payment transaction will be credited to the payee’s payment service provider’s account by the end of the following business day.
\n
(2)The time limit referred to in paragraph (1) is extended by a further business day for paper-initiated payment transactions.
\n
(3)The payment service provider of a payee shall value date and make available the amount of the payment transaction to the payee’s payment account after the payment service provider has received the funds in accordance with Regulation 110.
\n
(4)A payee’s payment service provider shall transmit a payment order initiated by or through the payee to the payer’s payment service provider within the time limits agreed between the payee and the payment service provider, so as to enable settlement, as far as direct debit is concerned, on the agreed due date.
\n
Absence of payee’s payment account with the payment service provider
\n
Section 108
\n
108.Where a payee does not have a payment account with a payment service provider, a payment service provider who receives funds for the payee shall make the funds available to the payee within the time limit specified in Regulation 107.
\n
Cash placed on a payment account
\n
Section 109
\n
109.(1) Where a payment service user that is a consumer places cash on a payment account with a payment service provider in the currency of that payment account, the payment service provider shall ensure that the amount is made available and value dated immediately after receipt of the funds.
\n
(2)Where a payment service user that is not a consumer places cash on a payment account with a payment service provider in the currency of that payment account, the amount shall be made available and value dated not later than the following business day after receipt of the funds.
\n
Value date and availability of funds
\n
Section 110
\n
110.(1) The credit value date for a payee’s payment account shall not be later than the business day on which the amount of the payment transaction is credited to the payee’s payment service provider’s account.
\n
(2)The payment service provider of a payee shall ensure that the amount of a payment transaction is at the payee’s disposal immediately after that amount is credited to the payee’s payment service provider’s account where, on the part of the payee’s payment service provider, there is— (a) no currency conversion, (b) a currency conversion between the euro and a Member State currency, or (c) a currency conversion between two Member State currencies.
\n
(3)Paragraph (2) shall also apply to payments within one payment service provider.
\n
(4)The debit value date for a payer’s payment account shall not be earlier than the time at which the amount of the payment transaction is debited to that payment account.
\n
Incorrect unique identifiers
\n
Section 111
\n
111.(1) Where a payment order is executed in accordance with a unique identifier, the payment order shall be deemed to have been executed correctly where payment is made to the payee specified by the unique identifier.
\n
(2)Where the unique identifier provided by a payment service user is not the unique identifier of the person to whom payment was intended to be made, the payment service provider concerned shall not be liable under Regulation 112 for non-execution or defective execution of the payment transaction concerned.
\n
(3)Where the unique identifier provided by a payment service user is not the unique identifier of the person to whom payment was intended to be made— (a) the payer’s payment service provider shall make reasonable efforts to recover the funds involved in the payment transaction, and (b) the payee’s payment service provider shall cooperate in those efforts by communicating to the payer’s payment service provider all relevant information for the collection of funds.
\n
(4)Where the recovery of funds in accordance with paragraph (3) is not possible, the payer’s payment service provider shall provide to the payer, upon written request, all information available to the payer’s payment service provider and relevant to the payer in order for the payer to issue proceedings for the recovery of the funds.
\n
(5)Where agreed in the framework contract concerned, a payment service provider may charge the payment service user for recovery of funds.
\n
(6)Where a payment service user provides information in addition to that specified in Regulation 69(1) (a) or Regulation 76(b) (ii), the payment service provider shall be liable only for the execution of payment transactions in accordance with the unique identifier provided by the payment service user.
\n
Payment service providers’ liability for non-execution, defective or late execution of payment transactions
\n
Section 112
\n
112.(1) Where a payment order is initiated directly by a payer, the payer’s payment service provider shall, without prejudice to Regulations 95, 111(2), (3) and (4), and 116, be liable to the payer for correct execution of the payment transaction, unless the payer’s payment service provider can prove to the payer and, where relevant, to the payee’s payment service provider that the payee’s payment service provider received the amount of the payment transaction in accordance with Regulation 107(1) and (2).
\n
(2)Where, in accordance with paragraph (1), the payer’s payment service provider can prove to the payer and, where relevant, to the payee’s payment service provider that the payee’s payment service provider received the amount of the payment transaction in accordance with Regulation 107(1) and (2), the payee’s payment service provider shall be liable to the payee for the correct execution of the payment transaction.
\n
(3)Where a payer’s payment service provider is liable under paragraph (1), it shall, without undue delay, refund to the payer the amount of a non-executed or defective payment transaction, and, where applicable, restore the debited payment account to the state in which it would have been had the defective payment transaction not taken place.
\n
(4)Where a payer’s payment service provider refunds a payer in accordance with paragraph (3), the credit value date for the payer’s payment account shall be no later than the date on which the amount was debited.
\n
(5)Where a payee’s payment service provider is liable under paragraph (2), it shall immediately place the amount of the payment transaction at the payee’s disposal and, where applicable, credit the corresponding amount to the payee’s payment account.
\n
(6)Where a payee’s payment account is credited in accordance with paragraph (5), the credit value date for the payee’s payment account shall be no later than the date on which the amount would have been value dated, had the transaction been correctly executed in accordance with Regulation 110.
\n
(7)Where a payment transaction is executed late, the payee’s payment service provider shall ensure, upon the request of the payer’s payment service provider acting on behalf of the payer, that the credit value date for the payee’s payment account is no later than the date the amount would have been value dated had the transaction been correctly executed.
\n
(8)In the case of a non-executed or defectively executed payment transaction where the payment order is initiated by the payer, the payer’s payment service provider shall, regardless of liability under paragraphs (1) to (7) and free of charge for the payer, on request, make immediate efforts to trace the payment transaction and notify the payer of the outcome.
\n
(9)Where a payment order is initiated by or through a payee, the payee’s payment service provider shall, without prejudice to Regulations 95, 111(2), (3) and (4), and 116, be liable to the payee for correct transmission of the payment order to the payment service provider of the payer in accordance with Regulation 107(4).
\n
(10)Where a payee’s payment service provider is liable under paragraph (1), it shall immediately re-transmit the payment order in question to the payment service provider of the payer.
\n
(11)In the case of a late transmission of a payment order, the amount of the payment order shall be value dated on the payee’s payment account no later than the date the amount would have been value dated had the transaction been correctly executed.
\n
(12)The payment service provider of a payee shall, without prejudice to Regulations 95, 111(2), (3) and (4), and 116, be liable to the payee for handling the payment transaction in accordance with its obligations under Regulation 110.
\n
(13)Where a payee’s payment service provider is liable under paragraph (12), it shall ensure that the amount of the payment transaction is at the payee’s disposal immediately after that amount is credited to the payee’s payment service provider’s account.
\n
(14)Where the amount of a payment transaction is put at the payee’s disposal in accordance with paragraph (13), the amount shall be value dated on the payee’s payment account no later than the date the amount would have been value dated had the transaction been correctly executed.
\n
(15)In the case of a non-executed or defectively executed payment transaction for which a payee’s payment service provider is not liable under paragraph (9), (10) or (11), the payer’s payment service provider shall be liable to the payer concerned.
\n
(16)Where a payer’s payment service provider is liable under paragraph (15), the payment service provider shall, as appropriate and without undue delay, refund to the payer the amount of the non-executed or defective payment transaction and restore the debited payment account to the state in which it would have been had the defective payment transaction not taken place.
\n
(17)Where a payer’s payment service provider refunds a payer in accordance with paragraph (16), the credit value date for the payer’s payment account shall be no later than the date on which the amount was debited.
\n
(18)The obligation under paragraph (16) shall not apply to the payer’s payment service provider where the payer’s payment service provider proves that the payee’s payment service provider has received the amount of the payment transaction, including where execution of the payment transaction has been delayed.
\n
(19)Where paragraph (18) applies, the payee’s payment service provider shall value date the amount on the payee’s payment account no later than the date the amount would have been value dated had it been executed correctly.
\n
(20)In the case of a non-executed or defectively executed payment transaction where the payment order is initiated by or through a payee, the payee’s payment service provider shall, regardless of liability under paragraphs (9) to (19) and free of charge for the payee, on request, make immediate efforts to trace the payment transaction and notify the payee of the outcome.
\n
(21)A payment service provider shall be liable to its payment service user for any charges for which the payment service user is responsible, and for any interest to which the payment service user is subject as a consequence of non-execution or defective, including late, execution of the payment transaction.
\n
Liability in the case of payment initiation services for non-execution, defective or late execution of payment transactions
\n
Section 113
\n
113.(1) Where a payment order is initiated by a payer through a payment initiation service provider, the account servicing payment service provider concerned shall, without prejudice to Regulations 95 and 111(2), (3) and (4), refund to the payer the amount of a non-executed or defective payment transaction and, where applicable, restore the debited payment account concerned to the state in which it would have been had the defective payment transaction not taken place.
\n
(2)Where a payment order is initiated by a payer through a payment initiation service provider, the burden shall be on the payment initiation service provider to prove— (a) that the payment order was received by the payer’s account servicing payment service provider in accordance with Regulation 102, and (b) to the extent that it is within the sphere of competence of the payer’s payment initiation service provider, that the payment transaction was authenticated, accurately recorded and not affected by a technical breakdown or other deficiency linked to the non-execution, defective or late execution of the transaction.
\n
(3)Where a payment initiation service provider is liable for the non-execution, defective or late execution of a payment transaction, it shall immediately compensate the account servicing payment service provider at its request for the losses incurred or sums paid as a result of the refund to the payer concerned.
\n
Additional financial compensation
\n
Section 114
\n
114.Any financial compensation additional to that provided for under Regulations 111 to 116 may be determined in accordance with the law applicable to the contract concluded between the payment service user and the payment service provider.
\n
Right of recourse
\n
Section 115
\n
115.(1) Where the liability of a payment service provider under Regulation 97 or 112 is attributable to another payment service provider or to an intermediary, that payment service provider or intermediary, as the case may be, shall compensate the first-mentioned payment service provider for any losses incurred or sums paid under Regulation 97 or 112, including where any of the payment service providers concerned fail to use strong customer authentication.
\n
(2)Financial compensation in addition to that provided for under paragraph (1) may be determined in accordance with an agreement between the payment service providers concerned or the payment service provider and intermediary concerned, as the case may be, and the law applicable to that agreement.
\n
Abnormal and unforeseeable circumstances
\n
Section 116
\n
116.A person shall not be liable under Chapter 2 or 3 of this Part— (a) where, but for this Regulation, the person’s liability would have resulted from abnormal and unforeseeable circumstances beyond that person’s control, the consequences of which could not have been avoided by it, or (b) where the person is a payment service provider, they are subject to other legal obligations under Union law or the law of the State.
\n
Chapter 4
\n
Data protection Data protection
\n
Section 117
\n
117.(1) A payment system or payment service provider may process personal data where this is necessary to safeguard the prevention, investigation and detection of payment fraud.
\n
(2)The provision of information to individuals about the processing of personal data and the processing of such personal data and any other processing of personal data for the purposes of these Regulations shall be in accordance with— (a) prior to the date of application of the General Data Protection Regulation, the Data Protection Acts 1988 and 2003, and (b) after that date— (i) the General Data Protection Regulation, and (ii) the law of the State giving further effect to the General Data Protection Regulation.
\n
(3)A payment service provider shall only access, process and retain personal data necessary for the provision of its payment services, with the explicit consent of the payment service user concerned.
\n
Chapter 5
\n
Operational and security risks and authentication Management of operational and security risks
\n
Section 118
\n
118.(1) A payment service provider shall establish a framework with appropriate mitigation measures and control mechanisms to manage the operational and security risks, relating to the payment services that it provides.
\n
(2)As part of the framework referred to in paragraph (1), a payment service provider shall establish and maintain effective incident management procedures, including for the detection and classification of major operational and security incidents.
\n
(3)A payment service provider shall provide to the Bank on an annual basis, or at shorter intervals as determined by the Bank, an updated and comprehensive assessment of— (a) the operational and security risks relating to the payment services provided by the payment service provider, and (b) the adequacy of the mitigation measures and control mechanisms implemented in response to those risks.
\n
Incident reporting
\n
Section 119
\n
119.(1) Where a major operational or security incident occurs, a payment service provider shall, without undue delay, notify the competent authority of its home Member State.
\n
(2)Where an incident to which paragraph (1) applies has or may have an impact on the financial interests of the payment service users of the payment service provider concerned, the payment service provider shall, without undue delay, inform its payment service users of the incident and of all measures that those users can take to mitigate the adverse effects of the incident.
\n
(3)The Bank shall, following receipt of a notification referred to in paragraph (1), without undue delay, provide the relevant details of the incident to the European Banking Authority and to the European Central Bank.
\n
(4)The Bank shall, following receipt of a notification referred to in paragraph (1) and after assessing the relevance of the incident concerned to relevant authorities of the State, notify those authorities accordingly.
\n
(5)Where the Bank receives a notification from the European Central Bank under Article 96 of the Payment Services Directive, the Bank shall, on the basis of that notification, where appropriate, take all of the necessary measures to protect the immediate safety of the financial system.
\n
(6)A payment service provider shall provide, at least on an annual basis, statistical data on fraud relating to different means of payment to the competent authority of its home Member State.
\n
(7)The Bank shall provide to the European Banking Authority and the European Central Bank, in an aggregated form, data received under paragraph (6).
\n
Authentication
\n
Section 120
\n
120.(1) A payment service provider shall apply strong customer authentication where a payer— (a) accesses its payment account online, (b) initiates an electronic payment transaction, or (c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
\n
(2)Where a payer initiates an electronic remote payment transaction, a payment service provider shall apply strong customer authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
\n
(3)Where paragraph (1) applies, a payment service provider shall have in place adequate security measures to protect the confidentiality and integrity of the personalised security credentials of the payment service user concerned.
\n
(4)Paragraphs (2) and (3) also apply where a payment is initiated through a payment initiation service provider.
\n
(5)Paragraphs (1) and (3) also apply where information is requested through an account information service provider.
\n
(6)An account servicing payment service provider shall permit a payment initiation service provider and an account information service provider to rely on the authentication procedures provided by the account servicing payment service provider to the payment service user in accordance with paragraphs (1) and (3) and, where the payment initiation service provider is involved, in accordance with paragraphs (1), (2) and (3).
\n
Chapter 6
\n
Infringements, supervision, dispute resolution and enforcement Reporting of infringements
\n
Section 121
\n
121.(1) The Bank shall establish a procedure to allow payment service users and other interested parties including consumer associations, to submit reports to the Bank with regard to alleged infringements of these Regulations by payment service providers.
\n
(2)Where appropriate and without prejudice to any right to bring proceedings before a court, the reply from the Bank to a report submitted to it with regard to an alleged infringement of these Regulations by a payment service provider shall inform the person submitting the report of the existence of the alternative dispute resolution procedures set up in accordance with Regulation 125.
\n
Supervision
\n
Section 122
\n
122.The Bank may— (a) require a payment service provider to provide any information needed to monitor the institution’s compliance with these Regulations, (b) carry out on-site inspections at— (i) the premises of a payment service provider, (ii) any agent or branch providing payment services under the responsibility of a payment service provider, (iii) the premises of any entity to which a payment service provider’s activities are outsourced, and (iv) any premises at which payment services are, or are suspected of being conducted, and (c) issue recommendations, guidelines, policy statements and codes of practice.
\n
Bank’s power to give directions
\n
Section 123
\n
123.(1) If the Bank considers it necessary to do so in the interests of the proper and orderly supervision of payment services, the Bank may give a direction in writing to— (a) a payment institution, (b) another person registered to provide payment services, or (c) any other person involved in or connected with the provision of a payment service, in the State.
\n
(2)A direction under paragraph (1) — (a) takes effect on the date, or on the occurrence of the event, specified in the direction for the purpose, and (b) ceases to have effect on the earlier of— (i) the date, or the occurrence of the event, specified in the direction for the purpose, or (ii) the expiration of the period of 12 months immediately following the day on which it took effect.
\n
(3)If a direction under this Regulation has not been complied with or is unlikely to be complied with, the Bank may apply to the court in a summary manner for such order as the court thinks appropriate by way of enforcement of the direction.
\n
Dispute resolution
\n
Section 124
\n
124.(1) A payment service provider shall put in place and apply adequate and effective complaint resolution procedures for the settlement of complaints of payment service users concerning the rights and obligations arising under Parts 3 and 4.
\n
(2)A complaint resolution procedure referred to in paragraph (1) which applies in the State shall be available in Irish or English or, where another language is agreed between a payment service provider and a payment service user, that language.
\n
(3)A payment service provider shall make every possible effort to reply, on paper or, if agreed between the payment service provider and a payment service user, on another durable medium, to the payment service users’ complaints.
\n
(4)A reply from a payment service provider to a complaint from a payment service user shall address all points raised in the complaint, within an adequate timeframe and at the latest within 15 business days of receipt of the complaint.
\n
(5)Where, in an exceptional situation, a payment service provider is unable to comply with paragraph (4) for reasons beyond the control of the payment service provider, the payment service provider shall send a reply to the payment service user clearly indicating the reasons for a delay in answering the complaint and specifying the deadline by which the payment service user will receive a reply in compliance with paragraph (4).
\n
(6)Where, in an exceptional situation, a payment service provider is unable to comply with paragraph (4) for reasons beyond the control of the payment service provider, the payment service provider shall send a final reply to the payment service user concerned, addressing all points raised in the complaint, at the latest within 35 business days of receipt of the complaint.
\n
(7)Notwithstanding paragraphs (3) to (6), where the Bank introduces or maintains rules on dispute resolution procedures that are applicable to the complaint and parties concerned and more advantageous to the payment service user than the obligations specified in those paragraphs, those rules shall apply in place of paragraphs (3) to (6).
\n
(8)Where the Bank has not introduced or maintained rules on dispute resolution procedures that are applicable to the complaint, paragraphs (3) to (6) will not apply in a case in which— (a) the complaint has been resolved to the complainant’s satisfaction within five business days of receipt of the complaint, and (b) a record of the resolution of the complaint to the satisfaction of the complainant is maintained by the payment service provider.
\n
(9)A payment service provider shall inform a payment service user of at least one ADR entity which is competent to deal with disputes concerning the rights and obligations arising under Parts 3 and 4.
\n
(10)A payment service provider shall— (a) provide the information referred to in paragraph (9), and (b) inform the payment service user how further information on the ADR entity concerned and on the conditions for using it can be accessed, in a clear, comprehensive and easily accessible way on the website of the payment service provider concerned, where one exists, at the branch, and in the general terms and conditions of the contract between the payment service provider and the payment service user.
\n
(11)A reference in paragraph (9) or (10) to an ADR entity includes, where applicable, a reference to the Financial Services and Pensions Ombudsman.
\n
Alternative dispute resolution procedures
\n
Section 125
\n
125.(1) The Financial Services and Pensions Ombudsman has jurisdiction over the settlement of disputes between payment service users (being payment service users that are consumers or the operators of undertakings that were at the relevant time micro enterprises) and payment service providers concerning rights and obligations arising under these Regulations.
\n
(2)The Financial Services and Pensions Ombudsman shall cooperate effectively in the resolution of cross-border disputes concerning the rights and obligations arising under Parts 3 and 4.
\n
Offence — operation as a payment institution without authorisation, etc.
\n
Section 126
\n
126.A person who contravenes Regulation 6 shall be guilty of an offence.
\n
Offence — false or misleading information in application
\n
Section 127
\n
127.(1) A person shall be guilty of an offence if the person— (a) knowingly or recklessly makes a false or misleading statement in an application for authorisation to operate as a payment institution, or (b) makes a false or misleading statement to the Bank in relation to— (i) the obtaining of an authorisation to operate as a payment institution, or (ii) an approval, waiver or permission from the Bank concerning the operation of a payment institution.
\n
Offence — misappropriation of users’ funds
\n
Section 128
\n
128.A person who is a director, officer or employee of a payment institution shall be guilty of an offence if he or she fraudulently misappropriates users’ funds.
\n
Offence — failure to inform Bank of relevant changes, etc.
\n
Section 129
\n
129.A payment institution that fails to comply with Regulation 27 shall be guilty of an offence.
\n
Offence — failure to keep appropriate records
\n
Section 130
\n
130.A payment institution that fails to comply with Regulation 32 (whether by not keeping appropriate records or by not holding such records for the period required by that Regulation) shall be guilty of an offence.
\n
Offence — provision of false or misleading information under Regulation 122(a)
\n
Section 131
\n
131.A payment institution shall be guilty of an offence if the payment institution gives the Bank, in purported compliance with a requirement of the Bank under Regulation 122(a), information that the payment institution knows or reasonably ought to know is false or misleading.
\n
Prosecution of offences
\n
Section 132
\n
132.(1) Summary proceedings for an offence under these Regulations may be brought and prosecuted by the Bank.
\n
(2)Notwithstanding section 10(4) of the Petty Sessions (Ireland) Act 1851 , summary proceedings for an offence under these Regulations may be instituted— (a) at any time within 3 years from the date on which the offence was committed, (b) where, at the expiry of that period, the person against whom the proceedings are to be brought is outside the State, within 6 months of the date on which he or she next enters the State, or (c) at any time within 3 years from the date on which evidence that, in the opinion of the person by whom the proceedings are brought, is sufficient to justify the bringing of the proceedings, comes to that person’s knowledge, whichever is the later, provided that no such proceedings shall be commenced later than 5 years from the date on which the offence concerned was committed.
\n
(3)For the purpose of this Regulation, a certificate signed by or on behalf of or jointly with the person bringing the proceedings as to the date on which evidence relating to the offence concerned came to his or her knowledge shall be prima facie evidence and in any legal proceedings a document purporting to be a certificate issued for the purpose of this subsection and to be so signed shall be deemed to be so signed and shall be admitted as evidence without proof of the signature of the person purporting to sign the certificate.
\n
Publication of information
\n
Section 133
\n
133.Where the Bank imposes a sanction under Part IIIC of the Act of 1942 in respect of a contravention of these Regulations, it shall not publish information under section 33BC of that Act where such publication would seriously jeopardise the financial markets or cause disproportionate damage to the parties involved.
\n
Penalties
\n
Section 134
\n
134.A person who is guilty of an offence under these Regulations shall be liable— (a) on summary conviction, to a class A fine or to imprisonment for a term not exceeding 6 months, or to both, or (b) on conviction on indictment, to a fine not exceeding €500,000 or to imprisonment for a term not exceeding 3 years, or to both.
\n
Offences by bodies corporate and managers etc.
\n
Section 135
\n
135.Where an offence is committed under these Regulations by a body corporate and is proved to have been committed with the consent, connivance or approval of any person, being— (a) a director, manager, secretary or other officer of the body corporate, or (b) a person who was purporting to act in any such capacity, that person as well as the body corporate shall be guilty of an offence and shall be liable to be proceeded against and punished as if that person were guilty of the first-mentioned offence.
\n
PART 5
\n
Consumer Rights Information Obligation to inform consumers of their rights
\n
Section 136
\n
136.(1) The Bank shall ensure that the leaflet produced by the Commission of the European Union in accordance with Article 106(1) of the Payment Services Directive is made available in an easily accessible manner on its website.
\n
(2)A payment service provider shall ensure that the leaflet produced by the Commission of the European Union in accordance with Article 106(1) of the Payment Services Directive is made available— (a) in an easily accessible manner on its website (if any), and (b) in paper form at its branches (if any), agents (if any) and any entity to which its activities are outsourced.
\n
(3)A payment service provider shall not charge its clients for making available the information referred to in paragraph (2).
\n
(4)The Bank and payment service providers shall ensure that the leaflet produced by the Commission of the European Union in accordance with Article 106(1) of the Payment Services Directive is made available in an accessible format to persons with disabilities.
\n
PART 6
\n
Final Provisions Derogation
\n
Section 137
\n
137.(1) Save to the extent provided under these Regulations, a payment service provider shall not derogate, to the detriment of payment service users, from these Regulations.
\n
(2)A payment service provider may provide its services to payment service users on more favourable terms than is provided for under these Regulations.
\n
Revocation
\n
Section 138
\n
138.The Regulations of 2009 are revoked.
\n
Saver
\n
Section 139
\n
139.The revocation of the Regulations of 2009— (a) does not affect any investigation undertaken, or disciplinary or enforcement action undertaken by the Bank or any other person, in respect of any matter in existence at, or before, the time of the revocation, and (b) does not preclude the taking of any legal proceedings, or the undertaking of any investigation, or disciplinary or enforcement action by the Bank or any other person, in respect of any contravention of the Regulations of 2009 or any misconduct which may have been committed before the time of the revocation.
\n
Transitional provisions
\n
Section 140
\n
140.(1) Where a payment institution has taken up activities in accordance with the Regulations of 2009 on or before 13 January 2018, the payment institution— (a) shall be permitted to continue those activities in accordance with those Regulations, and (b) shall not be required to seek authorisation in accordance with Regulation 7 or to comply with the other provisions of, or referred to in, Part 2, until 13 July 2018.
\n
(2)A payment institution to which paragraph (1) applies shall submit all relevant information to the Bank in a timely manner in order to allow the Bank to assess whether the payment institution complies with its requirements under Part 2 and, if not, which measures need to be taken in order to ensure compliance or whether a withdrawal of authorisation is appropriate.
\n
(3)The Bank shall complete the assessment referred to in paragraph (2) by 13 July 2018.
\n
(4)Where the Bank is satisfied that a payment institution to which paragraph (1) applies complies with the institution’s obligations under Part 2, the Bank shall grant an authorisation to the payment institution and enter in the Register the information required under Regulation 25 in respect of the payment institution.
\n
(5)Where the Bank is not satisfied by 13 July 2018 that a payment institution to which paragraph (1) applies complies with the institution’s obligations under Part 2, the payment institution shall, in accordance with Regulation 6, be prohibited from providing payment services.
\n
(6)Where a person is granted a waiver under Regulation 35(2) of the Regulations of 2009 prior to 13 January 2018 and pursued payment services within the meaning of those Regulations prior to that date, the person— (a) shall be permitted to continue those activities within the State in accordance with those Regulations, and (b) shall not be required to seek authorisation under Regulation 7 or, to obtain an exemption pursuant to Regulation 41, or to comply with the other provisions of, or referred to in, Part 2, until 13 January 2019.
\n
(7)A person to whom paragraph (6) applies who has not, by 13 January 2019, been authorised or exempted under these Regulations shall, in accordance with Regulation 6, be prohibited from providing payment services.
\n
(8)Notwithstanding paragraphs (1) to (4), a payment institution that has been granted authorisation to provide payment services as referred to in paragraph 7 of Schedule 1 to the Regulations of 2009 shall retain that authorisation for the provision of those payment services which are considered to be payment services as referred to in paragraph 3 of the Schedule where, by 13 January 2020, the Bank has evidence that the requirements laid down in Regulation 8(1) (c) and in Regulations 11 to 16 have been complied with.
\n
(9)Where a person has provided the payment service referred to in paragraph 7 of the Schedule in the State prior to 12 January 2016, that person shall not be required to seek authorisation in accordance with Regulation 7 or to comply with the other provisions of, or referred to in, Part 2 until the date that is 18 months from the date that the regulatory technical standards referred to in Article 98 of the Payment Services Directive enter into force.
\n
(10)Where a person has provided the payment service referred to in paragraph 8 of the Schedule in the State prior to 12 January 2016, that person shall not be required to be registered in accordance with Regulation 42 or to comply with the other provisions of, or referred to in, Part 2 until the date that is 18 months from the date that the regulatory technical standards referred to in Article 98 of the Payment Services Directive enter into force.
\n
Amendment of European Communities (Distance Marketing of Consumer Financial Services) Regulations 2004
\n
Section 141
\n
141.Regulation 6 of the European Communities (Distance Marketing of Consumer Financial Services) Regulations 2004 ( S.I. No. 853 of 2004 ) is amended— (a) in paragraph (1), by the substitution of “Subject to paragraph (1A), within a reasonable time” for “Within a reasonable time”, and (b) by the insertion of the following paragraph after paragraph (1) : “(1A) Where the European Union (Payment Services) Regulations 2018 also apply, the supplier shall, within a reasonable time before a consumer is bound by a distance contract for the supply of a financial service, give the consumer— (a) the information specified in paragraphs (j), (k), (l), (m), (n), (o), (r), (s) and (x) of Schedule 1, and (b) the information required to be provided under Regulations 68, 69, 75 and 76 of those Regulations.”.
\n
Amendment of European Communities (Electronic Money) Regulations 2011
\n
Section 142
\n
142.The European Communities (Electronic Money) Regulations 2011 are amended— (a) in Regulation 3(1) — (i) by the insertion of the following definitions: “ ‘account information service’ has the same meaning as it has in the Payment Services Regulations 2018; ‘Directive (EU) 2015/849’ means of the European Parliament and of the Council of 20 May 201519 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC; ‘European Banking Authority’ means the European Banking Authority established by Regulation (EU) 1093/2010 of the European Parliament and of the Council of 24 November 201020 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC; ‘payment initiation service’ has the same meaning as it has in the Payment Services Regulations; ‘payment service provider’ has the same meaning as it has in the Payment Services Regulations; ‘Regulation (EU) No 1093/2010’ means Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC21 ; ‘sensitive payment data’ means information, including personalised security credentials, which could be used to carry out fraud; but in relation to account information services and payment initiation services does not include the name of an account holder or an account number;”, (ii) by the substitution of the following definition for the definition of “Payment Services Directive”: “ ‘Payment Services Directive’ means Directive 2015/2366/EU of the European Parliament and of the Council of 25 November 201522 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No. 1093/2010, and repealing Directive 2007/64/EC;”, and (iii) by the substitution of the following definition for the definition of “Payment Services Regulations”: “ ‘Payment Services Regulations’ means the European Union (Payment Services) Regulations 2018 ( S.I. No. 6 of 2018 );”, (b) in Regulation 7, by the insertion of the following paragraphs after paragraph (2): “(2A) The Bank shall enter in the Register any withdrawal of an authorisation and any withdrawal of a waiver pursuant to Regulation 36.
\n
(2B) The Bank shall notify the European Banking Authority of the reasons for the withdrawal of any authorisation and of any waiver pursuant to Regulation 36.”, (c) by the insertion of the following Regulation after Regulation 7: “European Banking Authority Register 7A. (1) Where information is entered in the Register, the Bank shall, without delay and in a language customary in the field of finance, send a notification to the European Banking Authority informing it of the information so entered.
\n
(2)The Bank shall ensure that the information provided to the European Banking Authority under paragraph (1) is accurate and up-to-date.”, (d) in Regulation 8— (i) in paragraph (1) — (I) by the substitution of the following subparagraph for subparagraph (f) : “(f) for applicants subject to the obligations in relation to money laundering and terrorist financing under Directive (EU) 2015/849 and Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 201523 , a description of the internal control mechanisms which the applicant has established in order to comply with those obligations,”, (II) by the substitution of the following subparagraph for subparagraph (g) : “(g) a description of the applicant’s structural organisation, including, where applicable, a description of the intended use of agents and branches and of the off-site and on-site checks that the applicant undertakes to perform on them at least annually, as well as a description of outsourcing arrangements, and of its participation in a national or international payment system,”, (III) in subparagraph (k), by the substitution of “documents,” for “documents, and”, (IV) in subparagraph (l), by the substitution of “office,” for “office.”, and (V) by the insertion of the following subparagraphs after subparagraph (l) : “(m) a description of the procedure in place to monitor, handle and follow up a security incident and security related customer complaints, including an incidents reporting mechanism, (n) a description of the process in place to file, monitor, track and restrict access to sensitive payment data, (o) a description of business continuity arrangements including a clear identification of the critical operations, effective contingency plans and a procedure to regularly test and review the adequacy and efficiency of such plans, (p) a description of the principles and definitions applied for the collection of statistical data on performance, transactions and fraud, (q) a security policy document, including a detailed risk assessment in relation to the applicant’s payment services and a description of security control and mitigation measures taken to adequately protect payment service users against the risks identified, including fraud and illegal use of sensitive and personal data, and (r) in the case of an applicant that proposes to provide payment initiation services or account information services, information on the professional indemnity insurance policy or comparable guarantee against liability it holds or proposes to put in place to cover potential liabilities in relation to the provision of such services.”,
\n
(ii) in paragraph (2), by the substitution of “For the purposes of subparagraphs (d), (e), (g) and (m) of paragraph (1), the applicant shall” for “The applicant shall”, and (iii) by the insertion of the following paragraphs after paragraph (2): “(2A) The security control and mitigation measures referred to in subparagraph (q) of paragraph (1) shall indicate how those measures ensure a high level of technical security and data protection, including for the software and information technology systems used by the applicant or the undertakings to which it outsources the whole or part of its operations. (2B) The measures referred to in paragraph (2A) shall also include the security measures referred to in Regulation 118(1) and (2) of the Payment Services Regulations and shall take into account the European Banking Authority’s guidelines on security measures where such guidelines have been issued under Article 95(3) of the Payment Services Directive. (2C) An applicant that applies for authorisation to provide payment initiation services, shall as a condition of its authorisation, hold a professional indemnity insurance policy, covering the territories in which it offers services, or some other comparable guarantee against liability to ensure that it can cover its liabilities in relation to the provision of such services. (2D) An applicant that applies for authorisation or registration for the purposes of providing account information services, shall as a condition of its authorisation, hold a professional indemnity insurance policy covering the territories in which it offers services, or some other comparable guarantee against its liability vis--vis an account servicing payment service provider or a payment service user resulting from non-authorised or fraudulent access to or non-authorised or fraudulent use of payment account information. (2E) In paragraph (2D), “account servicing payment service provider” and “payment service user” have the same meaning as they have in the Payment Services Regulations.”, (e) in Regulation 14, by the substitution of the following paragraph for paragraph (3): “(3) Methods, A, B and C are set out in Regulations 12, 13 and 14, respectively, of the Payment Services Regulations.”, (f) by the substitution of the following for Regulation 19: “Accounting and statutory audit 19. (1) The European Union (Credit Institutions: Financial Statements) Regulations 2015 ( S.I. No. 266 of 2015 ) and Regulation (EC) No 1606/2002 of the European Parliament and of the Council of 19 July 200224
\n
shall apply to an electronic money institution, subject to the modification that a reference in the European Union (Credit Institutions: Financial Statements) Regulations 2015 to a credit institution shall be construed as a reference to an electronic money institution.
\n
(2)Part 6 of the Companies Act 2014 (No. 38 of 2014) shall apply mutatis mutandis to an electronic money institution to which that Act does not otherwise apply.
\n
(3)Unless exempted under the Companies Act 2014 (including as applied in accordance with paragraph (2)), where applicable, the European Union (Credit Institutions: Financial Statements) Regulations 2015, the annual accounts and consolidated accounts of an electronic money institution shall be audited by a statutory auditor or audit firm within the meaning of the European Union (Statutory Audits) (Directive 2006/43/EC, as amended by Directive 2014/56/EU, and Regulation (EU) No 537/2014) Regulations 2016 ( S.I. No. 312 of 2016 ).
\n
(4)For supervisory purposes, an electronic money institution shall provide separate accounting information for the issuance of electronic money and activities referred to in Regulation 28, which shall be subject to an auditor’s report prepared, where applicable, by the statutory auditors or an audit firm.
\n
(5)Regulation 52 of the European Union (Capital Requirements) Regulations 2014 ( S.I. No. 158 of 2014 ) shall apply to the statutory auditor or audit firm of an electronic money institution in respect of the issuance of electronic money, subject to the modification that a reference in those Regulations to a credit institution shall be construed as a reference to an electronic money institution.”, (g) by the substitution of the following for Regulation 21: “Use of agents 21. (1) Where an electronic money institution whose home Member State is the State intends to provide payment services through an agent it shall communicate the following information to the Bank: (a) the name and address of the agent; (b) a description of the internal control mechanisms that will be used by the agent in order to comply with the obligations in relation to money laundering and terrorist financing under the law of the State giving effect to Directive (EU) 2015/849, to be updated without delay in the event of material changes to the particulars communicated at the initial notification; (c) the identity of directors and persons responsible for the management of the agent to be used in the provision of payment services and, for agents other than payment service providers, evidence that they are fit and proper persons; (d) the payment services of the electronic money institution for which the agent is mandated; (e) where applicable, the unique identification code or number of the agent.
\n
(2)Within 2 months of receipt of the information referred to in paragraph (1), the Bank shall inform the electronic money institution whether the details of the agent concerned have been entered in the Register.
\n
(3)An agent shall not commence provision of payment services prior to the entry of its details in the Register.
\n
(4)Before listing an agent in the Register, the Bank shall, if it considers that the information provided to it pursuant to paragraph (1) is incorrect, take further action to verify the information.
\n
(5)Where, after taking action to verify the information, the Bank is not satisfied that the information provided to it pursuant to paragraph (1) is correct, it shall not list the agent in the Register and shall inform the electronic money institution accordingly without undue delay.
\n
(6)Where an electronic money institution proposes to provide payment services in another Member State by engaging an agent or establishing a branch it shall follow the procedures set out in Regulation 26.”, (h) by the substitution of the following for Regulation 22: “Outsourcing of functions 22. (1) Where an electronic money institution whose home Member State is the State proposes to outsource an operational function relating to the provision of electronic money services or payment services, it shall inform the Bank accordingly not less than 30 days prior to the date on which it proposes to commence such outsourcing.
\n
(2)Outsourcing of important operational functions, including information technology systems, shall not be undertaken in a manner that materially impairs the quality of the electronic money institution’s internal control and the ability of the Bank to monitor and review the electronic money institution’s compliance with these Regulations.
\n
(3)For the purposes of this Regulation, an operational function shall be regarded as important if a defect or failure in its performance would materially impair the continuing compliance of an electronic money institution with the requirements of its authorisation under this Part, its other obligations under these Regulations, its financial performance, or the soundness or the continuity of its provision of electronic money services or payment services.
\n
(4)An electronic money institution may only outsource an important operational function where it meets the following requirements: (a) the outsourcing will not result in the delegation by senior management of its responsibility; (b) the relationship and obligations of the electronic money institution towards its electronic money holders or payment service users under these Regulations will not be altered; (c) the conditions with which the electronic money institution is to comply in order to be authorised and remain so in accordance with this Part will not be breached; (d) none of the other conditions subject to which the electronic money institution’s authorisation was granted will be removed or modified.”, (i) by the insertion of the following Regulation after Regulation 22: “22A Information obligation
\n
(1)An electronic money institution shall ensure that agents or branches acting on its behalf inform electronic money holders and payment service users of this fact.
\n
(2)An electronic money institution whose home Member State is the State shall communicate to the Bank without undue delay any change regarding the use of— (a) entities to which activities are outsourced, and (b) in accordance with the procedure provided for in paragraphs (2), (3), (4) and (5) of Regulation 21, agents, including additional agents.”, (j) by the substitution of the following for Regulation 25: “Record-keeping 25. (1) An electronic money institution shall keep all appropriate records for the purpose of this Part for at least 5 years.
\n
(2)Paragraph (1) does not affect the operation of the law of the State giving effect to Directive (EU) 2015/849 or other relevant European law.”, (k) by the substitution of the following for Regulation 26: “Application to exercise the right of establishment and freedom to provide services 26. (1) An electronic money institution which proposes to provide (a) electronic money services, or (b) payment services, for the first time in another Member State, in the exercise of the right of establishment or the freedom to provide services, shall communicate the following information to the Bank not less than 3 months prior to the date on which it proposes to commence provision of those services: (i)the name, address and, where applicable, authorisation number of the electronic money institution; (ii)the Member State or Member States, as the case may be, in which it intends to operate; (iii)the electronic money or payment services to be provided; (iv)where the electronic money institution intends to make use of an agent, the information referred to in Regulation 21(1) ; (v)where the electronic money institution intends to make use of a branch, the information referred to in subparagraphs (b) and (e) of Regulation 8(1) with regard to the electronic money business in the host Member State, a description of the organisational structure of the branch and the identity of those responsible for the management of the branch; (vi)where the electronic money institution proposes to outsource operational functions of electronic money or payment services to other entities in the host Member State, that it proposes to do so.
\n
(2)Where an electronic money institution becomes aware of any relevant change regarding the information communicated in accordance with paragraph (1), including as regards additional agents, branches or entities to which activities are outsourced in the host Member States in which it operates, it shall communicate any such change to the Bank without undue delay.
\n
(3)Within 1 month of receipt of all of the information referred to in paragraph (1), or change regarding such information received in accordance with paragraph (2), as the case may be, the Bank shall send the information to the competent authority of the host Member State.
\n
(4)Where the Bank receives information from a competent authority of another Member State in accordance with the law of that Member State equivalent to paragraph (3), the Bank shall, within 1 month of receipt of the information assess that information and provide that competent authority with relevant information in connection with the proposed provision of electronic money or payment services by the electronic money institution, authorised by that competent authority, in the exercise of the freedom of establishment or the freedom to provide services.
\n
(5)The Bank shall, when providing relevant information in accordance with paragraph (4), inform the competent authority concerned in particular of any reasonable grounds for concern in connection with the intended engagement of an agent or establishment of a branch with regard to money laundering or terrorist financing within the meaning of Directive (EU) 2015/849.
\n
(6)Where the Bank does not agree with an assessment provided by the competent authority of a host Member State, provided by that competent authority in accordance with the law of that Member State equivalent to paragraphs (4) and (5), it shall provide that competent authority with the reasons for the Bank’s disagreement with that assessment.
\n
(7)If the assessment of the Bank, in particular in light of the information received from the competent authority of the host Member State provided by that competent authority in accordance with the law of that Member State equivalent to paragraphs (4) and (5), is not favourable, the Bank shall refuse to register the agent or branch or shall withdraw the registration if already made.
\n
(8)If the assessment of the Bank, in particular in light of the information received from the competent authority of the host Member State provided by that competent authority in accordance with the law of that Member State equivalent to paragraphs (4) and (5), is favourable, the Bank shall enter the agent or branch in the Register.
\n
(9)Within 3 months of receipt of the information referred to in paragraph (1), or where a change to that information has been provided in accordance with paragraph (2), receipt of the most recently received of such information, the Bank shall communicate its decision to the competent authority of the host Member State and to the electronic money institution.
\n
(10)Upon entry in the Register, the agent or branch, as the case may be, of the electronic money institution concerned may commence its activities in the host Member State.
\n
(11)The electronic money institution concerned shall notify the Bank of the date from which it commences its activities through the agent or branch, as the case may be, in the relevant host Member State.
\n
(12)The Bank shall inform the competent authority of the host Member State concerned of the information provided by the electronic money institution concerned in accordance with paragraph (11).”, (l) by the insertion of the following Regulations after Regulation 26: “Supervision of electronic money institutions exercising the right of establishment and freedom to provide services 26A. (1) In order to carry out the controls and take the necessary steps provided for in this Part and in Parts 3, 4 and 5 in respect of the agent or branch of an electronic money institution authorised under Regulation 9 located in the territory of another Member State, the Bank shall cooperate with the competent authorities of the host Member State of that agent or branch.
\n
(2)The Bank shall notify the competent authority of the host Member State concerned where the Bank intends to carry out an on-site inspection in that Member State.
\n
(3)The Bank may delegate to the competent authority of the host Member State concerned the task of carrying out on-site inspections of the agent or branch concerned.
\n
(4)The Bank may require an electronic money institution authorised in another Member State having an agent or branch in the State to report to the Bank periodically on the activities carried out in the State.
\n
(5)A report referred to in paragraph (4) shall be required for information or statistical purposes and, as far as the agent or branch concerned conducts the electronic money or payment service business under the right of establishment, to monitor compliance with this Part and Parts 3, 4 and 5.
\n
(6)The Bank shall provide the competent authority of a host Member State of the agent or branch of an electronic money institution authorised under Regulation 9 with all essential and relevant information, in particular in the case of infringements or suspected infringements of these Regulations by an agent or a branch, and where such infringements occurred in the context of the exercise of the freedom to provide services.
\n
(7)The Bank shall, for the purposes of compliance with paragraph (6), communicate, upon request, all relevant information and, on its own initiative, all essential information, including on the compliance of the electronic money institution with the conditions under Regulation 11(1) .
\n
(8)The Bank may require an electronic money institution operating in the State through an agent under the right of establishment, the head office of which is situated in another Member State, to appoint a central contact point in the State to— (a) ensure adequate communication and information reporting on compliance with this Part and Parts 3, 4 and 5, without prejudice to any obligations under anti-money laundering law or counter terrorist financing law, and (b) facilitate supervision by the competent authority of the home Member State and any other host Member States of the electronic money institution concerned, including by providing such competent authorities with documents and information on request.
\n
(9)Paragraph (8) shall not apply to an electronic money institution that distributes or redeems electronic money through natural or legal persons acting on its behalf.
\n
Measures in case of non-compliance, including precautionary measures 26B. (1) Where the Bank ascertains that an electronic money institution authorised in another Member State having agents or branches in the State contravenes this Part or Parts 3, 4 or 5 it shall inform the competent authority of the home Member State of the electronic money institution concerned without delay.
\n
(2)Where the Bank receives information from a competent authority in another Member State pursuant to the law of that Member State equivalent to paragraph (1), the Bank shall, after having evaluated the information received, without undue delay, take all appropriate measures, available to it under this or any other law of the State, to ensure that the electronic money institution concerned ceases its contravention.
\n
(3)Where the Bank takes measures under paragraph (2), it shall communicate those measures without delay to the competent authority of the host Member State of the electronic money institution concerned and to the competent authorities of any other Member State concerned.
\n
(4)In an emergency situation, where immediate action is necessary to address a serious threat to the collective interests of the electronic money holders in the State, where the State is the host Member State, the Bank may, in parallel with the cross-border cooperation between competent authorities and pending measures by the competent authorities of the home Member State of the electronic money institution concerned, as provided by Regulation 26A, take such precautionary measures, available to it under this or any other law of the State, as it considers appropriate in the circumstances.
\n
(5)A precautionary measure taken under paragraph (4) shall— (a) be appropriate and proportionate to its purpose to protect against a serious threat to the collective interests of the electronic money holders in the State, (b) not result in a preference for electronic money holders of the electronic money institution concerned in the State over electronic money holders of the electronic money institution in other Member States, (c) be temporary, and (d) be terminated when the serious threats identified are addressed, including with the assistance of or in cooperation with the home Member State’s competent authority or with the European Banking Authority in accordance with Regulation 61A.
\n
(6)Where compatible with the emergency situation referred to in paragraph (4), the Bank shall inform— (a) the competent authorities of the home Member State of the electronic money institution concerned and those of any other Member State concerned, (b) the Commission, and (c) the European Banking Authority in advance and in any case without undue delay, of the precautionary measures taken under paragraph (4) and of their justification.
\n
Reasons and communication 26C. (1) The Bank shall only take a decision pursuant to Regulation 26, 26A, 26B or 59 involving penalties or restrictions on the exercise of the freedom to provide services or the freedom of establishment where that decision is justified in the circumstances relating to the decision.
\n
(2)Where the Bank takes a decision pursuant to Regulation 26, 26A, 26B or 59 involving penalties or restrictions on the exercise of the freedom to provide services or the freedom of establishment, it shall communicate the reasons for its decision to the electronic money institution concerned.
\n
(3)Regulations 26, 26A and 26B shall be without prejudice to the obligation of the Bank under the law of the State giving effect to Directive (EU) 2015/849 and Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 201525 , in particular under the law of the State giving effect to Article 48(1) of Directive (EU) 2015/849 and Article 22(1) of that Regulation, to supervise or monitor the compliance with the requirements laid down in those enactments.”, (m) in Regulation 27— (i) in paragraph (1), by the substitution of the following subparagraph for subparagraph (a) : “(a) if the institution— (i) does not engage in the provision of electronic money services or payment services, in accordance with the authorisation within 12 months, expressly renounces the authorisation or ceases to engage in that business for more than 6 months, (ii) obtained the authorisation through false statements or any other irregular means, (iii) would constitute a threat to the stability of or trust in the payment system by continuing its electronic money or payment services business, or (iv) no longer meets the conditions for granting the authorisation or fails to inform the competent authority on major developments in this respect,”, and (ii) by the deletion of paragraph (6), (n) in Regulation 59, by the insertion of the following paragraph: “(3) Where the Bank requires an electronic money issuer to provide information under paragraph (1) (a), it shall specify the purpose of the request, where appropriate, and the time limit by which the information is to be provided.”, (o) in Regulation 61, by the substitution of the following paragraph for paragraph (2): “(2) The Bank may exchange information with— (a) the competent authorities of other Member States responsible for the authorisation and supervision of electronic money institutions, (b) the European Central Bank and the central banks of other Member States, in their capacity as monetary and oversight authorities, and, where appropriate, other public authorities responsible for overseeing payment and settlement systems, (c) relevant authorities of other Member States designated under laws giving effect to the Payment Services Directive, Directive (EU) 2015/849 and other acts of the European Union applicable to payment service providers (including acts applicable to money laundering and terrorist financing), and (d) the European Banking Authority, in its capacity of contributing to the consistent and coherent functioning of supervising mechanisms (as referred to in point (a) of Article 1(5) of Regulation (EU) No 1093/2010).”,
\n
(p) by the insertion of the following Regulation after Regulation 61: “Settlement of disagreements between competent authorities of different Member States 61A. (1) Where the Bank considers that, in a particular matter, cross-border cooperation with competent authorities of another Member State referred to in Regulations 26, 26A, 26B, 26C or 61 does not comply with the relevant conditions set out in those provisions, it may refer the matter to the European Banking Authority and request its assistance in accordance with Article 19 of Regulation (EU) No 1093/2010.
\n
(2)Where the European Banking Authority has been requested to assist in accordance with Article 19 of Regulation (EU) No 1093/2010 or the European Banking Authority, on its own initiative, is assisting the Bank and competent authorities of other Member States in reaching an agreement in accordance with the second subparagraph of Article 19(1) of that Regulation, the Bank shall defer its decision on the matter concerned pending resolution under Article 19 of that Regulation.”, and (q) by the insertion of the following Regulation after Regulation 77: “Activities taken up before 13 January 2018 77A. (1) An electronic money institution that has, before 13 January 2018, taken up activities— (a) in the State in accordance with these Regulations and the European Communities (Payment Services) Regulations 2009, or (b) in another Member State in accordance with the laws of that Member State giving effect to the Electronic Money Directive and Directive 2007/64/EC of the European Parliament and of the Council of 13 November 200726 , may continue to carry out those activities in the State until 13 July 2018 without being required to seek authorisation in accordance with Regulation 8 or to comply with the other requirements of Part 2.
\n
(2)An electronic money institution to which paragraph (1) applies shall submit all relevant information to the Bank in a timely manner in order to allow the Bank to assess whether the electronic money institution complies with its requirements under Part 2 and, if not, which measures need to be taken in order to ensure compliance or whether a withdrawal of authorisation is appropriate.
\n
(3)The Bank shall complete the assessment referred to in paragraph (2) by 13 July 2018.
\n
(4)Where the Bank is satisfied that an electronic money institution to which paragraph (1) applies complies with the institution’s obligations under Part 2, the Bank shall grant an authorisation to the electronic money institution and enter in the Register the information required under Regulation 7 in respect of the electronic money institution.
\n
(5)Where the Bank is not satisfied by 13 July 2018 that an electronic money institution to which paragraph (1) applies complies with the institution’s obligations under Part 2, the electronic money institution shall be prohibited from issuing electronic money.”.
\n
Amendment of European Union (Capital Requirements) Regulations 2014
\n
Section 143
\n
143.The Schedule to the European Union (Capital Requirements) Regulations 2014 ( S.I. No. 158 of 2014 ) is amended by the substitution of the following paragraph for paragraph (4): “(4) Payment services as defined in Article 4(3) of Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 201527 .”.
\n
Amendment of Act of 1942 — professional secrecy
\n
Section 144
\n
144.Section 33AK of the Act of 1942 is amended— (a) in subsection (4)(a) (ii), by the insertion of “or (5B)” after “subsection (1A)”, (b) by the insertion of the following subsections after subsection (5): “(5A) Subsection (5) shall not apply to confidential information received by the Bank in the performance of its functions as a competent authority designated as such for the purposes of the Payment Services Directive. (5B) A person to whom subsection (1) applies shall not disclose confidential information concerning— (a) the business of any person or body whether corporate or incorporate that has come to the person’s knowledge through the person’s office or employment with the Bank, or (b) any matter arising in connection with the performance of the functions of the Bank or the exercise of its powers, if such disclosure is required to be prohibited by the Payment Services Directive. (5C) Subject to subsection (5B), the Bank may disclose confidential information received by it in the performance of its functions as a competent authority (so designated for the purposes of the Payment Services Directive)— (a) to a public authority or body designated by another Member State as the competent authority for the purposes of the Payment Services Directive, (b) to the European Central Bank and the central banks of other Member States, in their capacity as monetary and oversight authorities, and, where appropriate, other public authorities responsible for overseeing payment and settlement systems, (c) to the European Banking Authority, in its capacity of contributing to the consistent and coherent functioning of supervising mechanisms (as referred to in point (a) of Article 1(5) of Regulation (EU) No 1093/2010 of 24 November 201028), (d) to the relevant authorities of other Member States designated under laws giving effect to the Payment Services Directive, Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 201529 and other Acts of the European Union applicable to payment service providers (including Acts applicable to the protection of individuals with regard to the processing of personal data and to money laundering and terrorist financing), (e) to authorities entrusted with the public duty of supervising other financial sector entities and the authorities responsible for the supervision of financial markets, (f) to authorities or bodies charged with responsibility for maintaining the stability of the financial system in Member States through the use of macroprudential rules,
\n
(g) to reorganisation bodies or authorities aiming at protecting the stability of the financial system, (h) to bodies involved in the liquidation and bankruptcy of institutions and in other similar procedures, (i) to the persons responsible for carrying out statutory audits of the accounts of institutions, insurance undertakings and financial institutions, (j) to the ESCB central banks and other bodies with a similar function in their capacity as monetary authorities when the information is relevant for the exercise of their respective statutory tasks, (k) to contractual or institutional protection schemes as referred to in Article 113(7) of Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 201330 , (l) where appropriate, to other public authorities responsible for overseeing payment systems, (m) to the European Systemic Risk Board, the European Insurance and Occupational Pensions Authority and the European Securities and Markets Authority, where that information is relevant for the exercise of their functions under Regulation (EU) No 1092/2010 of the European Parliament and of the Council of 24 November 201031 , Regulation (EU) No 1094/2010 of the European Parliament and of the Council of 24 November 201032 or Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 201033 , as the case may be, (n) to a clearing house or other similar body recognised under Irish law for the provision of clearing or settlement services where that information is necessary in order to ensure the proper functioning of those bodies in relation to defaults or potential defaults by market participants, (o) to a liquidator, examiner, receiver or any other person or body involved in the liquidation or bankruptcy of a supervised entity in relation to that entity, (p) to the Minister for Housing, Planning and Local Government in connection with that Ministers functions under the national housing programme with respect to a mortgage lender, (q) to— (i) the Minister, in accordance with the provisions of the Payment Services Directive in relation to the Minister’s responsibility for policy on the supervision of supervised entities, (ii) authorities in other Member States with responsibilities corresponding to that of the Minister referred to in subparagraph (i), or (iii) where the Bank is the chair of a college of supervisors established under Regulation 104 of the European Union (Capital Requirements) Regulations 2014 ( S.I. No. 158 of 2014
\n
), to the Committee of European Banking Supervisors, (r) to an inspector appointed by the Minister and acting on the Minister’s behalf, (s) where the information is required for the purposes of criminal proceedings, or (t) with the consent of the person to whom the information relates and, if the information was obtained from another person, that other person.