EN ECB-PUBLIC  
 
 
OPINION OF THE EUROPEAN CENTRAL BANK 
of 21 March 2018 
on security and protection of critical infrastructures  
(CON/2018/15) 
 
Introduction and legal basis 
On 21 February 2018 the European Central Bank (ECB) received a request from the Governor of the 
Nationale Bank van België/Banque Nationale de Belgique (NBB), acting on behalf of the Belgian Ministry of Finance, for an opinion on a draft law (hereinafter the ‘draft law’) amending the Law of 
11 December 1998 on security classification, security clearance, security certificates and security advisory notices (the ‘Law of 11 December 1998 on security matters’
1) and on a draft Royal Decree 
appointing the administrative authorities as competent  to implement the Law of 11 December 1998 on 
security matters (hereinafter the ‘draft Royal Decree’ an d together with the draft law, the ‘draft laws’).  
The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the 
Functioning of the European Union and the third, fifth and sixth indents of Article 2(1) of Council Decision 98/415/EC
2, as the draft laws relate to the NBB, payment  and settlement systems and rules applicable to 
financial institutions insofar as they materially influe nce the stability of financial institutions and markets. 
In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central 
Bank, the Governing Council has adopted this opinion. 
 1. Purpose of the draft laws 
1.1 The main purpose of the draft laws is to complement the existing legal framework on the protection 
of the fundamental interests of the Belgian State, including, inter alia , the internal and external 
security of the State and the integrity of the State’s territory, in the li ght of growing terrorist threats.  
1.2 Although the Law of 3 May 2005 had already amended the Law of 11 December 1998 on security 
matters with a view to creating a clearer and more comprehensive legal basis for the Belgian 
National Security Authority to conduct security checks of specific natural persons, this framework has proven inadequate to deal with the growing number of requests for security checks.  
1.3 In order to improve the balance between the respect for the privacy of natural persons subject to 
security checks and the efficiency of these measures, the draft law provides for the designation of 
administrative authorities which will act as a liaison between the National Security Authority and the 
                                                 
1  « Loi du 11 décembre 1998 relative à la classification et aux habilitations, attestations et avis de sécurité/Wet van 
11 december 1998 betreffende de  classificatie en de veiligheidsmachtigingen, veiligheidsattesten en 
veiligheidsadviezen».  
2 
 Council Decision 98/415/EC of 29 June 1998 on the consultation of the European Central Bank by national 
authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42).  
ECB-PUBLIC 
2 various sectors of activities falling within the scope of the Law of 11 December 1998 on security 
matters and deemed necessary for the protection of the fundamental interests of the State.  
1.4 The draft Royal Decree designates the NBB as the administrative authority for critical financial 
infrastructures. The NBB has already been designated as the competent authority for critical financial infrastructures under the Law of 1 July 2011 on the security and protection of critical 
infrastructures
3. 
1.5 The draft law requires the appointment of security officers within the administrative authorities as 
well as within all public and private legal entities  falling within the relevant sectors. The draft law 
outlines the procedures which will take place between the National Se curity Authority, the 
competent administrative authorities and the legal enti ties within the relevant sectors, through their 
respective security officers. Upon request by the competent administrative authorities, the relevant legal entities will perform a preliminary risk analysis in order to assess whether the exercise of a 
profession, function, mission or mandate, the access to premises, buildings, sites or the holding of a permit, license or authorisation may, through inappropriate use, undermine any of the 
fundamental interests of the Belgian State. Based on this preliminary risk analysis, the competent 
administrative authority conducts an impact analysis mapping out the effect of potential damages to 
the fundamental interests of the Belgian State. De pending on the results of the impact analysis, the 
competent administrative authority may propose to the National Security Authority that individual 
security checks be conducted with regard to the exercise of a profession, function, mission or 
mandate, access to premises, buildings or sites or the holding of a permit, license or authorisation. 
If the National Security Authority approves the requ est, it will conduct itself the security checks of 
specific individuals involved in the exercise of t he relevant profession, function, mission, mandate, 
the access to premises, buildings, sites or the holding of a permit, license or authorisation. Some of the information gathered as a result of the above-mentioned security checks is available only to the 
security officers of the administrative authoritie s and the relevant legal entities, and may be used 
only in the specific context of the draft law. The draft law provides that the costs incurred as a result 
of the security check, which are currently borne by the individual persons subject to check, will be 
paid by the legal entity which employs the relevant individual.  
 
2. General observations 2.1 The ECB supports the basic purpose of the draft laws to ensure national security in the light of the 
growing threat of terrorism, including to critical financial infrastructures. In particular, the ECB welcomes that the draft laws strengthen the protection of critical financial infrastructures at a time 
when terrorism has become a serious threat to the stability of the financial system. 
2.2 The ECB has laid down oversight requirements fo r systemically important payment systems (SIPS) 
pursuant to Regulation (EU) No 795/2014 of the European Central Bank (ECB/2014/28)
4, which 
addresses operational risk, requiring SIPS operators to establish, inter alia, (i) comprehensive physical and information security policies that adequat ely identify, assess an d manage all potential 
                                                 
3   «  Loi du 1er juillet 2011 relative à la sécurité et à la protection des infrastructures critiques/wet van 1 juli betreffende 
de  beveiliging en de bescherming van de kritieke infrastructuren ».  
4  Regulation of the European Central Bank (EU) No 795/2014 of 3 July 2014 on oversight requirements for 
systemically important payment systems (ECB/2014/28), (OJ L 217, 23.7.2014, p. 16), as amended.. 
ECB-PUBLIC 
3 vulnerabilities and threats and (ii) a business cont inuity plan that addresses events posing a 
significant risk of disrupting the SIPS’ operations, including the use of a secondary site, and a design that ensures that critical information technology systems can resume operations within two 
hours of those events
5. In organising the conduct of security checks for employees of legal entities 
operating critical financial infrastructures, the draft laws touch upon matters of national security 
going beyond the ECB’s oversight requirements.  
2.3 The tasks conferred upon the NBB by the draft laws appear to naturally complement the NBB’s 
existing tasks with regard to the security of critical financial infrastructures, which are carried out by 
the NBB in its capacity as competent authority6 pursuant to the Law of 1 July 2011 on the security 
and protection of critical infrastructures. As the draft laws do not, therefore, confer genuinely new 
tasks on the NBB, the issue of assessing the conferral of new tasks on a national central bank from the perspective of the prohibition of monetary financing does not arise in the case at hand.  
 
3. Specific comments 3.1 The ECB understands that in appointing the NBB as the competent administrative authority for 
critical financial infrastructures, the draft laws enable the NBB, subject to the approval of the National Security Authority, to set in motion the performance of security checks intended to assess 
the potential risks associated with individuals wo rking for private and publ ic legal entities that 
operate critical financial infrastructures. As a liaison between the National Security Authority and 
the security officer for the relevant legal entity, the NBB’s security officer will, for the strict purpose 
of organising the security verification, have access to classified information which would otherwise be unavailable.  
3.2 The tasks of the NBB are limited to (i) the perform ance of part of the preliminary risk analysis; (ii) 
where appropriate, the submission of a proposal to  the National Security Authority for the conduct 
of security checks with regard to the exercise of a profession, function, mission, mandate, access to premises, buildings, sites, or the holding of a permit, license or authorisation; and (iii) acting as a 
liaison between the relevant legal entity and the National Security Authority . Furthermore, pursuant 
to Article 9 of the draft law, the costs incurred in relation to the security checks will ultimately be 
borne by the legal entity employing the individuals subject to the checks. Finally, given that this 
new function will be exercised with respect to financial institutions that are already subject to the supervisory and oversight powers of the NBB, the corresponding expenses are expected to be 
marginal and to be reimbursed in full by the supervised institutions as provided for in the first and second paragraphs of Article 12 of the Royal Decree of 17 July 2012, as amended by the Royal 
Decree of 5 July 2015, on the coverage of the NBB’ s functioning costs derived from the control of 
                                                 
5  See Article 15(4)-(5) of Regulation of the European Central Bank (EU) No 795/2014.  
6  With regard to the NBB’s role as competent authority for the security and protection of critical infrastructures, see 
CON/2014/17, paragraphs 3.1 and 3.5.  
ECB-PUBLIC 
4 financial institutions7. Consequently, the draft laws would not have an impact on the financial 
independence of the NBB.  
 
This opinion will be published on the ECB’s website.  
 
Done at Frankfurt am Main, 21 March 2018.  
[signed] 
 
The President of the ECB 
Mario DRAGHI  
                                                 
7  Arrêté Royal du 17 juillet 2012, modifié par l’arrêt royal du 5 juillet 2015, relatif à la couverture des frais de 
fonctionnement de la Banque Nationale de Belgique liés au contrôle des établissements financiers en exécution de 
l’article 12bis, § 4 de la loi du 22 février 1998 fixant le statut organique de la Banque Nationale de 
Belgique/Koninklijk besluit van 17 juli 2012 gewijzigd bij he t koninklijk besluit van 5 juli 2015 betreffende de dekking 
van de werkingskosten van de Nationale Bank van België ve rbonden aan het toezicht op financiële instellingen, tot 
uitvoering van artikel 12bis, § 4 van de wet van 22 februari 1998 tot vaststelling van het organiek statuut van de 
Nationale Bank van België ».