Opinion of the European Central Bank of 26 October 2018 on the review of Finnish law concerning preparedness obligations applicable in the financial sector (CON/2018/46)
Date: 2018-10-26
Institutions: European Central Bank
Subjects: Finland, banking supervision, credit institution, financial instrument, financial services, financial stability, intra-EU payment, investment company, payment system

EN 

ECB-PUBLIC 

OPINION OF THE EUROPEAN CENTRAL BANK 

of 26 October 2018 

on the review of Finnish law concerning preparedness obligations applicable 

 in the financial sector  

(CON/2018/46) 

Introduction and legal basis 

On  16  August  2018,  the  European  Central  Bank  (ECB)  received  a  request  from  the  Finnish  Ministry  of 

Finance for an opinion on a proposal to further specify so-called preparedness obligations in the field of 

financial market services to ensure the uninterrupted availability of functions vital to society, including (1) 
amendments to the Law on credit institutions1, the Law on payment institutions2, the Law on investment 
funds3,  the  Law  on  investment  services4,  the  Law  on  the  book-entry  system,  clearing  and  settlement 
operations5, and the Law on trading in financial instruments6; (2) a draft law on a Joint Working Group for 

incident management in the financial market; and (3) a draft government decree to specify the functions 

and  services  the  performance  of  which  the  addressees  of  the  preparedness  obligations  shall  ensure 

(hereinafter collectively referred to as the ‘proposal’). 

The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the 

Functioning  of  the  European  Union  and  the  second,  fifth  and  sixth  indents  of  Article 2(1)  of  Council 
Decision  98/415/EC7,  as  the  proposal  relates  to  means  of  payment,  payment  and  settlement  systems, 

rules  applicable  to  financial  institutions  insofar  as  they  materially  influence  the  stability  of  financial 

institutions  and  markets and  the ECB’s tasks concerning the prudential supervision of credit  institutions 

pursuant to Article 127(6) of the Treaty. In accordance with the first sentence of Article 17.5 of the Rules 

of Procedure of the European Central Bank, the Governing Council has adopted this opinion. 

1. 

Purpose of the proposal 

1.1  The  proposal  elaborates  on  the  existing  preparedness  obligations  imposed  on  credit  institutions, 

payment  institutions,  investment  funds,  investment  service  providers,  the  central  securities 

depository,  and  the  stock  exchange  (collectively  referred  to  as  ‘addressees’)  under  Finnish  law. 

Credit  and  payment  institutions,  investment  funds  and  investment  service  providers  are  already 

1  
2  
3  
4  
5  
6  
7  

Laki luottolaitostoiminnasta (8.8.2014/610). 
Maksulaitoslaki (30.4.2010/297). 

Sijoitusrahastolaki (29.1.1999/48). 
Sijoituspalvelulaki (14.12.2012/747). 

Laki arvo-osuusjärjestelmästä ja selvitystoiminnasta (16.6.2017/348). 
Laki kaupankäynnistä rahoitusvälineillä (28.12.2017/1070). 
Council  Decision  98/415/EC  of  29 June  1998  on  the  consultation  of  the  European  Central  Bank  by  national 
authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42). 

 
 
 
 
                                                 
ECB-PUBLIC 

obliged  to  ensure  that  they  can  perform  tasks  and  provide  services  free  of  interruption,  as  far  as 

possible,  also  in  emergency  situations,  by  participating  in  preparedness  planning  regarding 

financial  markets  and  by  planning  contingency  measures.  The  proposal  requires  these  entities to 

ensure the performance of their tasks and the provision of their services, in particular by means of 

maintaining  sufficient  data  systems  and  data  repositories  in  Finland,  and  by  other  arrangements 

deemed  sufficient  for  ensuring  their  uninterrupted  operation  in  Finland.  Regarding  investment 

service providers, for which the preparedness obligation currently concerns only keeping custody of 

securities,  the  obligation  would  be  extended  to  ensuring  that  the  issue,  trading,  clearing  and 

settlement of securities are  also safeguarded. The stock exchange, which is currently required to 

ensure  its  functioning  despite  interferences  and  during  peak  times  as  well,  is  tasked  with  similar 

preparedness  obligations  as  the  other  addressees.  Regarding  the  central  securities  depository, 

only  editorial  amendments  to  the  law  are  proposed  (to  align  the  current  wording  with  the  new 

wording of the  preparedness obligations  imposed  on the  other  addressees) as, in substance,  the 

existing preparedness obligations correspond to those in the proposal.  

1.2  Regarding  credit  institutions,  payment  institutions  and  investment  service  providers,  the  proposal 

recommends  a  government  decree  to  specify  the  functions  and  services  of  these  entities  the 

performance  of  which  is  to  be  ensured  also  in  emergency  situations.  In  respect  of  credit  and 

payment institutions, these include: (1) services for making cash deposits into a payment account 

or  cash  withdrawals  from  a  payment  account  as  well  as  operations  related  to  the  provision  and 

maintenance  of  a  payment  account;  (2)  the  execution  of  a  payment  transaction,  as  an  account 

transfer,  involving  the  transfer  of  funds  to  the  payment  account  of  a  payment  service  provider 

(PSP) as a direct debit, with a payment card or with another payment instrument; (3) the issuance 

of a payment instrument into circulation; (4) the approval and processing of a payment transaction 

based  on  a  contract  made  with  a  payee,  leading  to  funds  being  transferred  to  the  payee;  and 

(5) functions whereby an account transfer is made into a Finnish account located at another credit 

or payment institution and functions whereby an account transfer coming from such an account can 

be received. In respect of investment funds, these include the activities listed in Articles 53 and 54 

of the Law on investment funds to ensure the maintenance of a fund unit register that would record 

basic  information  on  the  fund  unit-holder,  such  as  the  number  of  units  held,  a  breakdown  of  the 

different types of shares and series of shares and the date of registration of the fund unit, as well 

as  to  ensure  that  in  the  case  of  a  new  issuance  the  issue  price  will  be  paid  within  regular 

timeframes. The provision of a share  certificate  upon request of a fund unit-holder  would  also be 

available.  In  respect  of  investment  service  providers,  these  include:  (1)  the  receipt  and 

transmission of orders in relation to financial instruments; (2) the execution of orders in relation to 

financial instruments on behalf of clients; (3) the management of financial instruments on the basis 

of an agreement with the client whereby the decisive authority regarding investment is given wholly 

or partly to the investment service provider; (4) the organisation of the issue of financial instruments 

into  circulation,  or  the  sale  thereof,  by  providing  an  associated  subscription  or  purchasing 

commitment;  (5)  the  organisation  of  the  issue  of  financial  instruments  without  subscription  or 

purchasing commitment; (6) services linked to the guarantee of the issue of financial instruments; 

and (7) the storage and maintenance of financial instruments on behalf of the client.  

1.3  The  proposal  also  calls  for  a  decree  of  the  Ministry  of  Finance  to  be  prepared  to  regulate  the 

principles and arrangements involved in preparedness planning in the financial market. It is further 

2 

ECB-PUBLIC 

proposed  that  the  Finnish  Supervisory  Authority  (FSA)  issues  ordinances  on  the  preparedness 

obligations,  covering  in  particular:  (1)  the  technical  details  of  preparedness  planning;  (2)  the 

documents  related  to  preparedness  planning;  (3)  the  technical  requirements  for  and  general 

information  on  the  use  of  the  relevant  systems  and  infrastructures;  and  (4)  technical  matters  in 

respect  of  the  abovementioned  points.  The  proposal  also  contains  sanctions  for  non-compliance 

with the preparedness obligations. 

1.4  The proposal further provides for a draft law on a Joint Working Group, which would be established 

through a decision of the Ministry of Finance, to plan and coordinate preparedness measures in the 

financial  market.  The  duties  of  this  Joint  Working  Group  would  include:  (1)  planning  and 

coordinating  measures  necessary  for  the  management  of  both  emergency  circumstances  and 

serious  disruptive  situations  occurring  under  normal  conditions;  (2)  acquiring  and  delivering 

information  necessary  for  the  management  of  disruptive  situations,  and  serving  as  support  for 

decision-making by public authorities; and (3) supporting the operators who are able to mitigate the 

negative effects of the disruptive situations on society, e.g. by conveying and analysing information 

on disruptive situations. The draft law on the Joint Working Group also contains related provisions 

on the processing of confidential information.  

2. 

General observations 

The  ECB  understands  that  the  basic  purpose  of  the  draft  law  is  to  impose  an  obligation  on  the 

addressees  to:  (1)  plan  and  prepare  in  advance  measures  that  would  be  used  in  emergency  situations 

and  during  serious  disruptive  situations  occurring  under  normal  conditions;  and  (2)  to  establish  and 

maintain  systems  and  infrastructures  that  are  located  in  Finland,  in  order  to  ensure  their  uninterrupted 

functioning  also  in  emergency  situations,  in  addition  to  the  existing  European  and  international 

infrastructures. Against this backdrop, the ECB wishes to make a number of general observations on the 

proposal. 

2.1  Consultation of European Commission on the proposal  

The  ECB  notes  that  it  has  previously  issued  opinions  to  the  Finnish  authorities  on  emergency 
powers  legislation  that  applies  in  respect  of  the  Finnish  financial  markets8.  Since  the  proposal 

affects  Union  law  falling  outside  the  competence  of  the  ECB,  in  the  areas  of  international  and 

national security, and may affect the internal market for financial services, the Ministry of Finance 
may wish to consult the European Commission on the proposal if it has not already done so9. For 

its  part,  the  ECB  would  highlight  that,  in  accordance  with  Article  4(3)  of  the  Treaty  on  European 

Union, pursuant to the principle of sincere cooperation Member States are obliged to facilitate the 

achievement of the ECB’s tasks and refrain from taking any measures which could jeopardise the 

ECB’s  or  the  ESCB’s  objectives.  This  principle,  similar  to  the  views  expressed  in  the  ECB’s  past 
opinions10, should be noted in respect of the areas covered by this opinion. 

2.2  Necessity and proportionality of the proposal  

8  

9  
10  

See  Opinions  CON/2002/27  and  CON/2006/6.  All  ECB  opinions  are  published  on  the  ECB’s  website  at 
www.ecb.europa.eu. 
See paragraph 22 of Opinion CON/2006/6; see also paragraph 2.1 of Opinion CON/2018/8.  
See footnotes 8 and 12. 

3 

 
                                                 
ECB-PUBLIC 

The ECB understands that most of the relevant infrastructures that are being used in Finland in the 

financial  market  sector  are  either  European  or  global  in  nature.  These  infrastructures  provide  for 

contingency  measures  and  fall  back  solutions  that  are  not  physically  located  in  Finland.  As 
contingency  measures  have  already  been  put  in  place11,  the  ECB  would  recommend  that  the 

Finnish authorities further consider the necessity and proportionality of the proposal in view of the 

high  costs  that,  the  ECB  understands,  will  be  caused  by  the  establishment  and  maintenance  of 

additional national infrastructures. 

2.3 

Impact of the proposal on TARGET2, Target2-Securities and ESCB infrastructures  

2.3.1  The  ECB  understands  that  the  proposal  was  prepared  in  view  of  the  situation  that  the  Finnish 

financial sector is cut off entirely from European and other financial market infrastructures (FMIs), 

including TARGET2 and Target2-Securities (T2S), due to an incident during normal circumstances 

or  during  an  emergency  situation.  In  such  a  scenario,  the  ability  of  Suomen  Pankki  to  engage  in 

single monetary policy operations and to provide regular liquidity to Finnish counterparties, through 
participation of the counterparties in monetary policy operations, would also be disrupted12. In the 

event that the Finnish financial sector and Suomen Pankki were cut off from TARGET2 and T2S, 

those systems, including accounts and assets held in them by Finnish participants, would continue 

to operate normally, and branches or subsidiaries of those participants from outside Finland having 

the relevant permissions may continue to make transactions. In the event that a back-up solution 

becomes available in Finland and starts using TARGET2 and/or T2S balances from the last known 

account position, it would be possible for debits to be made on the same account in both TARGET2 

and/or TS2 as well as in the Finnish back-up system, which could eventually lead to the participant, 

in  effect,  being  granted  uncollateralised  credit  (for  TARGET2)  or  selling  securities  twice  (in  T2S). 

When planning preparedness measures, it is important to avoid such scenarios and to ensure legal 

certainty of bookings. 

2.3.2  As member of the Eurosystem, Suomen Pankki has a Treaty based obligation to participate in the 

implementation  of  the  single  monetary  policy  that  is  conducted  via  the  TARGET2  infrastructure, 

which also transmits large-value payments in general. As appropriate, the measures proposed by 

the  proposal  do  not  address  TARGET2,  T2S  or  other  infrastructures  of  the  European  System  of 

Central  Banks  (ESCB).  In  this  respect,  the  ECB  would  like  to  stress  that  any  preparedness 

measures should not be arranged in such a manner that they would have an adverse effect on the 

performance of ESCB tasks, or prejudice Eurosystem competencies. For the avoidance of doubt, it 

should  also  be  made  clear  that  the  proposal  is  not  intended  to  apply  even  indirectly  to  ESCB 

infrastructures such as TARGET2 or T2S or prejudice the offering of their services. 

2.4  Oversight of systemically important payment systems 

11  

12  

See Disclosure Report TARGET2 assessment against the principles for financial market infrastructures (June 2016) 
at https://www.ecb.europa.eu  and EURO1 PFMI Disclosure Report by EBA CLEARING S.A.S. (20 August 2015) at 
https://www.ebaclearing.eu. 

To the extent that the situation would fall within the definition of an emergency situation, as defined in the Law on 
emergency  powers,  this  would  entail  the  enactment  of  a  government  decree  on  emergency  powers  in  the  field  of 
financial markets (as provided for in the Law on emergency powers, currently in force). In view of preparedness for 
acting  in  emergency  situations,  the  views  expressed  in  the  past  ECB  opinions  regarding  emergency  powers 
legislation  that  applies  in  respect  of  the  Finnish  financial  markets,  in  particular  regarding  the  definition  of  an 
emergency  situation,  remain  valid.  See  paragraph  7  of  ECB  Opinion  CON/2002/27  and  paragraph  9  and  14  of 
CON/2006/6.  

4 

                                                 
ECB-PUBLIC 

By  way  of  background  information  in  connection  with  the  implementation  of  the  proposal,  the 

Finnish  authorities may  wish to  take note that Regulation of the  European Central  Bank (EU)  No 

795/2014  of  3  July  2014  on  oversight  requirements  for  systemically  important  payment  systems 
(ECB/2014/28)13  (hereinafter  the  ‘SIPS  Regulation’),  which  covers  both  large-value  and  retail 

payment  systems  of  systemic  importance,  operated  either  by  a  Eurosystem  central  bank  or  a 

private entity, and the non-legally binding oversight frameworks for retail payment systems and for 

payment  instruments  have  recently  introduced  a  number  of  requirements  addressing  new  risks, 

including  those  related  to  operational  and  security  risks  such  as  cyber  resilience,  for  which  the 
CPMI-IOSCO  guidance  on  cyber  resilience  for  financial  market  infrastructures14  has  been  taken 
into account15.  

2.5  Eurosystem cyber resilience strategy for FMIs 

The Finnish authorities may also wish to take note of the Eurosystem cyber resilience strategy for 

FMIs,  which  is  intended  to  support  the  implementation  of  the  CPMI-IOSCO  guidance  from  an 

oversight  perspective.  The  strategy  aims  to  develop  a  range  of  tools  which  can  be  used  by 

regulators  and  markets  to:  (1)  facilitate  effective  cyber  resilience,  by  enhancing  the  ‘cyber 

readiness’ of individual FMIs that are overseen by the Eurosystem central banks, and ensure that 

measures are in place to support this; and (2) foster collaboration among FMIs, their critical service 

providers  and  the  relevant  authorities.  In  addition,  the  Eurosystem  is  developing  a  range  of  tools 

that can be used by FMIs to enhance their cyber resilience such as a European red team testing 

framework,  cyber  surveys  and  focused  assessments,  to  assess  the  level  of  cyber  maturity  of 

Eurosystem  payment  systems  and  to  develop  cyber  resilience  oversight  expectations  to  provide 

more  detailed  guidance  to  payment  system  operators.  It  is  essential  that  Finnish  FMIs’  level  of 

soundness  is  guaranteed  and  that  the  proposed  amendments  follow  the  Eurosystem’s  cyber 

resilience strategy. 

2.6  Prudential supervision of credit institutions 

The proposal assigns the FSA the power to issue legally binding  instructions to credit institutions 

concerning the use and functioning of the fall back systems that market participants are obliged to 

establish to ensure full functioning of the infrastructures in all situations. The ECB understands that 

these powers relate to the existing tasks of the FSA concerning supervision of operational risks and 

cyber security. Credit institutions should establish a sound business continuity management plan to 

ensure their ability to operate on an ongoing basis and limit losses in the event of severe business 
disruption16. According to the explanatory memorandum accompanying the proposal, the new FSA 

powers  would  be  limited  to  cover  preparedness  planning  and  technical  requirements  of  data 

systems and data repositories in Finland, and other arrangements deemed sufficient for ensuring 

their uninterrupted operation in Finland, for instance, the interconnectedness of fall back systems. 

For significant credit institutions, these powers fall under the exclusive supervisory task of the ECB 

13  

14  

15  
16  

Regulation  of  the  European  Central  Bank  (EU)  No  795/2014  of  3  July  2014  on  oversight  requirements  for 
systemically important payment systems (ECB/2014/28) (OJ L 217, 23.7.2014, p. 16).  
The said guidance was published by the Committee on Payments and Market Infrastructures and the Board of the 
International Organizsation of Securities Commissions (CPMI-IOSCO) in June 2016, available at https://www.bis.org. 
See Article 15 of the SIPS Regulation. 
European Banking Authority Guidelines of 26 September 2017 on internal governance under Directive 2013/36/EU 
(EBA/GL/2017/11), p. 53-54. 

5 

                                                 
ECB-PUBLIC 

regarding  robust  governance  arrangements,  and  arrangements  and  mechanisms  for  the  sound 
management  of  their  risks17.  Moreover,  under  Union  law  there  is  an  obligation  to  exchange 

information between the ECB and the national competent authorities, and the national competent 

authorities, under the conditions laid  down by law, are required to inform the ECB about material 

supervisory procedures concerning less significant institutions and to transmit to the ECB material 

draft  supervisory  decisions  related  to  these  institutions  in  order  to  enable  the  ECB  to  exercise 
oversight  over  the  functioning  of  the  Single  Supervisory  Mechanism18.  Hence,  the  ECB 

recommends  that  the  proposal  require  the  FSA  to  share  information,  in  a  timely  and  efficient 

manner, about any exceptional situation affecting the performance of the tasks and the exercise of 

the  powers  conferred  on  the  ECB  for  prudential  supervisory  purposes,  as  well  as  the  measures 

planned or adopted by the FSA.   

2.7  SEPA Regulation 

The  preparedness  obligations  for  Finnish  PSPs  outlined  in  the  proposal  are  expected  to  be 

compliant with the requirements for the SEPA schemes under Regulation (EU) No 260/2012 of the 

European  Parliament  and  of  the  Council  of  14  March  2012  establishing  technical  and  business 

requirements  for  credit  transfers  and  direct  debits  in  euro,  in  particular  the  requirements  for 
‘reachability’ and ‘interoperability’ for PSPs when executing transactions19. 

This opinion will be published on the ECB’s website.  

Done at Frankfurt am Main, 26 October 2018 

[signed] 

The President of the ECB 

Mario DRAGHI 

17  

18  

19  

Articles 4(1)(e) and 6(4) of Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on 
the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 
29.10.2013, p. 63). 
See  Articles  6(2)  and  6(7)(c)(i)  and  (iii)  of  Council  Regulation  (EU)  No  1024/2013  of  15  October  2013  conferring 
specific  tasks  on  the  European  Central  Bank  concerning  policies  relating  to  the  prudential  supervision  of  credit 
institutions (OJ L 287, 29.10.2013, p. 63); Articles 21(1), 97 and 98 of Regulation (EU) No 468/2014 of the European 
Central Bank of 16 April 2014 establishing the framework for cooperation within the Single Supervisory Mechanism 
between  the  European  Central  Bank  and  national  competent  authorities  and  with  national  designated  authorities 
(SSM Framework Regulation) (ECB/2014/17) (OJ L 141, 14.5.2014, p. 1).  
Regulation  (EU)  No  260/2012  of  the  European  Parliament  and  of  the  Council  of  14  March  2012  establishing 
technical  and  business  requirements  for  credit  transfers  and  direct  debits  in  euro  and  amending  Regulation  (EC) 
No 924/2009 (OJ L 94, 30.3.2012, p. 22). 

6