Opinion of the European Central Bank of 14 August 2017 on an Act on critical infrastructure (CON/2017/31)
Date: 2017-08-14
Institutions: European Central Bank
Subjects: Slovenia, critical infrastructure security, electronic banking, intra-EU payment, national law, payment system

EN 

ECB-PUBLIC 

OPINION OF THE EUROPEAN CENTRAL BANK 

of 14 August 2017  

on an Act on critical infrastructure 

(CON/2017/31) 

Introduction and legal basis 

On  4  July  2017  the  European  Central  Bank  (ECB)  received  a  request  from  the  Slovenian  Ministry  of 

Defence for an opinion on a draft Act on critical infrastructure (hereinafter the ‘draft law’). 

The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the 

Functioning  of  the  European  Union  and  the  third  and  fifth  indents  of  Article  2(1)  of  Council  Decision 
98/415/EC1  as  the  draft  law  relates  to  Banka  Slovenije  and  payment  and  settlement  systems.  In 

accordance  with  the  first  sentence  of  Article  17.5  of  the  Rules  of  Procedure  of  the  European  Central 

Bank, the Governing Council has adopted this opinion. 

1. 

Purpose of the draft law 

1.1  The  purpose  of the  draft law  is  to systemically  regulate  the  protection of critical infrastructures of 

national  importance  to  the  Republic  of  Slovenia.  Pursuant  to  the  draft  law  European  critical 

infrastructures  in  the  territory  of  the  Republic  of  Slovenia  are  also  considered  to  be  critical 

infrastructures  of  the  Republic  of  Slovenia.  However  legislation  and  regulations  regulating 

European  critical  infrastructures  apply  for  the  protection  of  these  infrastructures.  The  draft  law 

defines critical infrastructures and their owners/operators, and sets out measures and activities for 

the  protection  of  critical  infrastructures,  as  well  as  reporting  and  other  tasks  of  the  competent 

authorities with respect to their protection. 

1.2  The draft law identifies Banka Slovenije as a potential owner/operator of a critical infrastructure and 

a (financial) critical infrastructure sector holder. It also identifies the financial sector as one of the 

sectors of critical infrastructures, without further specification. It is envisaged that each sector  will 

have an identified holder that will be designated by the Slovenian Government. The criteria for the 

identification  of  a  critical  infrastructure  are  sectoral  and  cross-cutting  and  will  be  adopted  by  the 

Slovenian Government. The Slovenian  Government will also  designate critical infrastructures and 

operators of critical infrastructures.  

1.3  Operators  of  critical  infrastructures  have  the  following  responsibilities:  (1)  to  draw  up,  regularly 

update (at least once a year or in the case of new relevant developments within one month of such 

events) and retain operator security plans, which include a risk assessment and measures for the 

protection  of  critical  infrastructures;  (2)  to  obtain  the  consent  of  the  critical  infrastructure  sector 

holder to the  operator security  plans; (3) to present to the critical sector  infrastructure  holder and 

1  

Council  Decision  98/415/EC  of  29 June  1998  on  the  consultation  of  the  European  Central  Bank  by  national 
authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42). 

 
 
 
 
                                                 
ECB-PUBLIC 

the  Ministry  of  Defence,  at  their  request,  operator  security  plans;  and  (4)  to  inform  the  critical 

infrastructure  sector  holder  and  the  National  Centre  for  Crisis  Management  as  soon  as  possible 

about  a  break of functioning  of a  critical infrastructure, if the operator deems that that break may 

have negative material or other consequences on the functioning of the critical infrastructure sector 

and  previously  implemented  measures  for  the  protection  of  critical  infrastructures.  The  role  of  an 

operator  of  a  critical  infrastructure  is  to  provide  uninterrupted  continuity  of  services  of  the  critical 

infrastructure.  

1.4  Critical infrastructure sector holders have an advisory role in relation to the identification of a critical 

infrastructure,  a  coordinating  role  in  relation  to  the  adoption  of  proposals  for  measures  for  the 

protection  of  a  critical  infrastructure,  and  a  role  to  provide  assistance  to  the  operators  of  critical 

infrastructures and to prepare and amend legislation dealing with critical infrastructures within their 

competence  from  the  perspective  of  the  protection  of  critical  infrastructures.  Once  a  year  a 

competent critical infrastructure holder has to prepare a report on the provision of the uninterrupted 

functioning  of  the  critical  infrastructure  for  its  sector  based  on  annual  reports  prepared  by  the 

operators, which is then included in a joint report prepared by the Ministry of Defence and delivered 

to the Government by May of each year in respect of the previous year.  

1.5 

 The  draft  law  explicitly  states  that  it  does  not  apply  to  critical  infrastructures  operated  by  the 

European System of Central Banks (ESCB) or critical infrastructures operated by Banka Slovenije 

which are supervised by the ESCB.  

1.6  The draft law provides that it does not encroach on the supervision of a critical infrastructure falling 

within  the  competence  of  Banka  Slovenije  or  the  ESCB  governed  by  European  Union  legislation 

and regulations or legislation of the Republic of Slovenia adopted on the basis of such legislation 

and regulations. 

1.7  The  draft  law  provides  that  the  authorized  bodies  pursuant  to  the  draft  law  may  only  with  the 

consent of Banka Slovenije adopt decisions relating to any critical infrastructure of Banka Slovenije 

which is not operated by the ESCB nor by Banka Slovenije under the supervision of the ESCB, but 

which is used by Banka Slovenije for the discharge of its duties pursuant to the Bank of Slovenia 

Act, the Statute of the European System of Central Banks and of the European Central Bank (the 

‘Statute of the ESCB’) or Union legislation or regulations. 

1.8  The  draft  law  provides  that  data  relating  to  the  determination,  establishment  and  protection  of 

critical infrastructures designated as restricted or confidential must be treated as such in line with 

relevant  applicable  legislation.  The  draft  law  specifically  provides  that  data  available  to  Banka 

Slovenije  which  is  held  pursuant  to  the  Bank  of  Slovenia  Act,  the  Statute  of  the  ESCB  or  other 

legislation and is designated as confidential may only be used in line with such legislation.  

2. 

Observations 

2.1  The ECB understands that the draft law does not purport to implement Directive (EU) 2016/1148 of 

the European Parliament and of the Council2 into Slovenian law.  

2  

Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a 
high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1). 

2 

 
                                                 
ECB-PUBLIC 

2.2  The  ECB  understands  that  the  term  ‘supervision’  (Slovene:  “nadzor”)  as  used  in  the  draft  law 

includes  both  ‘supervision’  and  ‘oversight’.  Under  Slovenian  law  the  term  ‘supervision’  may  be 

understood  as  referring  to  both  the  concepts  of  ‘supervision’  and  ‘oversight’,  as  those  terms  are 

understood in, for example, the English language.  

2.3  Critical  infrastructures  operated  by  ESCB  central  banks  and  critical  infrastructures  operated  by 

Banka Slovenije which are supervised or overseen by ESCB central banks 

2.3.1  The ECB understands that critical infrastructures operated by ESCB central banks and operated by 

Banka Slovenije which are supervised or overseen by ESCB central banks are exempted from the 

draft law’s scope of application. The ECB welcomes this, as it should help to ensure that Slovenian 

legislation  on  the  protection  of  critical  infrastructures  does  not  encroach  on  the  ESCB’s 

competences,  consistent  with  the  principle  of  the  primacy  of  Union  law  and  of  central  bank 
independence pursuant to Article 130 of the Treaty3.  

2.3.2  The ECB understands that, pursuant to the draft law, the Slovenian component  of the TARGET2 

payment  system  would  be  exempt  from  its  scope  of  application.  The  TARGET2  payment  system 
has  been  identified,  pursuant  to  Decision  ECB/2014/35  of  the  European  Central  Bank4,  as  a 

systematically  important  payment  system  and  is  overseen  by  the  ECB  as  competent  authority 
under  Regulation  (EU)  No  795/2014  of  the  European  Central  Bank  (ECB/2014/28)5.  Banka 

Slovenije acts as the operator of the Slovenian component of the TARGET2 payment system.  

2.3.3  The  ECB  understands  that  the  TARGET2-Securities  (T2S)  services  would  be  exempt  from  the 

scope of the draft law, since pursuant to Article 6 of the Guideline ECB/2012/13 of the European 
Central  Bank6  and  Article  7  of  the  T2S  Framework  Agreement7,  T2S  is  operated  by  the  ESCB. 

Furthermore,  in  line  with  the  Governing  Council’s  decision  in  its  Eurosystem  Oversight  Policy 

Framework of July 2016, T2S falls under Eurosystem oversight competences under Articles 127(2) 
of the Treaty and Articles 3(1) and 22 of the Statute of the ESCB8.  

2.3.4  The  ECB  understands  that  the  issue  of  euro  banknotes  by  Banka  Slovenije  and  ESCB  central 

banks,  insofar  as  this  might  be  considered  as  falling  within  the  concept  of  a  critical  infrastructure 

under the draft law, would be exempt from the draft law’s scope of application, since the ECB has 

the exclusive right to authorise the issue of euro banknotes within the Union under Article 128(1) of 

the Treaty. 

2.4 

Impact of the draft law on supervision and oversight of critical infrastructures subject to supervision 

or oversight by Banka Slovenije or ESCB central banks pursuant to Union legislation or regulations 

3  

4  

5  

6  

7  
8  

See  paragraph  2.2.  of  Opinion  CON/2017/10.  All  ECB  opinions  are  published  on  the  ECB's  website  at 
www.ecb.europa.eu. 

Decision  ECB/2014/35  of  the  European  Central  Bank  of  13  August  2014  on  the  identification  of  TARGET2  as  a 
systemically  important  payment  system  pursuant  to  Regulation  (EU)  No  795/2014  on  oversight  requirements  for 
systemically important payment systems (OJ L 245, 20.8.2014, p. 5). 

Regulation  (EU)  No  795/2014  of  the  European  Central  Bank  of  3  July  2014  on  oversight  requirements  for 
systemically important payment systems (ECB/2014/28) (OJ L 217, 23.7.2014, p. 16). 
Guideline  ECB/2012/13  of  the  European  Central  Bank  of  18  July  2012  on  TARGET2-Securities  (OJ  L  215, 
11.8.2012, p. 19).  
Published on the ECB’s website at www.ecb.europa.eu.  

See  Section  4.4  of 
www.ecb.europa.eu. 

the  Eurosystem  Oversight  Policy  Framework,  available  on 

the  ECB’s  website  at 

3 

                                                 
ECB-PUBLIC 

2.4.1  The draft law provides that it does not encroach on the supervision of critical infrastructures falling 

within  the  competence  of  Banka  Slovenije  or  the  ESCB  governed  by  Union  legislation  or 

regulations  or  Slovenian  legislation  or  regulations  based  on  Union  legislation.  The  ECB 

understands  that  this  provision  aims  to  ensure  that  the  draft  law  does  not  encroach  on  the 

supervision  or oversight of financial infrastructures  which are not operated  by  Banka Slovenije  or 

ESCB central banks, but which are subject to supervision or oversight by Banka Slovenije or ESCB 

central banks pursuant to Union legislation or regulations. In the interests of legal certainty, it may 

be useful to  explicitly clarify in the  draft law  whether this provision is intended to entirely  exclude 

such infrastructures from its scope of application, as is the case for critical infrastructures operated 

by ESCB central banks or operated by Banka Slovenije subject to the supervision or oversight of 

ESCB central banks. 

2.4.2  The  ECB  understands  that,  based  on  this  provision,  the  draft  law  would  not  encroach  on  the 

supervision  or  oversight  of  KDD,  d.d.,  a  central  securities  depository  supervised  by  Banka 
Slovenije pursuant to Regulation (EU) No 648/2012 of the European Parliament and of the Council9 
and Regulation (EU) No 909/2014 of the European Parliament and of the Council10 11. 

2.4.3  The Eurosystem Oversight Policy Framework identifies payment instruments, such as cards, credit 

transfers,  direct  debit  and  e-money,  as  an  ‘integral  part  of  payment  systems’,  and  thus  includes 

these within the scope of its central bank oversight. For payment instruments, the role of primary 

overseer  (for  the  Eurosystem)  is  assigned  by  reference  to  the  national  anchor  of  the  payment 

scheme and the legal incorporation of its governance authority. For credit transfer and direct debit 

schemes within the Single Euro Payments Area, as well as some of the international card payment 

schemes, the ECB has the primary oversight role. Payment service providers (PSPs) are subject to 

Directive (EU) 2015/2366 of the European Parliament and of the Council, which is applicable as of 
January  201812.  While  PSPs  are  therefore  subject  to  Union  legislation  and  Slovenian  legislation 
and  regulations  based  on  Union  legislation13,  the  oversight  of  international  and  domestic  card 

schemes  are  not  subject  to  Union  legislation  and  regulations  as  such.  If  it  is  intended  that  such 

schemes will be excluded from the scope of the draft law, it is suggested, in the interests of legal 

certainty, that the draft law should explicitly clarify that it does not encroach on the oversight of card 

schemes  by  Banka  Slovenije  or  the  ESCB  that  are  subject  to  applicable  oversight  frameworks, 

guidelines and principles. 

2.4.4  Prominently important retail payment systems (PIRPS) and other retail payment systems (ORPS) 

are subject to oversight standards but are not subject to Union legislation and regulations as such. 

9  

10  

11  

12  

13  

Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, 
central counterparties and trade repositories (OJ L 201, 27.7.2012, p. 1). 
Regulation (EU) No 909/2014 of the European Parliament and of the Council of 23 July 2014 on improving securities 
settlement  in  the  European  Union  and  on  central  securities  depositories  and  amending  Directives  98/26/EC  and 
2014/65/EU and Regulation (EU) No 236/2012 (OJ L 257, 28.8.2014, p. 1). 
Supervision of KDD, d.d. is shared between Banka Slovenije and the Slovenian Securities Market Agency pursuant 
to  the  Financial  Instruments  Market  Act  (2007)  and  the  Decree  on  the  implementation  of  the  Regulation  (EU)  on 
improving securities settlement in the European Union and on central securities depositories (2016). The Slovenian 
Securities Market Agency issues authorization to, and supervises, KDD, d.d. in the provision of notary services and 
central maintenance services and other related non-banking-type ancillary services.  

Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services 
in  the  internal  market,  amending  Directives  2002/65/EC,  2009/110/EC  and  2013/36/EU  and  Regulation  (EU)  No 
1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35). 
Payment Services and Systems Act (2009).  

4 

                                                 
ECB-PUBLIC 

Oversight  of  both  PIRPS  and  ORPS  is  conducted  in  accordance  with  the  Eurosystem  Revised 
Oversight  Framework  for  retail  payment  systems14  subject  to  the  Principles  for  financial  market 

infrastructures  published  by  the  Committee  on  Payment  and  Market  Infrastructures  and  the 
International  Organization  of  Securities  Commissions  (IOSCO)15,  in  particular  Principle  17  on 
operational risk16. There is however, strictly speaking, no Union regulation or legislation regulating 

the oversight or supervision of these systems. Banka Slovenije is given supervisory and oversight 

competence pursuant to the Payment Services and Systems Act (2009), which in this matter does 

not implement Union legislation or regulations. The ECB understands that in this particular case the 

PIRPS and ORPS would fall within the scope of the draft law, insofar as they would be considered 

as  falling  within  the  concept  of  a  critical  infrastructure  under  the  draft  law,  as  the  term  Union 

legislation  and  regulations  would  not  seem  to  include  ‘soft  law’  instruments  such  as  oversight 

frameworks, guidelines and principles. If it is intended that PIRPS and ORPS should be excluded 

from the scope of the draft law it is suggested, in the interests of legal certainty, that the draft law 

should explicitly clarify that it does not encroach on the oversight of critical infrastructures by Banka 

Slovenije or the ESCB that are subject to applicable oversight frameworks, guidelines or principles.  

2.5  Other critical infrastructures of Banka Slovenije 

The draft law relates to any critical infrastructure of Banka Slovenije which is not operated by the 
ESCB, nor by Banka Slovenije under the supervision of the ESCB, but which infrastructure is used 

by Banka Slovenije for the discharge of its duties pursuant to the Bank of Slovenia Act, the Statute 
of the ESCB and the ECB or Union legislation or regulations. The ECB understands that examples 
of critical infrastructures that would fall within the scope of this provision would be the infrastructure 
for the issuing and supply of euro coins, with respect to which Banka Slovenije acts as distributor17, 
and  the  maintenance  of  the  treasury  account  system,  with  respect  to  which  Banka  Slovenije 
maintains  the  accounts  of  state  bodies18.  However,  before  decisions  can  be  adopted  under  the 
draft  law  relating  to  any  such  critical  infrastructure  of  Banka  Slovenije,  the  consent  of  Banka 
Slovenije is required which safeguards its institutional independence. 

This opinion will be published on the ECB’s website.  

Done at Frankfurt am Main, 14 August 2017 

[signed] 

The President of the ECB 

Mario DRAGHI 

14  

15  
16  
17 
18   

Published on the ECB’s website at www.ecb.europa.eu . 
Available on the Bank for International Settlement’s website at www.bis.org . 
This includes Key Considerations 1, 3 and 5 from Principle 17. 
Article 60(a) of the Bank of Slovenia Act (2002). 
Article 12 of the Bank of Slovenia Act and the Provision of Payment Services to Budget Users Act (2016). 

5