Piero Cipollone: Towards PSD3 - the dynamics of digitalized payment
systems
Speech by Mr Piero Cipollone, Deputy Governor of the Bank of Italy, at the International
Conference Roma Tre University, Rome, 14 April 2023.
* * *
Good Morning everyone,
I would like to thank the organizers for inviting me to this conference to talk about the
path towards PSD3.
The payments sector is a key component of the European single market. Because of its
lingering fragmentation along national borders, it has been the focus of several
technical and regulatory interventions aimed at improving harmonization among
Member States.
During this journey, PSD2 has been a landmark: it has brought about greater
harmonization and competition in payment services. However, two more milestones
need to be achieved before we can claim the creation of a single EU retail payments
market: to complete the job and thereby allow innovation to be as disruptive as it was
meant to be in PSD2 and to embed in the regulation the dramatic changes in the
technological landscape since PSD2 came into force.
As for completing the job, three hurdles need to be overcome: first, the lack of full
harmonization and complete application of the rules across Member States; as a matter
of fact, the payment services framework still needs to be fully aligned with other EU
policies and legislation: I am referring in particular to the General Data Protection
Regulation - GDPR, the Electronic Money Directive - EMD2 and the Market in
CryptoAssets Regulation - MiCAR. The cost of payment services is the second obstacle; it can
be further reduced by fostering stronger competition within and across Member States.
Third, the role of technological providers (including BigTechs) in the payments sector
still needs to be clarified.
As regards the technological shift, we should consider that PSD2 entered into force in
Italy in 2018; back then, worlds such as smart contracts, DeFi, consensus mechanism,
Dao and DLTs did not even exist and, when they did, they were unknown to most of us.
Today they are part of everyday jargon and they have made their way into important
legislation. As a matter of fact, the Pilot Regime entered into force on March 23. This is
a legal framework that supports those who want to use DLTs to issue, trade, regulate
and store assets. With the decree enacted on March 17, Italy was able to make the
needed adjustment to its domestic legislation so that our financial industry can take
advantage of the Pilot Regime.
This new technological landscape offers many opportunities to develop new payment
solutions that can improve general welfare. Whether this potential will be realized or not
it depends on the way we design PSD3. However, because of the new technological
infrastructure underlying the payment ecosystem, we cannot proceed with the same
mindset that guided us in the past. On the contrary, we need to be creative and to
approach the drawing board with three pillars in mind: i) how to solve the eternal
question of whether to regulate entities, activities, or both; ii) the fact that the whole
ecosystem is evolving continuously and swiftly; and iii) the need to promote
publicprivate partnerships aimed at designing pro-innovation regulations; let me now
elaborate on them.
To answer the first question about who or what should we be regulating, I think we
should first and foremost grasp the profound implications of the new technological
environment; for me, the most striking feature is that the supply chain of a payment
service is increasingly being fragmented among specialized and interdependent actors
caught up in the structure created by the technology, even in absence of any
contractual relationship.
To make clear what I am trying to say, let's recall that before PSD2 came into
existence, the main actors in the field of payment services were traditional PSPs
(banks, electronic money institutions and payment institutions) and the regulations were
centred on these entities.
The PSD2 has contributed to bringing the exclusivity of the bank-customer relationship
to an end; it allows new players such as Third Party Providers (TPPs) to offer new
services to their customers, namely open banking services, without having any
contractual relationship with the incumbent Payment Services Providers on whose
books these customers hold their savings. As a matter of fact, PSD2 laid out a
regulatory framework establishing that PSPs have to grant access to payments
accounts to TPPs through technology solutions, known as Application Programming
Interfaces - APIs.
Here we can clearly see the innovative and disruptive potential of PSD2 and how it was
able to foresee well in advance the technological leap that the payment industry could
make for the benefit of the whole financial world: as a matter of fact, in the 'open'
system, the technological standards replace the traditional 'private rules' (such as the
agreements typical of card schemes) and become technological law themselves. This is
why, in the context of open banking, agreements are not only unnecessary but are even
forbidden; it's the 'API law' that regulates relationships between parties that do not know
each other and that can only trust each other thanks to the digital guarantee offered by
technological standards: this is also the path that will lead open banking towards open
finance.
These technological interdependences will be equally strong for payment solutions and
financial services developed on blockchain platforms (I am referring in particular to
emoney tokens as defined in the MiCA regulation).
We then need to ponder the consequences of this new technological paradigm on our
regulatory framework: the traditional supervisory and/or oversight approach, which
postulates responsibilities that can clearly be traced back to specific entities, is no
longer fit to meet the challenges posed by the new fragmented ecosystem of entities.
It is therefore important to go beyond the 'single entities dimension' and to consider how
to factor the relationships between subjects, infrastructures, tools and services into the
new regulatory framework. One way forward is to think about a product-oriented
approach, whereby all entities involved in the supply chain of payment services, such
as the provision of digital wallets for payment transactions, need to comply with the core
principles underpinning the oversight of payments systems, including beyond their
reciprocal contractual relationship.
This approach is in line with the new Eurosystem oversight framework for electronic
payment instruments, schemes and arrangements (PISA), applicable as of November
2022, which is important because it introduces two significant innovations.
First of all, it goes beyond the traditional notion of a 'funds transfer', embracing instead
that of a 'value transfer', thereby extending the oversight scope to digital payment
tokens (e.g. crypto-assets used within a scheme and stablecoins). The framework also
targets not only traditional payment schemes but also 'arrangements', (e.g. the
aforementioned digital wallets) thereby bringing the complex dimensions that
characterize the new digital ecosystems under the overseer's competencies.
This somewhat lengthy discussion about who and what should be on the regulator's
radar brings me to my second pillar, which is the need to constantly bear in mind that
we are dealing with a very dynamic ecosystem. Therefore, while we are looking at the
current supply chains, and in particular at their single components, we also need to
monitor how they evolve over time and, more importantly, whether new ones are
established with the aim of providing new services or old services in an innovative way.
I have in mind, for example, all micro-payments, machine initiated payments, and
payments in real time using online services.
Continuous monitoring of the current ecosystem is therefore pivotal to designing
regulations that are flexible enough to be 'future-proof' so to speak, in an attempt to
accommodate the continuous flow of innovation.
Finally, and this is my third pillar, we must ask ourselves whether we, as regulators, are
fully equipped to achieve the daunting task I have tried to sketch out so far or whether a
closer interaction with payment industry might be useful. To be frank, we do not know a
great deal about how to regulate areas where the boundaries among activities and
subjects are blurred; these are uncharted waters for us and a more prudent approach is
needed.
Therefore, in addition to the rules on entities and activities and to the oversight
framework on payments systems and services, it might be wise to rely on 'soft'
regulations based on the definition of standards and practices developed according to a
logic of public-private collaboration; this collaborative mode could ensure a sufficient
degree of adherence with respect to ongoing technological development.
A practical example of this approach is represented by the Protocol that the Bank of
Italy has signed with two Italian Universities - Roma Tre and Cattolica di Milano - to
explore the role of smart contracts in DLTs and to provide a basis for the development
of technical standards and rules to be shared with those who, like the developers of the
algorithms, are outside the traditional perimeter of intervention of the regulatory and
control authorities; the first results of this work (a taxonomy of DLTs and the relative
smart contracts) will soon be made public to collect observations and suggestions from
all interested parties in order to be able to proceed to the most important phase for
defining 'good principles'.
To conclude, the retail payments industry is an incubator of innovation. Central banks
and supervisory authorities can play a key role in ensuring that the positive externalities
of innovation benefit consumers and businesses alike. The Bank of Italy is actively
involved in this process by monitoring market developments, interacting with market
operators and supporting the early adoption of digital technologies by the financial
market.
In this context - particularly with regard to interaction with the market - the activities of
the Bank of Italy's innovation facilitators are noteworthy, especially those of the
Comitato Pagamenti Italia (Italian Payments Committee, CPI), managed by the Bank of
Italy, which recently launched three technical working groups dedicated respectively to:
(i) PSD2 Review, (ii) Open Banking and (iii) Public Collections and Payments. The CPI
is the reference forum within which the national community can define strategic
orientations and actively participate in defining the solutions under discussion in the
European arena, including those that are the subject of today's conference and that
concern, through the PSD2 review, the future of the European payments industry.