Opinion of the European Central Bank of 31 August 2018 on critical infrastructures, cybersecurity and covered bonds (CON/2018/39)
Date: 2018-08-31
Institutions: European Central Bank
Subjects: Slovakia, banking supervision, exchange of information, financial solvency, financial stability, information security, national law, payment system

EN 

ECB-PUBLIC 

OPINION OF THE EUROPEAN CENTRAL BANK 

of 31 August 2018  

on critical infrastructures, cybersecurity and covered bonds 

(CON/2018/39) 

Introduction and legal basis 

On 18 July 2018 the European Central Bank (ECB) received a request from the Ministry of Finance of the 

Slovak Republic (hereinafter the ‘Ministry of Finance’) for an opinion on a draft law amending the Law on 

resolving crisis situations in the financial market and on amendments to certain laws (hereinafter the ‘draft 

law’). 

The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the 

Functioning of the European Union and the third, fifth and sixth indents of Article 2(1) of Council Decision 
98/415/EC1,  as  the  draft  law  relates  to  Národná  banka  Slovenska  (NBS),  payment  and  settlement 

systems,  rules  applicable  to  financial  institutions  insofar  as  they  materially  influence  the  stability  of 

financial  institutions  and  markets  and  the  ECB’s  specific  tasks  concerning  the  prudential  supervision  of 

credit  institutions  pursuant  to  Article  127(6)  of  the  Treaty.  In  accordance  with  the  first  sentence  of 

Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted 

this opinion. 

1. 

Purpose of the draft law 

1.1  The draft law amends seventeen laws. The majority of amendments it introduces relate to financial 

legislation in a variety of areas.  

1.2  Amendments to Law on critical infrastructure 

1.2.1  The draft law introduces amendments to the Law on critical infrastructure2 through the introduction 

of  a  new  ‘finance’  sector  in  respect  of  critical  infrastructures.  The  draft  law  proposes  that  this 

finance  sector  is  divided  into  three  sub-sectors:  ‘banking’,  ‘financial  markets’  and  ‘public  finance 

management’. The banking and financial markets’ sub-sectors exclude activities and infrastructures 

operated by the Eurosystem, the European System of Central Banks (ESCB) and NBS, or that are 

related to the activities, powers and infrastructures of the Eurosystem, the ESCB, the ECB or NBS.  

1.2.2  The  draft  law  designates  the  Ministry  of  Finance  as  a  competent  authority  in  relation  to  critical 

infrastructure  in  the  finance  sector  for  the  purposes  of  the  Law  on  critical  infrastructure.  In  the 

1  

2  

Council  Decision  98/415/EC  of  29 June  1998  on  the  consultation  of  the  European  Central  Bank  by  national 
authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42). 
Law No 45/2011 on critical infrastructure. This Law also transposed Council Directive 2008/114/EC of 8 December 
2008  on  the  identification  and  designation  of  European  critical  infrastructures  and  the  assessment  of  the  need  to 
improve their protection (OJ L 345, 23.12.2008, p.75). 

 
 
 
 
                                                 
ECB-PUBLIC 

performance of its duties, the Ministry of Finance is required to ask the opinion of NBS in situations 

where the Ministry of Finance carries out its tasks under the Law on critical infrastructure in respect 

of supervised entities in financial markets. 

1.2.3  The  draft  law  excludes  from  the  scope  of  the  Law  on  critical  infrastructure  information  systems, 

infrastructures,  competence,  authority  and  information  of  NBS,  the  ESCB,  the  Eurosystem,  the 

ECB,  the  European  System  of  Financial  Supervision  and  the  Single  Supervisory  Mechanism 
(SSM)3.  In  the  context  of  this  exclusion,  the  draft  law  refers  to  Council  Regulation  (EU)  No 
1024/20134, Regulation (EU) No 468/2014 of the European Central Bank 5, Decision ECB/2014/29 
of the European Central Bank6, Law No 566/1992 on the National Bank of Slovakia, Articles 127 to 

138 and 282 of the Treaty, the Protocol on the Statute of the European System of Central Banks 

and of the European Central Bank (hereinafter the ‘Statute of the ESCB’) and Regulation (EU) No 
795/2014 of the European Central Bank 7. 

1.3  Amendments to Law on cybersecurity 

1.3.1  The draft law introduces amendments to the Law on cybersecurity8 to align it with the new scope of 

the Law on critical infrastructure as amended by the draft law. In particular, the list of providers of 

essential services in the banking sector is expanded to include the administrators and operators of 

networks and information systems which are elements of a critical infrastructure under the Law on 

critical  infrastructure,  or  which  are  directly  connected  to  such  critical  infrastructure,  but  with  the 

exception  of  those  networks  and  information  systems  specified  in  Article  2(2)  of  the  Law  on 

cybersecurity. 

1.3.2  The  draft  law  expressly  retains  the  specific  exclusions  under  the  current  Law  on  cybersecurity 

when extending the scope of operators of essential services in the banking sector. In particular, as 

provided  for  in  Article  2(2),  the  current  Law  on  cybersecurity  does  not  apply  to  the  requirements 

related  to  network  and  information  system  security  and  cybersecurity  incident  reporting  in  the 

banking,  finance  or  financial  system  sectors  as  specified,  for  example,  in  the  Law  on  payment 
services 9.  These  include  the  standards  and  principles  issued  or  adopted  by  the  ECB,  the  ESCB, 
the  Eurosystem  or  the  European  Supervisory  Authorities 10,  if  their  effect  is  at  least  equal  to  the 

3  
4  

5  

6  

7  

8  
9  

10  

See Article XII, point 2 of the draft law. 

Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank 
concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63). 
Regulation  (EU)  No  468/2014  of  the  European  Central  Bank  of  16  April  2014  establishing  the  framework  for 
cooperation within the Single Supervisory Mechanism between the European Central Bank and national competent 
authorities  and  with  national  designated  authorities  (SSM  Framework  Regulation)  (ECB/2014/17)  (OJ  L  141, 
14.5.2014, p. 1). 
Decision ECB/2014/28 of the European Central Bank of 2 July 2014 on the provision to the European Central Bank 
of supervisory data reported to the national competent authorities by the supervised entities pursuant to Commission 
Implementing Regulation (EU) No 680/2014 (OJ L 214, 19.7.2014, p. 34). 
Regulation  (EU)  No  795/2014  of  the  European  Central  Bank  of  3  July  2014  on  oversight  requirements  for 
systemically important payment systems (ECB/2014/28) (OJ L 217, 23.7.2014, p. 16). 
Law No 69/2018 on cybersecurity. 
In particular (a) the provisions requiring the payment services provider (PSP) to manage operational risk (including 
making reports to NBS); (b) incident reporting by the PSP to NBS; (c) the obligation of the payment system operator, 
central  securities  depository  and  PSP  to  submit  from  their  registers  all  the  information  necessary  to  perform 
assessments  based  on  the  standards  issued  by  NBS,  the  ECB,  the  ESCB  and  the  Eurosystem;  and  (d)  the 
provisions  setting  out  the  content  of  applications  for  authorisation  of  payment  institutions  (which  include 
requirements as to the information on management of risks). 
The Law on cybersecurity cross-refers by way of example to Article 127(2) of the Treaty, Articles 12.1 and 22 of the 
Statute of the ESCB, Article 2 of Law No 566/1992 Coll. on the National Bank of Slovakia, and Article 2(9) of Law No 
747/2004 Coll. on financial market supervision. 

2 

                                                 
ECB-PUBLIC 

effect of obligations under the Law on cybersecurity, and also include the decisions, standards and 

principles  issued  or  adopted  by  NBS,  if  their  aim  is  to  achieve  a  higher  level  of  network  and 

information  system  security  than  is  achieved  under  the  Law  on  cybersecurity.  In  addition,  the 

current Law on cybersecurity does not apply to payment systems and securities clearing systems 

overseen or operated by the ECB or the Eurosystem pursuant to Articles 3.1 and 22 of the Statute 

of the ESCB or Regulation (EU) No 795/2014 of the European Central Bank.  

1.4  Amendments to Law on banks 

1.4.1  The draft law amends the provisions of the Law on banks11 regarding the composition of the cover 

pool  underlying  covered  bonds.  In  particular,  it  specifies  that  for  the  purpose  of  calculating  the 
minimum  90%  proportion  of  base  assets12  and  the  maximum  10%  proportion  of  supplementary 
assets13 in the cover pool, liquid assets in the cover pool are not to be taken into account14. 

1.4.2  The draft law further clarifies that the consent of the covered bond programme administrator is not 

required when the covered bond issuer excludes from the cover pool (i) claims where the borrower 
is  in  default  under  Article  178  of  Regulation  (EU)  No  575/201315,  (ii)  assets  with  a  maturity  date 

which exceeds 30 years and (iii) claims where the value of the immovable collateral has decreased 

below the principal amount of the loan. 

1.4.3  The draft law amends the provisions of the Law on banks regarding the provision of information to 

the  Register  of  Bank  Loans  and  Guarantees  maintained  by  NBS,  for  example  by  allowing  public 

authorities  to  make  available  and  provide  to  NBS  any  information  and  data  from  the  public  and 

non-public  parts  of  the  registers  they  maintain,  without  the  consent  of  the  person  to  which  the 

information relates.  

1.4.4  The  draft  law  also  amends  provisions  of  the  Law  on  banks  related  to  the  information  that  the 

Ministry of Finance and the Slovak tax authorities are entitled to receive from credit institutions. In 

particular, the data that credit institutions are required to submit to the Ministry of Finance from their 

accounting  and  statistical  records  are  limited  to  certain  pre-defined  reports  that  are  submitted  to 

NBS under the current Law on banks. On the other hand, the Ministry of Finance and the Financial 

Directorate (the Slovak tax authority) are entitled to receive on an annual basis detailed information 

on  accounts  and  transactions  of  legal  persons  and  entrepreneurs  for  the  purposes  of  their 

analytical work in the area of taxation.  

1.4.5  The  draft  law  extends  the  information-reporting  duties  of  NBS  with  respect  to  Rada  pre  riešenie 

krízových situácií (the Resolution Board). In addition to information on corrective measures that is 

11  
12  

13  

14  

15  

Law No 483/2001 on banks. 

The  Law  on  banks  defines  ‘base  assets’  as  mortgage  loans  with  a  maximum  maturity  of  30  years,  provided  to 
consumers, secured by mortgages over real estate and registered in the covered bond register. 
The  Law  on  banks  defines  ‘supplementary  assets’  as  deposits with  NBS,  the  ECB/  or  a  Eurosystem  central  bank, 
ECB debt certificates, cash, treasury bills of Slovakia or an EU Member State, deposits in banks and bank bonds. 
The  Law  on  banks  requires  covered  bond  issuers  to  maintain  a  liquid  assets  buffer  in  case  positive  and  negative 
cash  flows  are  not  aligned  at  all  times  within  a  180-day  period.  The  liquid  asset  buffer  is  to  cover  all  uncovered 
negative  cash  flows  (subject  to  transitional  provisions)  and  is  to  be  composed  of  Level  1  and  Level  2A  assets,  as 
defined by Commission Delegated Regulation (EU) 2015/61 of 10 October 2014 to supplement Regulation (EU) No 
575/2013  of  the  European  Parliament  and  the  Council  with  regard  to  the  liquidity  coverage  requirement  for  credit 
institutions (OJ L 11, 17.1.2015, p. 1), and is also to be composed of exposures to institutions.  
Regulation  (EU)  No  575/2013  of  the  European  Parliament  and  of  the  Council  of  26  June  2013  on  prudential 
requirements  for  credit  institutions  and  investment  firms  and  amending  Regulation  (EU)  No  648/2012  (OJ  L  176, 
27.6.2013, p. 1). 

3 

                                                 
ECB-PUBLIC 

currently required to be provided under Article 50 of the Law on banks, the draft law requires that 

NBS  must  inform  the  Resolution  Board  in  cases  where  NBS  adopts  decisions  on  a  measure  to 

prevent  crisis  situations  or  receives  notification  from  the  board  of  a  credit  institution  assessed  by 

NBS that one or more of the conditions for making the ‘failing or likely to fail’ determination is met. 

1.5  Amendments to Law on payment services 

The  draft  law  makes  several  amendments  to  the  Law  on  payment  services 16.  For  example,  it 

introduces  an  obligation  for  payment  services  providers  to  establish  an  alternative  dispute 

resolution mechanism to resolve disputes between payment services providers and their consumer 

clients  and  obliges  the  operators  of  such  alternative  dispute  resolution  mechanisms  to  provide 

information to NBS about any breaches by payment services providers of their obligations. 

1.6  Amendments to Law on resolution in the financial market and Law on insolvency and restructuring 

to implement Union law provisions on hierarchy of creditors 

The  draft  law  amends  the  Law  on  resolution  in  the  financial  market17  and  the  Law  on  insolvency 
and restructuring 18 to implement the provisions of Directive (EU) 2017/239919 on the hierarchy of 

creditors. The draft law provides that the claims of Fond ochrany vkladov (the Deposit Guarantee 

Fund) arising from resolution financing rank higher than (a) those arising from eligible deposits of 

natural persons and micro, small and medium-sized enterprises  which exceed the coverage level 

of the Deposit Guarantee Fund, and (b) deposits of natural persons and micro, small and medium-

sized enterprises which  would have been considered eligible deposits if they had not been made 

through branches located in a non-EU Member State. In addition, the draft law provides that claims 

which  are  issued  as  permanent  instruments  without  an  obligation  to  pay  back  the  principal,  and 

which  also  allow  for  their  write-down  or  conversion  to  Tier  1  instruments  are  to  rank  below 

subordinated claims. 

2. 

Preliminary comment 

This opinion focuses on the provisions of the draft law relating to (a) the Law on critical infrastructure and 

the Law on cybersecurity and (b) the Law on banks. 

3. 

Law on critical infrastructure and Law on cybersecurity 

3.1  As  previously  noted 20,  the  ECB  supports  the  aim  of  Directive  (EU)  2016/1148  to  ensure  a  high 

common  level  of  network  and  information  security  across  the  Union  and  to  achieve  a  consistent 

approach in this field across business sectors and Member States. It is important to ensure that the 

16  
17  
18  
19  

20  

Law No 492/2009 on payment services. 
Law No 371/2014 on resolution in the financial market. 
Law No 7/2005 on insolvency and restructuring. 
Directive (EU) 2017/2399 of the European Parliament and of the Council of 12 December 2017 amending Directive 
2014/59/EU as regards the ranking of unsecured debt instruments in insolvency hierarchy (OJ L 345, 27.12.2017, p. 
96). 
See e.g. paragraph 2.1 of Opinion CON/2014/58, paragraph 2.1 of Opinion CON/2017/10, paragraph 2.2 of Opinion 
CON/2018/22 and paragraph 2.2 of Opinion CON/2018/27. All ECB opinions are published on the ECB’s website 
at www.ecb.europa.eu. 

4 

 
 
                                                 
ECB-PUBLIC 

internal market is a safe place to do business and that all Member States have a certain minimum 
level of preparedness for cybersecurity incidents.21 

3.2 

Impact of draft law on payment systems  

3.2.1  The  ECB  understands  that  the  Law  on  critical  infrastructure  and  the  Law  on  cybersecurity,  as 
amended  by  the  draft  law,  do  not  apply  to  payment  systems  operated  or  overseen22  by  ESCB 

central banks. The ECB  welcomes this, as  it should  help to ensure that  Slovak legislation  on  the 

protection of critical infrastructures and on cybersecurity does not encroach on the competences of 

the ECB, the Eurosystem and/or the ESCB, consistently with the principle of the primacy of Union 
law and of central bank independence pursuant to Article 130 of the Treaty23. 

3.2.2  In  particular,  the  ECB  understands  that  (a)  the  Slovak  component  of  the  TARGET2  payment 

system,  which  is  operated  by  NBS,  (b)  the  Slovak  and  Interbank  Payment  System  (SIPS),  a 

prominently important retail payment system operated by NBS and overseen by  NBS pursuant to 
the Revised Oversight Framework for Retail Payment Systems24, and (c) the system operated by 

First Data Slovakia, which  is overseen by NBS pursuant to the Revised Oversight Framework for 

Retail Payment Systems, would all be exempt from the application of both laws as amended by the 

draft  law,  if  the  result  achieved  is  the  same  or  a  higher  level  of  network  and  information  system 

security  than  is  achieved  by  compliance  with  the  Law  on  cybersecurity.  The  TARGET2  payment 
system has been identified, pursuant to Decision ECB/2014/35 of the European Central Bank 25 as 

a systematically important payment system and is overseen by the ECB as the competent authority 

under Regulation (EU) No 795/2014.  

3.3 

Impact of draft law on TARGET2-Securities and critical service providers 

3.3.1  The ECB understands that TARGET2-Securities (T2S) services would be exempt from the scope 
of the Law on critical infrastructure and the Law on cybersecurity26 as amended by the draft law, on 
the basis that pursuant to Article 6 of Guideline ECB/2012/13 of the European Central Bank 27 and 

21  

22  

23  

24  

25  

26   

27  

See e.g. Article 15(4a) of Regulation (EU) No 795/2014 of the European Central Bank of 3 July 2014 on oversight 
requirements for systemically important payment systems (ECB/2014/28) (OJ L 217, 23.7.2014, p. 16). 
In this regard, the ECB understands that the term ‘related to the competencies’ in the text in the draft law amending 
Annex 3 to the Law on critical infrastructure ‘excluding activities and infrastructures operated by the Eurosystem, the 
ESCB  and  NBS,  or  related  to  the  activities,  competencies  and  infrastructures  of  the  Eurosystem,  the  European 
System  of  Central  Banks,  the  European  Central  Bank,  or  Národná  banka  Slovenska’  [emphasis  added]  excludes 
from the scope of Annex 3 all systems overseen by the ESCB.  
See  e.g.  paragraph  2.2  of  Opinion  CON/2014/58,  paragraph  2.2  of  Opinion  CON/2017/10  and  paragraph  3.1.1  of 
Opinion CON/2018/22. 
The  Revised  Oversight  Framework  for  Retail  Payment  Systems  is  published  on  the  ECB’s  website  at 
www.ecb.europa.eu. 
Decision  ECB/2014/35  of  the  European  Central  Bank  of  13  August  2014  on  the  identification  of  TARGET2  as  a 
systemically  important  payment  system  pursuant  to  Regulation  (EU)  No  795/2014  on  oversight  requirements  for 
systemically important payment systems (OJ L 245, 20.8.2014, p. 5). 
It is, however, noted that T2S is not a system and hence would not be considered as a payment system or securities 
clearing  and  settlement  system  within  the  second  arm  of  the  exclusion  under  Article  2(2)(d)  of  the  Law  on 
cybersecurity.  However,  the  ECB  understands  that  T2S  would  be  excluded  from  the  scope  of  the  Law  on 
cybersecurity  based  on  the  first  arm  of  the  same  provision,  as  it  is  overseen  based  on  standards  adopted  by  the 
Eurosystem on the basis of Article 127(2) of the Treaty. If the intention of the legislature was to also exempt T2S on 
the basis of the second arm of Article 2(2)(d) of the Law on cybersecurity, then the wording in Article 2(2)(d) should 
read ‘securities clearing and settlement infrastructures’ instead of ‘securities clearing systems’. 
Guideline  ECB/2012/13  of  the  European  Central  Bank  of  18  July  2012  on  TARGET2-Securities  (OJ  L  215, 
11.8.2012, p. 19). 

5 

                                                 
ECB-PUBLIC 

Article 7 of the T2S Framework Agreement28, T2S is operated by the Eurosystem. Furthermore, in 

line  with  the  Governing  Council’s  decision  in  its  Eurosystem  oversight  policy  framework  (revised 
version  of  July  2016)29,  T2S  falls  under  the  Eurosystem’s  oversight  competences  under  Articles 
127(2) of the Treaty and Articles 3.1 and 22 of the Statute of the ESCB30 .  

3.3.2  Similarly, the ECB understands that, in line with the Governing Council’s decision in its Eurosystem 

oversight policy framework referred to above, critical  service providers that fall under Eurosystem 

oversight competences under Articles 127(2) of the Treaty and Articles 3.1 and 22 of the Statute of 

the ESCB would not be included in the scope of the Law on critical infrastructure and the Law on 

cybersecurity as amended by the draft law. 

3.4 

Impact of draft law on central securities depositories 

3.4.1  NBS has been designated as a competent authority for authorisation and supervision of the central 
securities  depositories 31  (CSDs)  as  well  as  the  authority  responsible  for  the  oversight  of  the 
securities  settlement  systems  (SSSs)  operated  by  the  CSDs 32.  Accordingly,  NBS  supervises  the 

two  CSDs  in  Slovakia  –  the  Centrálny  depozitár  cenných  papierov,  a.s.  (CDCP)  and  Národný 

centrálny depozitár cenných papierov, a.s. (NCDCP) – and oversees the SSSs operated by them.  

3.4.2  Taking  into  account  the  cross-references  in  the  draft  law33  it  is  not  fully  clear  whether  the 

exclusions introduced by it would only apply to SSSs operated by either the CDCP or the NCDCP 

and overseen by NBS, or would also apply to the CDCP and the NCDCP themselves, on the basis 

that they are both supervised by NBS under Regulation (EU) No 909/2014. Consequently, it is not 

clear to what extent the Law on critical infrastructure and the Law on cybersecurity would apply to 

these two CSDs. In the interest of legal certainty, it may be useful to explicitly clarify in the draft law 

the extent to which these CSDs supervised by NBS fall within the scope of the draft law. 

3.5 

Impact of draft law and cybersecurity law on credit institutions supervised by ECB and NBS 

3.5.1  Council  Regulation  (EU)  No  1024/201334  confers  tasks  on  the  ECB  concerning  the  prudential 

supervision  of  credit  institutions  with  a  view  to  contributing  to  their  safety  and  soundness  and  in 

order to protect the stability of the financial system of the Union and each Member State. The ECB 

is responsible for the effective and consistent functioning of the SSM and exercises oversight over 

the SSM’s functioning, based on the distribution of responsibilities between the ECB and national 

competent authorities (NCAs), including NBS. In particular, the ECB carries out its task to authorise 

and to withdraw the authorisations of all credit institutions. For significant credit institutions the ECB 

also  has  the  task,  among  others,  to  ensure  compliance  with  the  relevant  Union  law  that  imposes 

28  
29  
30  

31  

32  
33  
34  

Published on the ECB’s website at www.ecb.europa.eu. 
Available on the ECB’s website at www.ecb.europa.eu. 

See  Section  4.4  of 
www.ecb.europa.eu. 

the  Eurosystem  oversight  policy 

framework,  available  on 

the  ECB’s  website  at 

See Article 11 of Regulation (EU) No 909/2014 of the European Parliament and of the Council of 23 July 2014  on 
improving  securities  settlement  in  the  European  Union  and  on  central  securities  depositories  and  amending 
Directives  98/26/EC  and  2014/65/EU  and  Regulation  (EU)  No  236/2012  (OJ  L  257,  28.8.2014,  p.1)  and  see  also 
Article 99 et seq. of Law No 566/2001 on securities and investment services. 
See Article 12 of Regulation (EU) No 909/2014. 

See paragraph 1.3 above. 

Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank 
concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63). 

6 

                                                 
ECB-PUBLIC 

prudential  requirements  on  credit  institutions,  including  the  requirement  to  have  in  place  robust 

governance  arrangements,  including  sound  risk  management  processes  and  internal  control 
mechanisms35. To this end, the ECB is given all supervisory powers to intervene in the activity of 
credit institutions that are necessary for the exercise of its functions36.  

3.5.2  The prudential supervision of credit institutions also covers topics related to cybersecurity and the 

protection of infrastructures relevant for the operation of credit institutions as part of the prudential 

supervision of operational risk, meaning the risk of loss resulting from inadequate or failed internal 
processes, people and systems or from external events37. In this respect, the ECB has the power, 

among others, to restrict or limit the business, operations or network of an institution or to request 
the divestment of activities that pose excessive risks to the soundness of an institution 38. Since the 

assessment of the adequacy of the internal governance arrangements of credit institutions is one of 

the  core  competences  of  prudential  supervisors,  the  requirements  under  the  draft  law  should  not 
interfere with the tasks they carry out 39,.  

3.5.3  Under  the  current  Law  on  cybersecurity,  Národný  bezpečnostný  úrad  (the  National  Security 

Authority)  has  a  wide  range  of  powers  to  address  a  serious  cybersecurity  incident  or  a  threat 

thereof, including issuing  an alert or  warning of cybersecurity  incidents, imposing  an  obligation to 

deal with a cybersecurity incident, imposing an obligation to take reactive measures, and requiring 

draft  measures  and  their  execution  to  prevent  further  continuation,  spread  and  recurrences  of  a 
serious cybersecurity incident40. 

3.5.4  Under the Law on critical infrastructure, as amended by the draft law, the Ministry of Finance has 

powers to impose administrative sanctions of up to EUR 200,000 where the operator of an element 

of  a  critical  infrastructure  does  not  comply  with  its  obligations  under  the  Law  on  critical 

infrastructures. 

3.5.5  In  the  light  of  the  above,  the  ECB  suggests  clarifying  that  the  scope  of  the  Law  on  critical 

infrastructure and of the Law on cybersecurity and any powers granted to the competent authorities 

thereunder  are  without  prejudice  to  the  tasks  and  powers  of  the  ECB  and  NBS  under  Council 
Regulation (EU) No 1024/2013 and applicable Slovak law41.  

3.5.6  Finally,  the  ECB  welcomes  the  requirement  that  the  authority  fulfilling  the  tasks  of  the  computer 

security  incident  response  team  (CSIRT)  unit  under  the  Law  on  cybersecurity  and  the  Ministry  of 

Finance under the Law on critical infrastructure must consult NBS in a case where the operator of 

the essential service is a credit institution supervised by the NBS. The ECB suggests that it should 

also be clarified that, in the same way, the ECB is consulted where the competent authorities under 

35  
36  

37  
38   
39   

40   
41  

See Articles 4(1)(e) and 6(4) of Regulation (EU) No 1024/2013. 

See Article 64(1) of Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access 
to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending 
Directive  2002/87/EC  and  repealing  Directives  2006/48/EC  and  2006/49/EC  (OJ  L  176,  27.6.2013);  see  also 
paragraph 4.1 of Opinion CON/2018/22. 

See Article 4(1)(52) of Regulation (EU) No 575/2013.  

See Article 16(2)(e) of Regulation (EU) No 1024/2013. 

See paragraph 3.5 of Opinion CON/2014/58, paragraph 2.12 of Opinion CON/2014/9 and paragraph 4.3 of Opinion 
CON/2018/22. 
See Article 27 of the Law on cybersecurity. 
See also paragraph 4.6 of Opinion CON/2018/22. 

7 

                                                 
ECB-PUBLIC 

the  Law  on  cybersecurity  or  the  Law  on  critical  infrastructure  take  measures  affecting  significant 

credit institutions directly supervised by the ECB.  

4. 

Law on banks 

4.1  Amendments to covered bond framework 

4.1.1  On  12  March  2018  the  European  Commission  published  a  legislative  proposal  for  a  Union 
framework on covered bonds42. The Slovak authorities are invited to take the proposal into account 

in the Slovak legislative process, as appropriate. 

4.1.2  The ECB supports the  provisions on  the composition of the cover pool, under  which base assets 

must  form  a minimum  share  and  supplementary  assets may  only  represent  a  maximum share  of 

the  cover  pool.  Those  limitations  are  important  for  the  regulation  of  the  composition  of  the  cover 

pool in order to ensure its homogeneity and to facilitate investors’ ability to conduct due diligence.  

4.1.3  The ECB recommends that prior to the adoption of the draft law the Slovak authorities analyse the 

possible impact of the exclusion of the liquidity buffer from the calculation of the minimum limits on 

base assets and maximum limits on supplementary assets. The ECB emphasises the importance 

of homogeneity in the cover pool, in particular to ensure sufficient representation of base assets.  

This opinion will be published on the ECB’s website.  

Done at Frankfurt am Main, 31 August 2018. 

[signed] 

The President of the ECB 

Mario DRAGHI 

42  

Proposal for a Directive of the European Parliament and of the Council on the issue of covered bonds and covered 
bond  public  supervision  and  amending  Directive  2009/65/EC  and  Directive  2014/59/EU,  available  at 
https://ec.europa.eu/info/law/better-regulation/initiatives/com-2018-94_en. 

8