DECISION (EU) 2019/1349 OF THE EUROPEAN CENTRAL BANK

of 26 July 2019

on the procedure and conditions for exercise by a competent authority of certain powers in relation to oversight of systemically important payment systems (ECB/2019/25)

THE GOVERNING COUNCIL OF THE EUROPEAN CENTRAL BANK,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 127(2) thereof,

Having regard to the Statute of the European System of Central Banks and of the European Central Bank, and in particular Article 3.1, Article 22 and the first indent of Article 34.1 thereof,

Having regard to Regulation of the European Central Bank (EU) No 795/2014 of 3 July 2014 on oversight requirements for systemically important payment systems (ECB/2014/28) (1), and in particular Article 21(2) thereof,

Whereas:

(1) The fourth indent of Article 127(2) of the Treaty and the fourth indent of Article 3.1 of the Statute of the European System of Central Banks and of the European Central Bank empower the Eurosystem to promote the smooth operation of payment systems.

(2) The Eurosystem promotes the smooth operation of payment systems, inter alia, by conducting oversight.

(3) In April 2012, the Committee on Payment and Settlement Systems (CPSS) of the Bank for International Settlements and the Technical Committee of the International Organization of Securities Commissions (IOSCO) jointly published the Principles for financial market infrastructures (hereinafter the ‘CPSS-IOSCO principles’) (2). The Committee on Payments and Market Infrastructures, the successor of the CPSS, and IOSCO subsequently jointly published guidance on these principles.

(4) According to the CPSS-IOSCO principles, a systemically important payment system (SIPS) should be subject to effective oversight on the basis of clearly defined and publicly disclosed criteria because of its potential to trigger systemic risks if insufficiently protected against the risks to which it is exposed. Moreover, the CPSS-IOSCO principles set out specific oversight expectations for critical service providers on which the continuous and adequate functioning of the market infrastructure depends. In addition, the CPSS-IOSCO principles state that competent authorities should have sufficient powers and resources to fulfil their respective tasks, including the power to take corrective action.

(5) The European Central Bank (ECB) implemented the CPSS-IOSCO principles and subsequent guidance insofar as they relate to a SIPS under Regulation (EU) No 795/2014 (ECB/2014/28).

(6) To ensure the application of the highest oversight standards, pursuant to Article 24 of Regulation (EU) No 795/2014 (ECB/2014/28), the Governing Council reviewed that Regulation to assess whether it needed to be amended and subsequently adopted Regulation (EU) 2017/2094 of the European Central Bank (ECB/2017/32) (3), which complemented the power of a competent authority to obtain information and documents from a SIPS operator under Article 21 of Regulation (EU) No 795/2014 (ECB/2014/28) with additional tools.

(7) Accordingly, Article 21(1) of Regulation (EU) No 795/2014 (ECB/2014/28) empowers the competent authority to obtain information and documents from a SIPS operator, require a SIPS operator to appoint an independent expert to perform an investigation or independent review on the operation of the SIPS and conduct on-site inspections or delegate the carrying out thereof.

(8) In addition, Article 21(2) of Regulation (EU) No 795/2014 (ECB/2014/28) requires the ECB to adopt a decision on the procedure and conditions for exercising the powers set out in Article 21(1).

(9) To ensure that the rights of third parties are respected, a competent authority should exercise the powers set out in Article 21 of Regulation (EU) No 795/2014 (ECB/2014/28) in accordance with, and subject to, the general principles of proportionality, equal treatment, effectiveness, efficiency, transparency and procedural due process. In addition, in order to comply with these principles, a decision to exercise the oversight powers set out in Article 21 of Regulation (EU) No 795/2014 (ECB/2014/28) should have a minimum predefined content and be notified to the SIPS operator before any oversight power is exercised.

(10) A formal decision is not required for exercising the power to obtain information or documents, which can be exercised by the competent authority according to its oversight needs, namely to check compliance with Regulation (EU) No 795/2014 (ECB/2014/28) and to facilitate the broader objective of promoting the smooth operation of payment systems at systemic level.

(11) For the purposes of effective oversight, it is important that the competent authority is enabled to impose requirements concerning the type of independent expert to be appointed, the content and scope of the report to be produced, the treatment of the report, including disclosure and publication, and the timing for the production of the report.

(12) The appointment of an independent expert to perform an investigation or independent review of the SIPS should avoid any conflict of interest and respect certain requirements to ensure the independent expert has the requisite qualifications, ability and knowledge to carry out its tasks.

(13) The SIPS operator may outsource core functions related to the clearing and settlement of transactions to critical service providers. When these functions are not performed by the SIPS operator itself but by a critical service provider then it is important that the competent authority should be able to exercise its powers under Article 21 of Regulation (EU) No 795/2014 (ECB/2014/28) in the same manner and to the same extent with respect to the critical service providers as to the SIPS operator. In order to enable this, it is essential that the SIPS operator includes clauses in its contractual arrangements with its critical service providers which allow for the sharing of information, documents and written or oral explanations between the representatives or members of staff of the critical service provider and the competent authority, the independent expert and the on-site inspection team, as the case may be, and for the conducting of on-site inspections at the location of the critical service provider.

(14) In order to deal in an efficient manner with emergency situations, it is important that competent authorities have the possibility to waive certain requirements relating to the exercise of their powers on a case-by-case basis in the limited cases and subject to the conditions specified in this Decision,

HAS ADOPTED THIS DECISION:

Article 1 Definitions The terms used in this Decision shall have the same meaning as the terms defined in Regulation (EU) No 795/2014 (ECB/2014/28) and the following definitions shall also apply: (1) ‘independent expert’ means a natural or a legal person which has no relationship that raises a conflict of interest regarding the SIPS or the SIPS operator or its controlling shareholders and has specific expertise in conducting investigations and reviews of financial market infrastructures with a focus on financial regulation, information systems and communication technology, risk management, financial reporting or auditing; (2) ‘independent review’ means an evaluation of the operation of a SIPS the purpose of which is to provide: insight into any risks and vulnerabilities; assurance on the progress made by a SIPS operator to mitigate any risks and vulnerabilities; and validation of the effectiveness of a SIPS operator's policies, procedures and controls to mitigate any risks and vulnerabilities; (3) ‘investigation’ means an examination and analysis of facts, documents, information and events, and an interpretation of the findings thereof, using known and commonly used investigative methods; (4) ‘on-site inspection’ means an examination taking place at the location of the SIPS operator or at a relevant location related to the activities of a SIPS operator, including at the location of a critical service provider insofar as the contractual arrangements between the SIPS operator and that critical service provider allow for such an inspection, the purpose of which is to provide an in-depth analysis of, amongst other things, business models or governance, different risks and internal control systems; (5) ‘on-site inspection team’ means a group of experts from the competent authority or its delegate or, as the case may be, another Eurosystem central bank, led by a head of team, the purpose of which is to conduct an on-site inspection; (6) ‘critical service provider’ means a service provider that has a direct contractual arrangement with a SIPS operator to provide, on a continuous basis, services to that SIPS operator, and potentially to the participants in the SIPS, which are essential for ensuring information confidentiality and integrity and service availability, as well as the smooth functioning of the core operations of the SIPS; (7) ‘another authority’ means an authority responsible for oversight of a SIPS, other than the competent authority or the central banks overseeing or supervising the critical service providers of a SIPS, to which the power of conducting on-site inspections may be delegated.

Article 2 General principles 1. This Decision sets out the procedure a competent authority shall follow and the conditions it shall comply with in exercising its powers under Article 21(1) of Regulation (EU) No 795/2014 (ECB/2014/28). 2. When exercising its powers under Article 21(1) of Regulation (EU) No 795/2014 (ECB/2014/28), a competent authority shall: (a) have regard to the objectives of Regulation (EU) No 795/2014 (ECB/2014/28) and their applicability to the circumstances of the case and only exercise such powers as are proportional to those objectives and the circumstance of the case in order to avoid any unnecessary burden on a SIPS operator; (b) either apply the same requirements consistently to similar SIPS operators or justify the different treatment of SIPS operators. 3. Without prejudice to Article 11, the competent authority shall notify a SIPS operator in writing of its decision to exercise either of the powers set out in points (b) or (c) of Article 21(1) of Regulation (EU) No 795/2014 (ECB/2014/28). 4. The decision referred to in paragraph 3 shall set out the following: (a) its legal basis and a statement of reasons; (b) the power to be exercised; (c) any additional requirement set out in Articles 4 to 7 according to the power to be exercised; (d) if the power to be exercised is the power to conduct on-site inspections and the written notification to the SIPS operator concerned is omitted in accordance with Article 11, the reasons for proceeding without informing the SIPS operator in advance; (e) the grounds on which the SIPS operator may challenge the decision. 5. The independent expert or on-site inspection team, as applicable, shall have the following powers: (a) the right to require the submission of information and documents in accordance with Article 3; (b) the right to examine the books and records of the SIPS operator and take copies or extracts from such books and records, including those related to services performed by critical service providers of the SIPS insofar as the respective contractual arrangements between the SIPS operator and a critical service provider allow; (c) the right to obtain written or oral explanations from any representative or member of staff of the SIPS operator or its critical service providers (in the latter case only insofar as the respective contractual arrangements between the SIPS operator and a critical service provider allow and in relation to the services provided by that critical services provider to the SIPS); (d) interview any other person that is legally or contractually obliged to provide information for the purpose of collecting information relating to the subject matter of the investigation, independent review or on-site inspection. 6. On conclusion of an investigation or independent review, the independent expert shall provide its draft report to the SIPS operator and the competent authority and subsequently its final report to the competent authority in the format and structure specified by the latter. The independent expert shall ensure that all findings within the report are evidence-based and, to the best of its knowledge and belief, accurate. 7. On conclusion of an on-site inspection, the competent authority shall provide its draft report to the SIPS operator. 8. The SIPS operator shall have the opportunity to comment in writing on a draft report provided by an independent expert or the competent authority. The SIPS operator's management board shall approve and sign the final report prior to submitting it or returning it to the competent authority or the independent expert, as applicable. 9. The obligation of professional secrecy shall apply to all persons with respect to their work in connection with investigations, independent reviews or on-site inspections. All the information exchanged under this Decision shall be treated as confidential, except where its disclosure is required by Union law or national law. 10. Findings resulting from investigations, independent reviews or on-site inspections under Article 21 of Regulation (EU) No 795/2014 (ECB/2014/28) may be published by the competent authority either at a level of detail which does not identify an individual system or operator, or, otherwise, with the consent of the SIPS operator.

Article 3 Exercise of a competent authority's power to obtain information and documents 1. The competent authority may require a SIPS operator to provide all information and documents necessary for the efficient and effective conduct of the oversight functions conferred on it by Regulation (EU) No 795/2014 (ECB/2014/28), including information and documents to be provided at recurring intervals and in specified formats for oversight purposes. 2. When requiring a SIPS operator to provide information and documents in accordance with point (a) of Article 21(1) of Regulation (EU) No 795/2014 (ECB/2014/28), the competent authority shall specify the following: (a) the information or document to be provided; (b) the format of, and the process for the provision of, the information or document; (c) the time limit for provision of the information or document and, if applicable, the intervals at which it is to be provided, without prejudice to the general obligation of a SIPS operator to respond without undue delay. 3. The SIPS operator shall provide the information or document within the time limit and, if applicable, at the intervals requested unless it can provide evidence to the competent authority that one of the following circumstances applies: (a) the information or document is not immediately available; (b) the information or document is not solely owned by the SIPS operator, or does not solely relate to its activity, and consent must therefore be obtained from a third party for providing that information or document to the competent authority. If the competent authority is satisfied with the evidence that one of the circumstances applies, it may grant to the SIPS operator additional time to provide the relevant information or document. 4. The SIPS operator and its staff shall not be exempted from complying with their obligations under this Decision to provide information or documents on the grounds of professional secrecy. 5. The SIPS operator shall include clauses in its contractual arrangements with third parties, including with critical service providers, allowing for the sharing of information and documents with the competent authority, the independent expert and the on-site inspection team in relation to the service provided by these third parties to the SIPS.

Article 4 Exercise of a competent authority's power to require the appointment of an independent expert 1. The competent authority may require the SIPS operator to appoint an independent expert to conduct either an investigation in accordance with Article 5 or an independent review in accordance with Article 6. The competent authority shall notify a SIPS operator of its decision that the SIPS operator shall appoint an independent expert in accordance with Article 2(4). The SIPS operator shall bear all costs related to the appointment of an independent expert. 2. When appointing an independent expert, the SIPS operator shall consult with its critical service provider where relevant. 3. The competent authority shall ensure that the decision by which it requires the SIPS operator to appoint an independent expert shall include at least the following requirements and information: (a) that the independent expert to be appointed by the SIPS operator has not been directly or indirectly involved in the past two years in the operation or oversight of the relevant SIPS, and has the specific expertise needed for the purposes of the investigations and independent reviews, including, for example, expertise in financial market infrastructures, financial regulation, information systems and communication technology, risk management, financial reporting or auditing; (b) details of the role, duties, powers and required field of expertise, ability and knowledge of the independent expert; (c) that the SIPS operator ensure that the independent expert has the requisite qualifications, ability and knowledge and carries out its functions free of any conflict of interest and in accordance with the requirements set out in paragraphs 5 to 7 of this Article; (d) the time limit by which the independent expert shall be appointed; (e) that the SIPS operator inform the competent authority how the requirements imposed by the competent authority have been satisfied and provide any relevant guidance in this respect; (f) that the SIPS operator provide the contact details of the independent expert for the purposes of paragraph 13 of this Article. 4. The decision by which the competent authority requires the SIPS operator to appoint an independent expert may contain requirements in addition to those set out in paragraph 3 above. The SIPS operator shall annex the decision by which the competent authority requires it to appoint an independent expert to its contractual arrangement with the independent expert. 5. In the performance of its functions, an independent expert shall have all the powers referred to in Article 6(3). 6. The SIPS operator shall ensure that the independent expert appointed to carry out an investigation or independent review has the following minimum qualifications: (a) a completed university degree or an equivalent level of qualification; or (b) a certificate or diploma granted or recognised by an EU Member State of professional competence in one of the fields in which the independent expert is required to have expertise for the purposes of the investigation or independent review. 7. Where necessary to ensure practical experience in addition to the qualifications required under paragraph 6, the competent authority may also require the SIPS operator to ensure that the independent expert has experience (preferably of 3 years or more) of performing similar investigations or independent reviews or equivalent examinations for firms within the financial sector. However, before imposing any additional requirement for practical experience the competent authority shall take into account the potential novelty of the investigation or independent review and the restrictions to potential future experts such additional requirements may impose. The SIPS operator shall ensure that the independent expert is subject to principles of professional ethics, covering at least its public-interest function, its integrity and objectivity and its professional competence and due care. 8. When recruiting the independent expert, the SIPS operator shall require sufficient proof of the qualifications and experience referred to in paragraphs 6 and 7. It shall inform the competent authority of the identity of the independent expert selected and, if the competent authority so requests, of how the appointment of the independent expert complies with the requirements in paragraphs 6 and 7. The competent authority shall retain the right to require the SIPS operator to appoint a different independent expert, if it deems that the requirements set out in this Decision or in the decision requiring the appointment of the independent expert are not met by the independent expert chosen by the SIPS operator. 9. Unless specified by the competent authority, the SIPS operator may agree with the independent expert the exact timing for the start and the duration of the investigation or independent review, depending on the scope provided by the competent authority, including in those cases where the competent authority requests the independent review to be made periodically. 10. The SIPS operator shall ensure that the independent expert has access to all the documents and information necessary for the purposes of the investigation or independent review in accordance with Articles 5 and 6 throughout the whole duration of the investigation or independent review. With regard to point (c) of Article 2(5), the SIPS operator shall include clauses in its contractual arrangements with its critical service providers which allow for the independent expert to have access to the explanations of representatives or members of staff of the critical service providers and for transmitting information to the central bank overseeing or supervising the critical service provider in accordance with Article 9(4). 11. The SIPS operator shall allow the independent expert to conduct investigations or independent reviews at the SIPS operator's premises, whenever the competent authority assesses that this will achieve the efficient and effective conduct of the investigations or independent reviews. 12. The SIPS operator shall ensure that the contractual arrangements for the provision of the independent expert's services in respect to conducting investigations or independent reviews provides for the obligation of the independent expert to answer the questions of the competent authority on the findings after the end date to perform the independent review or the investigation has expired. 13. The competent authority may communicate with the independent expert directly giving prior notice to the SIPS operator.

Article 5 Exercise of a competent authority's power to require the conduct of an investigation The competent authority may require the SIPS operator to appoint an independent expert in accordance with Article 4 to conduct an investigation, if it considers that it is necessary to achieve the objectives set out in Regulation (EU) No 795/2014 (ECB/2014/28).

Article 6 Exercise of a competent authority's power to require the conduct of an independent review 1. The competent authority may require the SIPS operator to appoint an independent expert in accordance with Article 4 to conduct an independent review, if it considers that it is necessary to achieve the objectives set out in Regulation (EU) No 795/2014 (ECB/2014/28). 2. The competent authority may require an independent review to take place on a one off basis or, in exceptional cases, at periodic intervals within a pre-defined scope, linked to operational, security, risk management, business or legal grounds. If the competent authority requires an independent review at periodic intervals, then it shall specify and justify the frequency of those intervals and the scope of such independent review as well as its end date. 3. The scope of the independent review may cover one or more matters, chosen by the competent authority upon due justification. The independent expert shall have the power to collect any information from the SIPS that it deems necessary to provide a comprehensive understanding of the matter or matters within the scope of the independent review.

Article 7 Exercise of a competent authority's power to conduct on-site inspections 1. The competent authority may conduct an on-site inspection, or delegate the carrying out of on-site inspections to another authority in accordance with Article 8, if it considers that it is necessary to achieve the objectives set out in Regulation (EU) No 795/2014 (ECB/2014/28). 2. Without prejudice to Article 2(4) of this Decision, when the competent authority exercises the power to conduct on-site inspections, the inspection decision shall at a minimum specify: (a) the subject matter and the purpose of the on-site inspection; (b) the fact that any obstruction to the on-site inspection by the legal person subject thereto shall constitute a breach of Regulation (EU) No 795/2014 (ECB/2014/28), without prejudice to national law. 3. The competent authority shall notify the entity subject to an on-site inspection of the decision, and of the identity of the members of the on-site inspection team, at least 10 working days before the start of the on-site inspection. 4. The competent authority shall ensure that the on-site inspection is conducted within a predefined scope and timeframe which it determines in cooperation with the entity subject to an on-site inspection. However, if it deems necessary, the competent authority may extend the scope and timeframe of the on-site inspection during the inspection by a revised decision, which shall be notified to the entity subject to an on-site inspection. 5. The SIPS operator shall include clauses in its contractual arrangements with critical service providers, which allow for the on-site inspection to also take place at the location of the critical service provider. Such clauses shall allow the competent authority to involve the central bank overseeing or supervising the critical service provider in the on-site inspection process, including for the exchange of relevant information. The SIPS operator shall ensure that those contractual arrangements also allow for the competent authority to have access to written or oral explanations of representatives or members of staff of the critical service providers in relation to the service these provide to the SIPS. The SIPS operator shall also include clauses in the contractual arrangements with its critical service providers which give the competent authority access to information and findings from previous on-site inspections of the critical service provider of the same scope and nature which have already been performed by the central bank overseeing or supervising the critical service provider.

Article 8 Delegation of power to conduct on-site inspections 1. Subject to the conditions set out in the relevant applicable national law and the internal procedural rules of the competent authority, the competent authority may delegate the power to conduct on-site inspections to another authority provided that that authority and its inspection team both keep the information and documents obtained from the SIPS operator confidential and abide by the relevant principles of Article 7 as well as further internal organisational rules for an on-site inspection, and that the delegating competent authority shall retain full power over, and liability in respect of, the inspection. 2. The competent authority, another authority and the SIPS operator shall respect the confidentiality of the on-site inspection proceedings.

Article 9 Cooperation with authorities 1. The competent authority for a SIPS shall exercise the powers referred to in points (b) and (c) of Article 21(1) of Regulation (EU) No 795/2014 (ECB/2014/28) on the basis of a decision taken by it. If the competent authority is a national central bank, it shall inform the Eurosystem of such decision upon its adoption. 2. If a SIPS operator's staff obstruct an on-site inspection required by a competent authority in accordance with this Decision, the national central bank of the participating Member State concerned shall afford the members of the inspection team the necessary assistance in accordance with national law. To the extent necessary for the on-site inspection, this assistance shall include the sealing of any business premises and books or records. Where that power is not available to the national central bank concerned, it shall use its powers to request the necessary assistance of other national authorities. 3. If an on-site inspection or the assistance to be provided in accordance with paragraph 2 of this Article require authorisation by a judicial authority according to applicable national law, then the authority performing the on-site inspection shall apply for such authorisation. 4. When, as part of the investigation or independent review of the SIPS operator, the independent expert is required to exercise the rights set out in Article 2(5) with respect to the critical service providers of a SIPS, the competent authority shall inform the central bank overseeing or supervising the critical service provider of the intention to exercise those rights and may inform that central bank of the findings of the investigation or independent review after it is performed. 5. When an on-site inspection is deemed necessary to take place also at the location of a critical service provider of a SIPS, the competent authority shall inform the central bank overseeing or supervising the critical service provider of the intended on-site inspection prior to notifying the SIPS operator. 6. To the extent an on-site inspection of the same scope and nature was already performed by the central bank overseeing or supervising the critical service provider of a SIPS, the competent authority for the SIPS may choose to rely on the findings of such on-site inspection or perform an on-site inspection of its own. In this regard, the competent authority may ask the critical service provider to give access to the respective information and the findings which are available to it or to consent to the competent authority having access to these findings at the central bank. If there has been no on-site inspection performed yet or not one of the same scope and nature, the SIPS competent authority may, at its discretion, also perform the on-site inspection at the location of the critical service provider. In doing so, the competent authority, having regard to the powers and responsibilities of central banks, may involve the central bank overseeing or supervising the critical service provider in the process of the on-site inspection and may inform that central bank of the findings of the on-site inspection after it has been performed. 7. If the on-site inspection is deemed necessary to take place also at the location of a critical service provider of a SIPS, the competent authority shall also notify the critical service provider of the inspection at the same time as the SIPS operator in accordance with Article 2(4).

Article 10 Right to be heard and access to information 1. The independent expert or the on-site inspection team, as the case may be, shall take into account comments submitted by the SIPS operator during an independent review, an investigation or an on-site inspection and shall base their findings on facts on which the SIPS operator concerned has had the opportunity to comment. 2. When submitting the findings report to the competent authority, the independent expert or the on-site inspection team shall notify the SIPS operator. The SIPS operator shall be entitled to have access to the report, subject to the legitimate interest of other persons and legal entities in the protection of their business secrets. The right of access to the report shall not extend to confidential information affecting third parties.

Article 11 Unannounced on-site inspections Notwithstanding Article 7(3), a competent authority is not obliged to inform an entity subject to an on-site inspection of such inspection in advance if there are indications that there exist facts of a serious nature that threaten the smooth functioning of the SIPS or that informing that entity of the need to proceed with an on-site inspection may undermine its results. In this case, the decision to proceed with an on-site inspection shall indicate the reasons to proceed without informing that entity in advance and shall be provided to that entity only once the inspection has started.

Article 12 Language regime between the competent authority and the SIPS operator 1. Any document which a SIPS operator subject to oversight pursuant to Regulation (EU) No 795/2014 (ECB/2014/28) sends to the competent authority according to Article 3 of this Decision may be drafted in any one of the official languages of the Union, chosen by the SIPS operator. 2. The SIPS operator subject to oversight may agree to exclusively use one Union official language in their written communication with the competent authority. The SIPS operator may revoke such agreement on the use of one language or may choose to waive this right occasionally and for certain written communications in order to accelerate the process, with no effect on future procedures. The revocation shall only affect the aspects of the oversight procedure which have not yet been carried out. 3. The SIPS operator may request the investigation, independent review or on-site inspection to be carried out in a Union official language other than the language agreed for the oversight process. If it intends to do so, the SIPS operator shall give sufficient advance notice of this intention to the competent authority or independent expert prior to the commencement of the investigation, independent review or on-site inspection so that necessary arrangements can be made.

Article 13 Final provisions This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Done at Frankfurt am Main, 26 July 2019. The President of the ECB Mario DRAGHI

(1) OJ L 217, 23.7.2014, p. 16.

(2) Available on the Bank for International Settlements' website at www.bis.org

(3) Regulation (EU) 2017/2094 of the European Central Bank of 3 November 2017 amending Regulation (EU) No 795/2014 on oversight requirements for systemically important payment systems (ECB/2017/32) (OJ L 299, 16.11.2017, p. 11).