EN ECB-PUBLIC 
 
OPINION OF THE EUROPEAN CENTRAL BANK 
of 26 October 2018 
on the review of Finnish law concerning preparedness obligations applicable 
 in the financial sector  
(CON/2018/46) 
 
Introduction and legal basis 
On 16 August 2018, the European Central Bank (ECB) received a request from the Finnish Ministry of 
Finance for an opinion on a proposal to further specify so-called preparedness obligations in the field of 
financial market services to ensure the uninterrupted availability of functions vital to society, including (1) 
amendments to the Law on credit institutions1, the Law on payment institutions2, the Law on investment 
funds3, the Law on investment services4, the Law on the book-entry system, clearing and settlement 
operations5, and the Law on trading in financial instruments6; (2) a draft law on a Joint Working Group for 
incident management in the financial market; and (3) a draft government decree to specify the functions and services the performance of which the addressees of the preparedness obligations shall ensure 
(hereinafter collectively refe rred to as the ‘proposal’). 
The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the 
Functioning of the European Union and the second, fifth and sixth indents of Article 2(1) of Council 
Decision 98/415/EC
7, as the proposal relates to means of payment, payment and settlement systems, 
rules applicable to financial institutions insofar as they materially influence the stability of financial 
institutions and markets and the ECB’s tasks concerning  the prudential supervision of credit institutions 
pursuant to Article 127(6) of the Treaty. In accordance with the first sentence of Article 17.5 of the Rules 
of Procedure of the European Central Bank, the Governing Council has adopted this opinion. 
 1. Purpose of the proposal  
1.1 The proposal elaborates on the existing prepared ness obligations imposed on credit institutions, 
payment institutions, investment funds, investment service providers, the central securities 
depository, and the stock exchange (collectively referred to as ‘addressees’) under Finnish law. 
Credit and payment institutions, investment funds and investment service providers are already 
                                                 
1  Laki luottolaitostoiminnasta (8.8.2014/610). 
2  Maksulaitoslaki (30.4.2010/297). 
3  Sijoitusrahastolaki (29.1.1999/48). 
4  Sijoituspalvelulaki (14.12.2012/747). 
5  Laki arvo-osuusjärjestelmästä ja selvitystoiminnasta (16.6.2017/348). 
6  Laki kaupankäynnistä rahoitusvälineillä (28.12.2017/1070). 
7  Council Decision 98/415/EC of 29 June 1998 on the consultation of the European Central Bank by national 
authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42). 
ECB-PUBLIC  
2 obliged to ensure that they can perform tasks and provide services free of interruption, as far as 
possible, also in emergency situations, by pa rticipating in preparedness planning regarding 
financial markets and by planning contingency measures. The proposal requires these entities to 
ensure the performance of their tasks and the provision of their services, in particular by means of 
maintaining sufficient data systems and data repositories in Finland, and by other arrangements 
deemed sufficient for ensuring their uninterrupted operation in Finland. Regarding investment service providers, for which the preparedness obligation currently concerns only keeping custody of 
securities, the obligation would be extended to ensuring that the issue, trading, clearing and settlement of securities are also safeguarded. The stock exchange, which is currently required to 
ensure its functioning despite interferences and during peak times as well, is tasked with similar 
preparedness obligations as the other addressees . Regarding the central securities depository, 
only editorial amendments to the law are proposed (to align the current wording with the new 
wording of the preparedness obligations imposed on the other addressees) as, in substance, the existing preparedness obligations correspond to those in the proposal.  
1.2 Regarding credit institutions, payment institutio ns and investment service providers, the proposal 
recommends a government decree to specify the functions and services of these entities the 
performance of which is to be ensured also in emergency situations. In respect of credit and 
payment institutions, these include: (1) services for making cash deposits into a payment account or cash withdrawals from a payment account as well as operations related to the provision and 
maintenance of a payment account; (2) the execution of a payment transaction, as an account transfer, involving the transfer of funds to the payment account of a payment service provider 
(PSP) as a direct debit, with a payment card or with another payment instrument; (3) the issuance of a payment instrument into circulation; (4) the approval and processing of a payment transaction 
based on a contract made with a payee, leading to funds being transferred to the payee; and 
(5) functions whereby an account transfer is made into a Finnish account located at another credit 
or payment institution and functions whereby an account transfer coming from such an account can 
be received. In respect of investment funds, these include the activities listed in Articles 53 and 54 of the Law on investment funds to ensure the maintenance of a fund unit register that would record 
basic information on the fund unit-holder, such as the number of units held, a breakdown of the 
different types of shares and series of shares  and the date of registration of the fund unit, as well 
as to ensure that in the case of a new issuance the issue price will be paid within regular 
timeframes. The provision of a share certificate upon request of a fund unit-holder would also be available. In respect of investment service providers, these include: (1) the receipt and 
transmission of orders in relation to financial instruments; (2) the execution of orders in relation to financial instruments on behalf of clients; (3) the management of financial instruments on the basis 
of an agreement with the client whereby the decisive authority regarding investment is given wholly 
or partly to the investment service provider; (4) the organisation of the issue of financial instruments 
into circulation, or the sale thereof, by providing an associated subscription or purchasing 
commitment; (5) the organisation of the issue of financial instruments without subscription or purchasing commitment; (6) services linked to the guarantee of the issue of financial instruments; 
and (7) the storage and maintenance of financial instruments on behalf of the client.  
1.3 The proposal also calls for a decree of the Ministry of Finance to be prepared to regulate the 
principles and arrangements involved in preparedness planning in the financial market. It is further 
ECB-PUBLIC  
3 proposed that the Finnish Supervisory Authority (FSA) issues ordinances on the preparedness 
obligations, covering in particular: (1) the technical details of preparedness planning; (2) the 
documents related to preparedness planning; (3) the technical requirements for and general 
information on the use of the relevant systems and infrastructures; and (4) technical matters in 
respect of the abovementioned points. The proposal also contains sanctions for non-compliance 
with the preparedness obligations. 
1.4 The proposal further provides for a draft law on a Joint Working Group, which would be established 
through a decision of the Ministry of Finance, to plan and coordinate preparedness measures in the financial market. The duties of this Joint Working Group would include: (1) planning and 
coordinating measures necessary for the management of both emergency circumstances and 
serious disruptive situations occurring under normal conditions; (2) acquiring and delivering information necessary for the management of disruptive situations, and serving as support for 
decision-making by public authorities; and (3) supporting the operators who are able to mitigate the negative effects of the disruptive situations on society, e.g. by conveying and analysing information 
on disruptive situations. The draft law on the Joint Working Group also contains related provisions 
on the processing of confidential information.  
 
2. General observations The ECB understands that the basic purpose of the draft law is to impose an obligation on the 
addressees to: (1) plan and prepare in advance measures that would be used in emergency situations and during serious disruptive situations occurring under normal conditions; and (2) to establish and 
maintain systems and infrastructures that are located in Finland, in order to ensure their uninterrupted 
functioning also in emergency situations, in addition to the existing European and international infrastructures. Against this backdrop, the ECB wishes to make a number of general observations on the 
proposal. 
2.1 Consultation of European Commission on the proposal  
The ECB notes that it has previously issued opinions to the Finnish authorities on emergency 
powers legislation that applies in respect of the Finnish financial markets
8. Since the proposal 
affects Union law falling outside the competence of the ECB, in the areas of international and 
national security, and may affect the internal market for financial services, the Ministry of Finance may wish to consult the European Commission on the proposal if it has not already done so
9. For 
its part, the ECB would highlight that, in accordance with Article 4(3) of the Treaty on European Union, pursuant to the principle of sincere cooper ation Member States are obliged to facilitate the 
achievement of the ECB’s tasks and refrain from taking any measures which could jeopardise the 
ECB’s or the ESCB’s objectives. This principle, similar to the views expressed in the ECB’s past opinions
10, should be noted in respect of the areas covered by this opinion. 
2.2 Necessity and proportionality of the proposal  
                                                 
8  See Opinions CON/2002/27 and CON/2006/6. All ECB opinions are published on the ECB’s website at 
www.ecb.europa.eu . 
9  See paragraph 22 of Opinion CON/2006/6; see also paragraph 2.1 of Opinion CON/2018/8.  
10  See footnotes 8 and 12. 
ECB-PUBLIC  
4 The ECB understands that most of the relevant infrastructures that are being used in Finland in the 
financial market sector are either European or global in nature. These infrastructures provide for 
contingency measures and fall back solutions that are not physically located in Finland. As 
contingency measures have already been put in place11, the ECB would recommend that the 
Finnish authorities further consider the necessity and proportionality of the proposal in view of the 
high costs that, the ECB understands, will be caused by the establishment and maintenance of additional national infrastructures. 
2.3 Impact of the proposal on TARGET2, Target2-Securities and ESCB infrastructures  
2.3.1 The ECB understands that the proposal was prepared in view of the situation that the Finnish 
financial sector is cut off entirely from European and other financial market infrastructures (FMIs), 
including TARGET2 and Target2-Securities (T2S), due to an incident during normal circumstances or during an emergency situation. In such a scenario, the ability of Suomen Pankki to engage in 
single monetary policy operations and to provide regular liquidity to Finnish counterparties, through participation of the counterparties in m onetary policy operations, would also be disrupted
12. In the 
event that the Finnish financial sector and Suomen Pankki were cut off from TARGET2 and T2S, 
those systems, including accounts and assets held in them by Finnish participants, would continue 
to operate normally, and branches or subsidiaries of those participants from outside Finland having 
the relevant permissions may continue to make transactions. In the event that a back-up solution becomes available in Finland and starts using TARGET2 and/or T2S balances from the last known 
account position, it would be possible for debits to be made on the same account in both TARGET2 and/or TS2 as well as in the Finnish back-up system, which could eventually lead to the participant, 
in effect, being granted uncollateralised credit (for TARGET2) or selling securities twice (in T2S). 
When planning preparedness measures, it is important to avoid such scenarios and to ensure legal certainty of bookings. 
2.3.2 As member of the Eurosystem, Suomen Pankki has a Treaty based obligation to participate in the 
implementation of the single monetary policy that is conducted via the TARGET2 infrastructure, 
which also transmits large-value payments in general. As appropriate, the measures proposed by 
the proposal do not address TARGET2, T2S or other infrastructures of the European System of 
Central Banks (ESCB). In this respect, the ECB would like to stress that any preparedness measures should not be arranged in such a manner that they would have an adverse effect on the 
performance of ESCB tasks, or prejudice Eurosystem competencies. For the avoidance of doubt, i t 
should also be made clear that the proposal is not intended to apply even indirectly to ESCB infrastructures such as TARGET2 or T2S or prejudice the offering of their services. 
2.4 Oversight of systemically important payment systems  
                                                 
11  See Disclosure Report TARGET2 assessment against the principles for financial market infrastructures (June 2016) 
at https://www.ecb.europa.eu   and EURO1 PFMI Disclosure Report by EBA CLEARING S.A.S. (20 August 2015) at 
https://www.ebaclearing.eu . 
12  To the extent that the situation would fall within the definition of an emergency situation, as defined in the Law on 
emergency powers, this would entail the enactment of a government decree on emergency powers in the field of financial markets (as provided for in the Law on emergency powers, currently in force). In view of preparedness for 
acting in emergency situations, the views expressed in  the past ECB opinions regarding emergency powers 
legislation that applies in respect of the Finnish financial markets, in particular regarding the definition of an emergency situation, remain valid. See paragraph 7 of ECB Opinion CON/2002/27 and paragraph 9 and 14 of CON/2006/6.  
ECB-PUBLIC  
5 By way of background information in connection with the implementation of the proposal, the 
Finnish authorities may wish to take note that Regulation of the European Central Bank (EU) No 
795/2014 of 3 July 2014 on oversight requirements for systemically important payment systems 
(ECB/2014/28)13 (hereinafter the ‘SIPS Regulation’), which covers both large-value and retail 
payment systems of systemic importance, operated either by a Eurosystem central bank or a 
private entity, and the non-legally binding oversight frameworks for retail payment systems and for payment instruments have recently introduced a number of requirements addressing new risks, 
including those related to operational and securi ty risks such as cyber resilience, for which the 
CPMI-IOSCO guidance on cyber resilience for financial market infrastructures
14 has been taken 
into account15.  
2.5 Eurosystem cyber resilience strategy for FMIs  
The Finnish authorities may also wish to take note  of the Eurosystem cybe r resilience strategy for 
FMIs, which is intended to support the implementation of the CPMI-IOSCO guidance from an oversight perspective. The strategy aims to develop a range of tools which can be used by 
regulators and markets to: (1) facilitate effect ive cyber resilience, by enhancing the ‘cyber 
readiness’ of individual FMIs that are overseen by the Eurosystem central banks, and ensure that 
measures are in place to support this; and (2) foster collaboration among FMIs, their critical service 
providers and the relevant authorities. In addition,  the Eurosystem is developing a range of tools 
that can be used by FMIs to enhance their cyber resilience such as a European red team testing 
framework, cyber surveys and focused assessments, to assess the level of cyber maturity of Eurosystem payment systems and to develop cyber resilience oversight expectations to provide 
more detailed guidance to payment system operators. It is essential that Finnish FMIs’ level of 
soundness is guaranteed and that the proposed amendments follow the Eurosystem’s cyber resilience strategy. 
2.6 Prudential  supervision of credit institutions  
The proposal assigns the FSA the power to issue legally binding instructions to credit institutions 
concerning the use and functioning of the fall back systems that market participants are obliged to 
establish to ensure full functioning of the infrastructures in all situations. The ECB understands that 
these powers relate to the existing tasks of the FSA concerning supervision of operational risks and 
cyber security. Credit institutions should establish a sound business continuity management plan to ensure their ability to operate on an ongoing basis and limit losses in the event of severe business 
disruption
16. According to the explanatory memorandum accompanying the proposal, the new FSA 
powers would be limited to cover preparedness planning and technical requirements of data 
systems and data repositories in Finland, and other arrangements deemed sufficient for ensuring 
their uninterrupted operation in Finland, for instance, the interconnectedness of fall back systems. 
For significant credit institutions, these powers fall under the exclusive supervisory task of the ECB 
                                                 
13  Regulation of the European Central Bank (EU) No 795/2014 of 3 July 2014 on oversight requirements for 
systemically important payment systems (ECB/2014/28) (OJ L 217, 23.7.2014, p. 16).  
14  The said guidance was published by the Committee on Payments and Market Infrastructures and the Board of the 
International Organizsation of Securities Commissions (CPM I-IOSCO) in June 2016, available at https://www.bis.org. 
15  See Article 15 of the SIPS Regulation. 
16  European Banking Authority Guidelines of 26 September 2017 on internal governance under Directive 2013/36/EU 
(EBA/GL/2017/11), p. 53-54. 
ECB-PUBLIC  
6 regarding robust governance arrangements, and arrangements and mechanisms for the sound 
management of their risks17. Moreover, under Union law there is an obligation to exchange 
information between the ECB and the national competent authorities, and the national competent 
authorities, under the conditions laid down by law, are required to inform the ECB about material 
supervisory procedures concerning less significant institutions and to transmit to the ECB material 
draft supervisory decisions related to these institutions in order to enable the ECB to exercise oversight over the functioning of  the Single Supervisory Mechanism
18. Hence, the ECB 
recommends that the proposal require the FSA to share information, in a timely and efficient manner, about any exceptional situation affecting the performance of the tasks and the exercise of 
the powers conferred on the ECB for prudential supervisory purposes, as well as the measures 
planned or adopted by the FSA.   
2.7 SEPA Regulation  
The preparedness obligations for Finnish PSPs outlined in the proposal are expected to be 
compliant with the requirements for the SEPA schemes under Regulation  (EU) No 260/2012 of the 
European Parliament and of the Council of 14 March 2012 establishing technical and business 
requirements for credit transfers and direct debits in euro, in particular the requirements for 
‘reachability’ and ‘interoperability’ for PSPs when executing  transactions
19. 
 This opinion will be published on the ECB’s website.  
  
Done at Frankfurt am Main, 26 October 2018 
 [signed] 
 
The President of the ECB Mario DRAGHI 
                                                 
17  Articles 4(1)(e) and 6(4) of Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on 
the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 
29.10.2013, p. 63). 
18  See Articles 6(2) and 6(7)(c)(i) and (iii) of Council R egulation (EU) No 1024/2013 of 15 October 2013 conferring 
specific tasks on the European Central Bank concerning po licies relating to the prudential supervision of credit 
institutions (OJ L 287, 29.10.2013, p. 63); Articles 21(1), 97 and 98 of Regulation (EU) No 468/2014 of the European 
Central Bank of 16 April 2014 establishing the framework for cooperation within the Single Supervisory Mechanism between the European Central Bank and national competent authorities and with national designated authorities 
(SSM Framework Regulation) (ECB/2014/17) (OJ L 141, 14.5.2014, p. 1).  
19  Regulation (EU) No 260/2012 of the European Parliament and of the Council of 14 March 2012 establishing 
technical and business requirements for credit transfers and direct debits in euro and amending Regulation (EC) No 924/2009 (OJ L 94, 30.3.2012, p. 22).