EN ECB-PUBLIC  
 
OPINION OF THE EUROPEAN CENTRAL BANK 
of 14 August 2017  
on an Act on critical infrastructure 
(CON/2017/31) 
 
Introduction and legal basis 
On 4 July 2017 the European Central Bank (ECB) received a request from the Slovenian Ministry of 
Defence for an opinion on a draft Act on critic al infrastructure (hereinafter the ‘draft law’). 
The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the 
Functioning of the European Union and the third and fifth indents of Article 2(1) of Council Decision 
98/415/EC1 as the draft law relates to Banka Slovenije and payment and settlement systems. In 
accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central 
Bank, the Governing Council has adopted this opinion. 
 1. Purpose of the draft law 
1.1 The purpose of the draft law is to systemically re gulate the protection of critical infrastructures of 
national importance to the Republic of Slovenia. Pursuant to the draft law European critical 
infrastructures in the territory of the Republic of Slovenia are also considered to be critical 
infrastructures of the Republic of Slovenia. However legislation and regulations regulating European critical infrastructures apply for the protection of these infrastructures. The draft law 
defines critical infrastructures and their owners/operators, and sets out measures and activities for 
the protection of critical infrastructures, as well as reporting and other tasks of the competent 
authorities with respect to their protection. 
1.2 The draft law identifies Banka Slovenije as a potential owner/operator of a critical infrastructure and 
a (financial) critical infrastructure sector holder. It also identifies the financial sector as one of the 
sectors of critical infrastructures, without further sp ecification. It is envisaged that each sector will 
have an identified holder that will be designated by the Slovenian Government. The criteria for the 
identification of a critical infrastructure are sectoral and cross-cutting and will be adopted by the Slovenian Government. The Slovenian Government will also designate critical infrastructures and 
operators of critical infrastructures.  
1.3 Operators of critical infrastructures have the following responsibilities: (1 ) to draw up, regularly 
update (at least once a year or in the case of new relevant developments within one month of such 
events) and retain operator security plans, which include a risk assessment and measures for the 
protection of critical infrastructures; (2) to obtain  the consent of the critical infrastructure sector 
holder to the operator security plans; (3) to present to the critical sector infrastructure holder and 
                                                 
1  Council Decision 98/415/EC of 29 June 1998 on the consultation of the European Central Bank by national 
authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42). 
ECB-PUBLIC  
2 the Ministry of Defence, at their request, operator security plans; and (4) to inform the critical 
infrastructure sector holder and the National Centre for Crisis Management as soon as possible about a break of functioning of a critical infrastr ucture, if the operator deems that that break may 
have negative material or other consequences on the functioning of the critical infrastructure sector and previously implemented measures for the protecti on of critical infrastructures. The role of an 
operator of a critical infrastructure is to provide uninterrupted continuity of services of the critical 
infrastructure.  
1.4 Critical infrastructure sector holders have an advisory role in relation to the identification of a critical 
infrastructure, a coordinating role in relation to the adoption of proposals for measures for the protection of a critical infrastructure, and a role to provide assistance to the operators of critical 
infrastructures and to prepare and amend legislation dealing with critical infrastructures within their competence from the perspective of the protection of critical infrastructures. Once a year a 
competent critical infrastructure holder has to prepare a report on the provision of the uninterrupted 
functioning of the critical infrastructure for its sector based on annual reports prepared by the operators, which is then included in a joint report prepared by the Ministry of Defence and delivered 
to the Government by May of each year in respect of the previous year.  
1.5  The draft law explicitly states that it does not apply to critical infrastructures operated by the 
European System of Central Banks (ESCB) or crit ical infrastructures operated by Banka Slovenije 
which are supervised by the ESCB.  
1.6 The draft law provides that it does not encroach on the supervision of a critical infrastructure falling 
within the competence of Banka Slovenije or the ESCB governed by European Union legislation and regulations or legislation of the Republic of Slovenia adopted on the basis of such legislation 
and regulations. 
1.7 The draft law provides that the authorized bodies pursuant to the draft law may only with the 
consent of Banka Slovenije adopt decisions relating to any critical infrastructure of Banka Slovenije which is not operated by the ESCB nor by Banka Slovenije under the supervision of the ESCB, but 
which is used by Banka Slovenije for the discharge of its duties pursuant to the Bank of Slovenia 
Act, the Statute of the European System of Cent ral Banks and of the European Central Bank (the 
‘Statute of the ESCB’) or Union legislation or regulations. 
1.8 The draft law provides that data relating to the determination, establishment and protection of 
critical infrastructures designated as restricted or confidential must be treated as such in line with 
relevant applicable legislation. The draft law specifically provides that data available to Banka Slovenije which is held pursuant to the Bank of Slovenia Act, the Statute of the ESCB or other 
legislation and is designated as confidential may only be used in line with such legislation.  
 
2. Observations 
2.1 The ECB understands that the draft law does not purport to implement Directive (EU) 2016/1148 of 
the European Parliament and of the Council
2 into Slovenian law.  
                                                 
2  Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a 
high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1). 
ECB-PUBLIC  
3 2.2 The ECB understands that the term ‘supervision’ (Slovene: “ nadzor” ) as used in the draft law 
includes both ‘supervision’ and ‘oversight’. Under Slovenian law the term ‘supervision’ may be understood as referring to both the concepts of ‘supervision’ and ‘oversight’, as those terms are 
understood in, for example, the English language.  
2.3 Critical infrastructures operated by ESCB central banks and critical infrastructures operated by 
Banka Slovenije which are supervised or overseen by ESCB central banks  
2.3.1 The ECB understands that critical infrastructures operated by ESCB central banks and operated by 
Banka Slovenije which are supervised or overseen by ESCB central banks are exempted from the 
draft law’s scope of application. The ECB welcomes this, as it should help to ensure that Slovenian legislation on the protection of critical infrastructures does not encroach on the ESCB’s 
competences, consistent with the principle of the primacy of Union law and of central bank independence pursuant to Article 130 of the Treaty
3.  
2.3.2 The ECB understands that, pursuant to the draft law, the Slovenian component of the TARGET2 
payment system would be exempt from its scope of application. The TARGET2 payment system has been identified, pursuant to Decision ECB/2014/35 of the European Central Bank
4, as a 
systematically important payment system and is  overseen by the ECB as competent authority 
under Regulation (EU) No 795/2014 of the European Central Bank (ECB/2014/28)5. Banka 
Slovenije acts as the operator of the Sloven ian component of the TARGET2 payment system.  
2.3.3 The ECB understands that the TARGET2-Securities (T2S) services would be exempt from the 
scope of the draft law, since pursuant to Article 6 of the Guideline ECB/2012/13 of the European 
Central Bank6 and Article 7 of the T2S Framework Agreement7, T2S is operated by the ESCB. 
Furthermore, in line with the Governing Council’s decision in its Eurosystem Oversight Policy 
Framework of July 2016, T2S falls under Eurosystem oversight competences under Articles 127(2) of the Treaty and Articles 3(1) and 22 of the Statute of the ESCB
8.  
2.3.4 The ECB understands that the issue of euro banknotes by Banka Slovenije and ESCB central 
banks, insofar as this might be considered as falli ng within the concept of a critical infrastructure 
under the draft law, would be exempt from the draft law’s scope of application, since the ECB has 
the exclusive right to authorise the issue of euro banknotes within the Union under Article 128(1) of the Treaty. 
2.4 Impact of the draft law on supervision and oversight of critical infrastructures subject to supervision 
or oversight by Banka Slovenije or ESCB central banks pursuant to Union legislation or regulations  
                                                 
3  See paragraph 2.2. of Opinion CON/2017/10. All ECB opinions are published on the ECB's website at 
www.ecb.europa.eu . 
4  Decision ECB/2014/35 of the European Central Bank of 13 August 2014 on the identification of TARGET2 as a 
systemically important payment system pursuant to Regulation (EU) No 795/2014 on oversight requirements for systemically important payment systems (OJ L 245, 20.8.2014, p. 5). 
5  Regulation (EU) No 795/2014 of the European Central Bank of 3 July 2014 on oversight requirements for 
systemically important payment systems (ECB/2014/28) (OJ L 217, 23.7.2014, p. 16). 
6  Guideline ECB/2012/13 of the European Central Bank of 18 July 2012 on TARGET2-Securities (OJ L 215, 
11.8.2012, p. 19).  
7  Published on the ECB’s website at www.ecb.europa.eu .  
8  See Section 4.4 of the Eurosystem Oversight Policy Framework, available on the ECB’s website at 
www.ecb.europa.eu . 
ECB-PUBLIC  
4 2.4.1 The draft law provides that it  does not encroach on the supervision of critical infrastructures falling 
within the competence of Banka Slovenije or the ESCB governed by Union legislation or regulations or Slovenian legislation or regulations based on Union legislation. The ECB 
understands that this provision aims to ensure that the draft law does not encroach on the supervision or oversight of financial infrastructures which are not operated by Banka Slovenije or 
ESCB central banks, but which are subject to supervision or oversight by Banka Slovenije or ESCB 
central banks pursuant to Union legislation or regulations. In the interests of legal certainty, it may 
be useful to explicitly clarify in the draft law whether this provision is intended to entirely exclude 
such infrastructures from its scope of application, as is the case for critical infrastructures operated by ESCB central banks or operated by Banka Slovenije subject to the supervision or oversight of 
ESCB central banks. 
2.4.2 The ECB understands that, based on this provision, the draft law would not encroach on the 
supervision or oversight of KDD, d.d., a central securities depository supervised by Banka 
Slovenije pursuant to Regulation (EU) No 648/2012 of the European Parliament and of the Council
9 
and Regulation (EU) No 909/2014 of the European Parliament and of the Council10 11. 
2.4.3 The Eurosystem Oversight Policy Framework identi fies payment instruments, such as cards, credit 
transfers, direct debit and e-money, as an ‘integral part of payment systems’, and thus includes 
these within the scope of its central bank oversight. For payment instruments, the role of primary 
overseer (for the Eurosystem) is assigned by reference to the national anchor of the payment 
scheme and the legal incorporation of its governance authority. For credit transfer and direct debit 
schemes within the Single Euro Payments Area, as well as some of the international card payment schemes, the ECB has the primary oversight role. Payment service providers (PSPs) are subject to 
Directive (EU) 2015/2366 of the European Parliament and of the Council, which is applicable as of 
January 2018
12. While PSPs are therefore subject to Union legislation and Slovenian legislation 
and regulations based on Union legislation13, the oversight of international and domestic card 
schemes are not subject to Union legislation and re gulations as such. If it is intended that such 
schemes will be excluded from the scope of the draft law, it is suggested, in the interests of legal 
certainty, that the draft law should explicitly clarify that it does not encroach on the oversight of card 
schemes by Banka Slovenije or the ESCB that are subject to applicable oversight frameworks, 
guidelines and principles. 
2.4.4 Prominently important retail payment systems (PIRPS) and other retail payment systems (ORPS) 
are subject to oversight standards but are not subj ect to Union legislation and regulations as such. 
                                                 
9  Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, 
central counterparties and trade repositories (OJ L 201, 27.7.2012, p. 1). 
10  Regulation (EU) No 909/2014 of the European Parliament and of the Council of 23 July 2014 on improving securities 
settlement in the European Union and on central securities depositories and amending Directives 98/26/EC and 
2014/65/EU and Regulation (EU) No 236/2012 (OJ L 257, 28.8.2014, p. 1). 
11  Supervision of KDD, d.d. is shared between Banka Slov enije and the Slovenian Securities Market Agency pursuant 
to the Financial Instruments Market Act (2007) and the Decree on the implementation of the Regulation (EU) on 
improving securities settlement in the European Union and on central securities depositories ( 2016 ). The Slovenian 
Securities Market Agency issues authorization to, and supervises, KDD, d.d. in the provision of notary services and central maintenance services and other related non-banking-type ancillary services.  
12  Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services 
in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 
1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35). 
13  Payment Services and Systems Act (2009).  
ECB-PUBLIC  
5 Oversight of both PIRPS and ORPS is conducted in accordance with the Eurosystem Revised 
Oversight Framework for retail payment systems14 subject to the Principles for financial market 
infrastructures published by the Committee on Payment and Market Infrastructures and the 
International Organization of Securities Commissions (IOSCO)15, in particular Principle 17 on 
operational risk16. There is however, strictly speaking, no Union regulation or legislation regulating 
the oversight or supervision of these systems. Ba nka Slovenije is given supervisory and oversight 
competence pursuant to the Payment Services and Systems Act (2009), which in this matter does 
not implement Union legislation or regulations. The ECB understands that in this particular case the 
PIRPS and ORPS would fall within the scope of the draft law, insofar as they would be considered as falling within the concept of a critical infras tructure under the draft law, as the term Union 
legislation and regulations would not seem to include ‘soft law’ instruments such as oversight frameworks, guidelines and principles. If it is intended that PIRPS and ORPS should be excluded 
from the scope of the draft law it is suggested, in the interests of legal certainty, that the draft law 
should explicitly clarify that it does not encroach on the oversight of critical infrastructures by Banka 
Slovenije or the ESCB that are subject to applicable oversight frameworks, guidelines or principles.  
2.5 Other critical infrastructures of Banka Slovenije  
 The draft law relates to any critical infrastructure of Banka Slovenije which is not operated by the 
ESCB, nor by Banka Slovenije under the supervision of the ESCB, but which infrastructure is used 
by Banka Slovenije for the discharge of its duties pursuant to the Bank of Slovenia Act, the Statute 
of the ESCB and the ECB or Union legislation or  regulations. The ECB understands that examples 
of critical infrastructures that woul d fall within the scope of this pr ovision would be the infrastructure 
for the issuing and supply of euro coins, with respect to which Banka Slovenije acts as distributor
17, 
and the maintenance of the treasury account system, with respect to which Banka Slovenije 
maintains the accounts of state bodies18. However, before decisions can be adopted under the 
draft law relating to any such critical infrastructure of Banka Slovenije, the consent of Banka Slovenije is required which safeguards its institutional independence. 
 
This opinion will be published on the ECB’s website.  
 
 
Done at Frankfurt am Main, 14 August 2017 
 
[signed]  
 The President of the ECB 
Mario DRAGHI 
                                                 
14  Published on the ECB’s website at www.ecb.europa.eu  . 
15  Available on the Bank for International Settlement’s website at www.bis.org  . 
16  This includes Key Considerations 1, 3 and 5 from Principle 17. 
17 Article 60(a) of the Bank of Slovenia Act (2002). 
18   Article 12 of the Bank of Slovenia Act and the Provision of Payment Services to Budget Users Act (2016).