COMMISSION DELEGATED REGULATION (EU) 2021/1722

of 18 June 2021

supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards specifying the framework for cooperation and the exchange of information between competent authorities of the home and the host Member States in the context of supervision of payment institutions and electronic money institutions exercising cross-border provision of payment services

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (1), and in particular Article 29(7) thereof,

Whereas:

(1) In accordance with Title II of Directive (EU) 2015/2366, the framework for cooperation and for the exchange of information between competent authorities of the home and the host Member States is to enhance cooperation between competent authorities and ensure consistent and efficient supervision of payment institutions providing payment services in other Member States by specifying the method, means and details of cooperation, including the scope and treatment of information to be exchanged.

(2) In order to facilitate communication and exchange of information with competent authorities in other Member States, competent authorities should designate single points of contact. They should notify those contact points to the European Banking Authority (EBA) and to competent authorities in other Member States so that those authorities in other Member States know to whom they should address their requests and notifications. Competent authorities should also indicate the languages in which they can receive correspondence from competent authorities in other Member States.

(3) Standardised forms should be introduced and made available to competent authorities to facilitate their communication when requesting and notifying information from and to each other, in order to ensure consistent and efficient cooperation. Those standard forms should be flexible enough to allow competent authorities to introduce the relevant explanations and information, upon request, and on their own initiative, information that they consider to be essential. It is desirable to introduce deadlines to avoid undue delays regarding the request, exchange and notification of information among competent authorities.

(4) Where the competent authorities of the host Member States require payment institutions located in their territory to report to them periodically on the activities carried out, they should indicate to those payment institutions, the registered office or head office of which is situated in another Member State the language in which and the electronic means, where available, by which they may submit the reports. Furthermore, to enable EBA to fulfil its mandate to contribute to supervisory cooperation and convergence as envisaged in Regulation (EU) No 1093/2010 of the European Parliament and of the Council (2) and for the purposes of applying Directive (EU) 2015/2366 consistently, host competent authorities should inform EBA about their decision to require payment institutions having branches or agents within their territories to report to them periodically.

(5) The content and the format of the reports to be submitted to host competent authorities by payment institutions having branches or agents within their territories should ensure the comparability of the data reported and, to the extent possible, the predictability of the data.

(6) In order to enhance cooperation, where the competent authority of the home Member State intends to carry out an on-site inspection of an agent or a branch of a payment institution located in the territory of another Member State, a specific procedure should be set out. The competent authority of the host Member State may also be able to ask the competent authority of the home Member State to carry out an on-site inspection at the head office of a payment institution situated in the home Member State. Competent authorities of the home and the host Member States should engage in ongoing dialogue to coordinate the various stages of any on-site inspection.

(7) In accordance with Article 6(1)(a) of Directive 2009/110/EC of the European Parliament and of the Council (3), electronic money institutions, in addition to issuing electronic money, are entitled to engage in the provision of payment services. Further, in accordance with Article 3(1) of that Directive, the procedures for supervision of payment institutions exercising the right of establishment and freedom to provide services, including any periodical reporting required from payment institutions, apply mutatis mutandis to electronic money institutions. Article 3(4) of Directive 2009/110/EC also establishes that the provisions for supervision of payment institutions exercising the right of establishment and freedom to provide services apply mutatis mutandis to electronic money institutions distributing electronic money in another Member State through natural or legal persons that act on their behalf, with the exception of the appointment of central contact points in accordance with Article 29(4) of Directive (EU) 2015/2366. Article 3(5) of Directive 2009/110/EC provides that electronic money institutions may not issue electronic money through agents, while they are allowed to provide payment services through agents subject to the conditions laid down in Article 19 of Directive (EU) 2015/2366. Cross-border cooperation among competent authorities in relation to electronic money institutions having branches, agents or distributors within the territory of a host Member State should be facilitated with regard to the content and the format of the reports to be submitted. Nevertheless, information for monitoring compliance with the provisions of national law transposing Titles III and IV of Directive (EU) 2015/2366 should be submitted only by electronic money institutions providing payment services via branches or agents that are establishments in the host Member States.

(8) This Regulation is based on the draft regulatory technical standards submitted by EBA to the Commission.

(9) EBA has conducted open public consultations on the draft regulatory technical standards on which this Regulation is based, analysed the potential related costs and benefits and requested the advice of the Banking Stakeholder Group established in accordance with Article 37 of Regulation (EU) No 1093/2010,

HAS ADOPTED THIS REGULATION:

Article 1 Subject matter and scope 1. This Regulation establishes the framework for cooperation and for the exchange of information between the competent authorities of the home Member State and the host Member State in accordance with Title II of Directive (EU) 2015/2366 and, as far as the payment service business is conducted under the right of establishment, for the monitoring of compliance with the provisions of national law transposing Titles III and IV of that Directive. 2. This Regulation also establishes the means and details of any periodical reporting required by the competent authorities of the host Member States from payment institutions having agents or branches within their territories on the payment business activities carried out in their territories, including the frequency of such reporting, in accordance with Article 29(2), first subparagraph) of Directive (EU) 2015/2366. 3. This Regulation shall also apply mutatis mutandis to the framework for cooperation, and for the exchange of information, between the competent authorities of the home Member State and of the host Member State with regard to the exercise of the right of establishment or of the freedom to provide services by electronic money institutions in accordance with Article 111 of Directive (EU) 2015/2366, including the means and details of any periodical reporting required by the competent authorities of the host Member States from electronic money institutions having agents, branches or distributors within their territories on the payment business activities and electronic money activities carried out in their territories, including the frequency of such reporting, in accordance with the first subparagraph of Article 29(2) of Directive (EU) 2015/2366.

Article 2 Single contact points 1. The competent authorities shall designate a single contact point to receive and transmit requests for cooperation and for the exchange of information in accordance with Article 4. The single contact point shall be a dedicated functional mailbox. 2. Each competent authority shall make information on the single contact points referred to in paragraph 1 available to the other competent authorities and to the European Banking Authority (EBA). 3. Based on the information received by the competent authorities, EBA shall maintain a list of single contact points referred to in paragraph 1 and shall make that list available to the competent authorities. 4. The competent authorities shall communicate updates on the information on single contact points referred to in paragraph 1 to EBA and shall be solely responsible for the validity of the information provided to EBA.

Article 3 General requirements 1. The requests for information and the responses exchanged between competent authorities in accordance with this Regulation shall be submitted in writing in a language customary in the field of finance, or in any Union language accepted by the competent authorities of the home and the host Member States. Those requests and responses shall be transmitted in a secure way by electronic means, where those means are accepted by the competent authorities of the home and the host Member States. 2. Where the requesting authority has objective reasons justifying the urgency of the request, the requesting authority may make the request by means other than those referred to in paragraph 1, including orally. Any request for cooperation or exchange of information made orally shall be subsequently confirmed in writing in accordance with paragraph 1, unless the competent authorities concerned agree otherwise. 3. Each competent authority shall communicate the languages accepted in accordance with paragraph 1 to EBA. EBA shall include that information, for each competent authority, in the list of single contact points referred to in Article 2(2).

Article 4 Submission of requests for cooperation or exchange of information Requests for cooperation of or exchange of information with a competent authority in another Member State shall be submitted to the single contact point of the requested authority by completing the form in Annex I. The requesting authority may attach to the request any document or other material deemed necessary to support the request.

Article 5 Reply to a request for cooperation or exchange of information 1. No later than twenty working days after receipt of a request for cooperation or exchange of information, the requested authority shall provide the following information: (a) all relevant information specified by the requesting authority; (b) all essential information, on its own initiative. The information shall be provided using the form set out in Annex II. It shall be submitted to the single contact point of the requesting authority. 2. The requested authority shall inform the requesting authority of any clarification it requires in relation to the request received. 3. Where, on the basis of the complexity of the request or the amount of information requested, the requested authority is unable to meet the time limit set out in paragraph 1, it shall immediately inform the requesting authority of the justifiable reasons that necessitate any such delay and provide an estimated date of response. 4. Where, as referred to in paragraph 3, the requested authority is not able to provide all the information required within the time limit set out in paragraph 1, it shall provide the information available to it within the time limit set out in that paragraph. For that purpose, it shall use the form in Annex II. 5. The requested authority shall provide the missing information as soon as it becomes available. The requested authority may provide that information in any manner, including orally, that ensures that any necessary action may be taken expediently. 6. Where a procedure for the settlement of a disagreement between the competent authorities of different Member States has been initiated in accordance with Article 27 of Directive (EU) 2015/2366 in relation to a request for cooperation or exchange of information, paragraphs 1 to 4 of this Article shall not apply pending resolution of the procedure under Article 19 of Regulation (EU) No 1093/2010.

Article 6 Notification of intention to carry out an on-site inspection in the host Member State Where the competent authority of the home Member State intends to carry out an on-site inspection of an agent or a branch of a payment institution located in the territory of another Member State, it shall notify the competent authority of the host Member State by completing the form in Annex III.

Article 7 Procedure for a request to carry out an on-site inspection 1. Where the competent authority of the home Member State intends to delegate to the competent authority of the host Member State the task of carrying out an on-site inspection of an agent or a branch of a payment institution located in its territory, it shall send a request to the competent authority of the host Member State, stating the reasons for the request. The competent authority of the home Member State may make a request to carry out the inspection jointly with the competent authority of the host Member State. 2. Where, on the basis of the complexity of the request, the competent authority of the host Member State is unable to fulfil the request, it shall immediately inform the competent authority of the home Member State, stating the justifiable reasons that prevent it from fulfilling the request. 3. The competent authorities of the home and the host Member States shall engage in ongoing dialogue to coordinate the various stages of the on-site inspection and shall agree beforehand on: (a) the subject matter and scope of the inspection; (b) a supervisory programme that sets out the different areas on which the inspection will focus; (c) the allocation of resources and staff; (d) timelines for the completion of the inspection; (e) responsibility for any enforcement actions and for monitoring the implementation of any risk mitigation plan that is considered necessary as a result of the inspection. 4. The competent authority of the home Member State shall submit the request in the accordance with Article 4 and the requested authority shall reply in accordance with Article 5. 5. The competent authority of the host Member State, to ensure consistent and efficient supervision of payment institutions exercising cross-border provision of payment services, may ask the competent authority of the home Member State to carry out an on-site inspection at the head office of a payment institution that is situated in the home Member State and which provides payment services in the host Member State, stating the reasons for the request. 6. The competent authority of the host Member State shall submit the requests under paragraph 5 in accordance with Article 4. 7. Where a procedure for the settlement of a disagreement between the competent authorities of different Member States has been initiated in accordance with Article 27 of Directive (EU) 2015/2366 in relation to a request to carry out an on-site inspection, paragraphs 1 to 4 of this Article shall not apply pending resolution of the procedure under Article 19 of Regulation (EU) No 1093/2010.

Article 8 Notification in the event of an infringement or suspected infringement 1. The competent authorities of the home and host Member States, on becoming aware of any infringements or suspected infringements by an agent or a branch of a payment institution, or such infringements occurring in the exercise of the freedom to provide services, shall notify each other immediately in accordance with Article 4. 2. The notifying competent authority shall provide the notified competent authority with all the indispensable information in relation to the infringements or suspected infringements as referred to in paragraph 1, which shall include: (a) the type of infringement; (b) any actions undertaken by the competent authority such as precautionary measures issued against the payment institution, sanctions or withdrawals of authorisation. The notifying competent authority may provide the notified competent authority with any other information that it considers to be pertinent for the notified competent authority. 3. The notified competent authority may request from the notifying competent authority any other information that it considers to be pertinent for deciding on the appropriate course of action. 4. The competent authorities shall notify each other in this regard by completing the form in Annex IV. The notifying authority may attach to the communication any document or other supporting material deemed pertinent. 5. If the notifying competent authority believes the information should be sent urgently, it may initially notify the other competent authority orally, provided that subsequently the information is transmitted in writing by electronic means, unless the competent authorities agree otherwise.

Article 9 Reporting for information or statistical purposes and to monitor compliance with the provisions of national law transposing Titles III and IV of Directive (EU) 2015/2366 1. Where the competent authorities of host Member States require payment institutions which have their registered office or head office in another Member State and have branches or agents in the host Member State to report to them periodically on their activities, those competent authorities shall indicate to the payment institutions the electronic means by which they may submit reports and in which languages the report may be submitted. 2. The competent authorities of the host Member State shall inform EBA about their decision to require payment institutions having branches or agents within their territories to report to them periodically.

Article 10 Information and data to be reported for information or statistical purposes 1. Where periodical reporting as referred to in Article 9 is required for information or statistical purposes, the reports shall include the following information: (a) the name, the address and where applicable, the authorisation number and the unique identification number of the payment institution in the home Member State in accordance with the form in Annex V; (b) the identity and contact details of the person responsible for the submission of the report; (c) the type of payment services and electronic money services provided, where applicable; (d) the number of places of business regarded as a single branch as defined in Article 4(39) of Directive (EU) 2015/2366, their addresses and the number of employees; (e) the number of agents enrolled within the reporting period and the total number of agents, broken down into number under the freedom to provide services and number under the right of establishment; (f) if applicable, the number of electronic money distributors enrolled within the reporting period and the total number of distributors, broken down into number under freedom to provide services and number under the right of establishment; (g) the names and addresses of the ten largest agents, and the ten largest distributors, if applicable, in the host Member State by transaction volumes; (h) the total volume of transactions carried out by the payment institution within the reporting period, broken down by type of payment service, distribution channel (branch, online, mobile, automated teller machine, telephone, etc.) and agent/branch (the volume of transactions coming in and out of the host Member State must also be specified); (i) the total value of transactions carried out by the payment institution within the reporting period, broken down by: (i) types of payment service; (ii) distribution channel; (iii) agent or branch; (iv) transactions coming into and out of the host Member State; (j) for electronic money institutions, the value of the electronic money distributed and redeemed in the host Member State; (k) the number of payment accounts, including accounts where electronic money is stored, opened or accessed in the host Member State within the reporting period, and the total number of payment accounts operated or maintained in the host Member State; (l) the number of card-based payment instruments issued in the host Member State within the reporting period, broken down by type of card-based payment instrument and stating the outstanding number of card-based payment instruments issued in the host Member State; (m) the number of automatic teller machines operated/managed by the payment institution in the host Member State, if applicable, and cash withdrawals from payment accounts and cash placed on payment accounts through those automated teller machines operated/managed by the payment institution in the host Member State; (n) the number of customers (framework contracts) and payment service users (single payment transactions) in the host Member State registered within the reporting period and the total number at the end of the period; (o) the aggregated number of complaints concerning the rights and obligations under Titles III and IV of Directive (EU) 2015/2366 and security-related customer complaints received from payment service users in the host Member State within the reporting period; (p) the volume of fraudulent payment transactions and the value of gross fraudulent payment transactions incurred in the host Member State within the reporting period; and (q) the number of suspicious transaction reports sent to the financial intelligence unit in the host Member State. 2. Payment institutions shall report values in the currency of the host Member State and, where required to convert currencies, apply the average European Central Bank reference exchange rate for the applicable reporting period. 3. Payment institutions shall report this information to the competent authority of the host Member State using the templates in Annex V. Payment institutions shall report this information annually, for the calendar year, within two months after the end of each calendar year.

Article 11 Additional information and data to be reported for monitoring compliance with the provisions of national law transposing Titles III and IV of Directive (EU) 2015/2366 1. Where the competent authority of the host Member State requires periodical reporting in order to monitor compliance with the provisions of national law transposing Titles III and IV of Directive (EU) 2015/2366, all payment institutions providing payment services in its territories via branches or agents under the right of establishment shall include in their reports all the information referred to in Article 10 and the following information: (a) the name and contact details of the person or persons responsible for the payment institution’s activity and of the compliance officer, if different, in the host Member State, where applicable; (b) the name and contact details of the central contact point in accordance with Article 29(4) of Directive (EU) 2015/2366, where applicable; (c) the number of complaints received from payment service users in the host Member State concerning the rights and obligations under Titles III and IV of Directive (EU) 2015/2366 and security-related customer complaints within the reporting period, broken down into the number of complaints that have been settled and the number that have not, and into the number of complaints that have been replied to and the number that have not, per agent or branch; (d) a brief description of the procedure in place to handle and follow up on customer complaints; (e) amendments to framework contracts within the reporting period; (f) the number of major operational and security incidents that affected payment service users in the host Member State within the reporting period; (g) the aggregated number of requests for refunds received from payment service users within the reporting period for unauthorised or incorrectly executed payment transactions and, where appropriate, the aggregated number of requests for refunds received from payment service users and from account servicing payment service providers (ASPSPs) within the reporting period for losses resulting from one or more of the liabilities referred to in Article 5, (2) and (3), of Directive (EU) 2015/2366, broken down into the number of transactions that have been refunded to the payment account and the number that have not; (h) the total value of refunds made to payment service users within the reporting period, broken down into unauthorised and incorrectly executed payment transactions, and, where appropriate, the total value of refunds made to payment service users and to ASPSPs for losses resulting from the liabilities referred to in Article 5, (2) and (3), of Directive (EU) 2015/2366, broken down into unauthorised and incorrectly executed payment transactions, into unauthorised and fraudulent access to payment account information and into unauthorised and fraudulent use of such information; (i) a brief description of the payment institution’s business model, focusing on the way in which payment services are provided in the host Member State. 2. Payment institutions shall report values in the currency of the host Member State and, where required to convert currencies, apply the average European Central Bank reference exchange rate for the applicable reporting period. 3. Payment institutions shall report the information listed in paragraph 1 to the competent authority of the host Member State in the form laid down in Annex VI. Payment institutions shall report this information annually, for the calendar year, within two months after the end of each calendar year.

Article 12 Entry into force This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States. Done at Brussels, 18 June 2021. For the Commission The President Ursula VON DER LEYEN

(1) OJ L 337, 23.12.2015, p. 35.

(2) Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12).

(3) Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions amending Directives 2005/60/EC and 2006/48/EC and repealing Directive 2000/46/EC (OJ L 267, 10.10.2009, p. 7).