EN ECB-PUBLIC 
 
OPINION OF THE EUROPEAN CENTRAL BANK 
of 21 September 2021  
on a draft regulation concerning the oversight of payment syste ms and supporting technological 
or network infrastructures  
(CON/2021/28) 
 
Introduction and legal basis 
On 23 July 2021, the European Central Bank (ECB) received a req uest from the Banca d’Italia for an opinion 
on a draft regulation concerning the oversight of payment syste ms and supporting technological or network 
infrastructures (hereinafte r the ‘draft regulation’).  
The ECB’s competence to deliver an opinion is based on Articles  127(4) and 282(5) of the Treaty on the 
Functioning of the European Union and the second, third, fifth and sixth indents of Article 2(1) of Council 
Decision 98/415/EC1, as the draft regulation relates to means of payment, the Banc a d’Italia, payment and 
settlement systems, and rules applicable to financial instituti ons that materially infl uence the stability of 
financial institutions and markets. In accordance with the firs t sentence of Article 17.5 of the Rules of 
Procedure of the European Central Bank, the Governing Council h as adopted this opinion. 
 
1. Purpose of the draft regulation 1.1 The main purpose of the draft regulation is to update the s econdary legislation concerning the 
oversight of retail payment  services and systems
2, which was adopted in 20123.  
1.2 The draft regulation governs payment systems in a broad sen se, including relevant third-party 
payment service providers. In particular, the draft regulation extends the scope of the existing 
legislation to encompass both Italian retail and large-value pa yment systems, as well as technical 
infrastructures or service providers supporting the payment eco system,  whose registered address 
and/or centre of operatio ns is located in Italy4.  
1.3 Under the draft regulation,  payment system operators are re quired to notify the Banca d’Italia of, 
inter alia , the taking-up and termination of their operation, the system operation rules, incident 
reports, their cyber resilience s trategy alongside the relevant  implementing procedures, and their 
operational risk management documentation5. 
 
1  Council Decision 98/415/EC of 29 June 1998 on the consultation  of the European Central Bank by national 
authorities regarding draft legisl ative provisions (OJ L 189, 3 .7.1998, p. 42). 
2  Banca d’Italia, Provvedimento del 18 Settembre 2012, Disposiz ioni in materia di sorveglianza sui sistemi di 
pagamento al dettaglio, available on the Banca d’Italia’s websi te at www.bancaditalia.it .  
3  See Opinion CON/2012/38. All EC B opinions are available on EU R-Lex. 
4  See Article 2 of the draft regulation. 
5   See Articles 3 and 13 of the draft regulation. 
ECB-PUBLIC  
2 1.4 With reference to large-value payment systems, the draft re gulation sets out specific additional 
requirements concerning collateral eligibility, means of settle ment, management of principal risk, 
tiered participation, and the us e of relevant internationally a ccepted communication procedures 
and standards in  order to facilitate effi cient payment, clearin g, settlement and recording6.  
1.5 The draft regulation also contains specific provisions on t he retail payment systems operated by 
the Banca d’Italia. In this context, most of the requirements p rovided for retail payment system 
operators also apply to the Banca d’Italia. In particular, the Banca d’Italia is expected to comply 
with the principle of full cost  recovery when operating retail payment systems7. 
1.6 Furthermore, technical infrastructures and service provider s are required to notify the Banca d’Italia 
of the taking-up and termination of their operation in support of the payment ecosystem as well as 
of any significant change to the services they provide to one o r more payment service providers 
and/or payment system operators8. Where technical infrastructures and service providers are 
classified as critical by the Banca d’Italia, they are required  to comply with requirements concerning 
governance, internal controls, business risk, legal risk and op erational risk9.  
1.7 Finally, the draft regulation is to be complemented by a gu ide on controls and by an annex 
containing business continuity m easures. Both documents are to be published on the Banca 
d’Italia’s website. 
 
2. General observations  
2.1 The ECB welcomes the draft regulation, which aims to (1) ac hieve alignment with the Committee 
on Payments and Market Infrastruct ures (CPMI) and the Internati onal Organization of Securities 
Commissions (IOSCO)10 Principles for financial market infrastructures (hereinafter t he ‘CPMI-
IOSCO principles’), (2) strengthen operational and cyber resili ence in the payment sector, and (3) 
support the role of the Banca d’Italia as overseer of payment s ystems and of their supporting 
technological or network infrastructures. The ECB also welcomes  the fact that the draft regulation 
provides for the application of the principle of full cost reco very by the Banca d’Italia when operating 
retail payment systems. 
2.2 The ECB welcomes the application of the draft regulation to  payment systems other than those 
classified as systemically impor tant payment systems (SIPS) und er Regulation (EU) No 795/2014 
of the European Central Bank (EC B/2014/28) (hereinafter the ‘SI PS Regulation’)11.  
2.3 In addition, the ECB welcomes the adherence of the draft re gulation to the Eurosystem oversight 
policy framework12 and the Eurosystem’s policy rega rding the identification and o versight of critical 
service providers of financia l market infrastructures. 
 
6  See Article 16 of t he draft regulation. 
7   See Articles 17 and 18 of the draft regulation. 
8  See Article 19 of t he draft regulation. 
9   See Article 21 of t he draft regulation. 
10  Available on the Bank for Inte rnational Settlements’ website at www.bis.org . 
11  Regulation (EU) No 795/2014 of the European Central Bank of 3  July 2014 on oversight requirements for 
systemically important paymen t systems (ECB/2014/28) (OJ L 217,  23.7.2014, p. 16). 
12  Eurosystem oversight policy framework, Revised version (July 2016) available on the ECB’s website at 
www.ecb.europa.eu . 
ECB-PUBLIC  
3 2.4 Furthermore, the ECB welcomes the alignment of the draft re gulation with the CPMI-IOSCO’s 
Guidance on cyber resilience  for financial market infrastructures13, which the ECB has 
operationalised in its cyber resilience oversight expectations for financial market infrastructures 
(CROE)14. The ECB suggests that any guidance to be developed under the draft regulation should 
be aligned with the CROE. 
2.5 Finally, the ECB notes that the recitals to the draft regul ation contain, inter alia , a list of frameworks 
which have been considered by the Banca d’Italia. For the sake of clarity, the ECB would suggest 
referring to Regulation (EU) 2021/728 of the European Central B ank (ECB/2021/17)15, which is the 
most recent amending  legal act to the SIPS Regulation, instead of Regulation (EU) No 2017/2094 
of the European Central Bank (ECB/2017/32)16. Alternatively, the Banca d’Italia may consider 
including a dynamic reference to the SIPS Regulation.  
 
This opinion will be published on EUR-Lex.  
  
Done at Frankfurt am Main, 21 September 2021. 
 [signed] 
 
The President of the ECB Christine LAGARDE 
 
13  Available on the Bank for Intern ational Settlements’ website a t www.bis.org . 
14  Cyber resilience oversight expectations for financial market infrastructures (December 2018) available on the ECB’s 
website at www.ecb.europa.eu .  
15  Regulation (EU) 2021/728 of the European Central Bank of 29 A pril 2021 amending Regulation (EU) No 795/2014 on 
oversight requirements for systemic ally important payment syste ms (ECB/2021/17) (OJ L 157, 5.5.2021, p. 1). 
16  Regulation (EU) 2017/2094 of the European Central Bank of 3 N ovember 2017 amending Regulation (EU) 
No 795/2014 on oversight requirement s for systemically importan t payment systems (ECB/2017/32) (OJ L 299, 
16.11.2017, p. 11).