Opinion of the European Central Bank of 21 September 2021 on a draft regulation concerning the oversight of payment systems and supporting technological or network infrastructures (CON/2021/28)
Date: 2021-09-21
Institutions: European Central Bank
Subjects: legal basis, payment system

EN 

ECB-PUBLIC 

OPINION OF THE EUROPEAN CENTRAL BANK 

of 21 September 2021  

on a draft regulation concerning the oversight of payment systems and supporting technological 

or network infrastructures  

(CON/2021/28) 

Introduction and legal basis 

On 23 July 2021, the European Central Bank (ECB) received a request from the Banca d’Italia for an opinion 

on a draft regulation concerning the oversight of payment systems and supporting technological or network 

infrastructures (hereinafter the ‘draft regulation’).  

The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the 

Functioning of the European Union and the second, third, fifth and sixth indents of Article 2(1) of Council 

Decision 98/415/EC1, as the draft regulation relates to means of payment, the Banca d’Italia, payment and 

settlement  systems,  and  rules  applicable  to  financial  institutions  that  materially  influence  the  stability  of 

financial  institutions  and  markets.  In  accordance  with  the  first  sentence  of  Article  17.5  of  the  Rules  of 

Procedure of the European Central Bank, the Governing Council has adopted this opinion. 

1. 

Purpose of the draft regulation 

1.1 

The  main  purpose  of  the  draft  regulation  is  to  update  the  secondary  legislation  concerning  the 

oversight of retail payment services and systems2, which was adopted in 20123.  

1.2 

The  draft  regulation  governs  payment  systems  in  a  broad  sense,  including  relevant  third-party 

payment  service  providers.  In  particular,  the  draft  regulation  extends  the  scope  of  the  existing 

legislation to encompass both Italian retail and large-value payment systems, as well as technical 

infrastructures or service providers supporting the payment ecosystem, whose registered address 

and/or centre of operations is located in Italy4.  

1.3 

Under the draft regulation, payment system operators are required to notify the Banca d’Italia of, 

inter  alia,  the  taking-up  and  termination  of  their  operation,  the  system  operation  rules,  incident 

reports, their cyber resilience strategy alongside the relevant implementing procedures, and their 

operational risk management documentation5. 

1  

2  

3  
4  
5   

Council  Decision  98/415/EC  of  29 June  1998  on  the  consultation  of  the  European  Central  Bank  by  national 
authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42). 

Banca  d’Italia,  Provvedimento  del  18  Settembre  2012,  Disposizioni  in  materia  di  sorveglianza  sui  sistemi  di 
pagamento al dettaglio, available on the Banca d’Italia’s website at www.bancaditalia.it.  
See Opinion CON/2012/38. All ECB opinions are available on EUR-Lex. 

See Article 2 of the draft regulation. 

See Articles 3 and 13 of the draft regulation. 

 
 
 
 
 
ECB-PUBLIC 

1.4 

With  reference  to  large-value  payment  systems,  the  draft  regulation  sets  out  specific  additional 

requirements concerning collateral eligibility, means of settlement, management of principal risk, 

tiered  participation,  and  the  use  of  relevant  internationally  accepted  communication  procedures 

and standards in order to facilitate efficient payment, clearing, settlement and recording6.  

1.5 

The draft regulation also contains specific provisions on the retail payment systems operated by 

the  Banca  d’Italia.  In  this  context,  most  of  the  requirements  provided  for  retail  payment  system 

operators also apply to the Banca d’Italia. In particular, the Banca d’Italia is expected to comply 

with the principle of full cost recovery when operating retail payment systems7. 

1.6 

Furthermore, technical infrastructures and service providers are required to notify the Banca d’Italia 

of the taking-up and termination of their operation in support of the payment ecosystem as well as 

of any significant change to the services they provide to one or more payment service providers 

and/or  payment  system  operators8.  Where  technical  infrastructures  and  service  providers  are 

classified as critical by the Banca d’Italia, they are required to comply with requirements concerning 

governance, internal controls, business risk, legal risk and operational risk9.  

1.7 

Finally,  the  draft  regulation  is  to  be  complemented  by  a  guide  on  controls  and  by  an  annex 

containing  business  continuity  measures.  Both  documents  are  to  be  published  on  the  Banca 

d’Italia’s website. 

2. 

General observations  

2.1 

The ECB welcomes the draft regulation, which aims to (1) achieve alignment with the Committee 

on Payments and Market Infrastructures (CPMI) and the International Organization of Securities 

Commissions  (IOSCO)10  Principles  for  financial  market  infrastructures  (hereinafter  the  ‘CPMI-

IOSCO principles’), (2) strengthen operational and cyber resilience in the payment sector, and (3) 

support  the  role  of  the  Banca  d’Italia  as  overseer  of  payment  systems  and  of  their  supporting 

technological or network infrastructures. The ECB also welcomes the fact that the draft regulation 

provides for the application of the principle of full cost recovery by the Banca d’Italia when operating 

retail payment systems. 

2.2 

The ECB welcomes the application of the draft regulation to payment systems other than those 

classified as systemically important payment systems (SIPS) under Regulation (EU) No 795/2014 

of the European Central Bank (ECB/2014/28) (hereinafter the ‘SIPS Regulation’)11.  

2.3 

In addition, the ECB welcomes the adherence of the draft regulation to the Eurosystem oversight 

policy framework12 and the Eurosystem’s policy regarding the identification and oversight of critical 

service providers of financial market infrastructures. 

6  
7   
8  
9   
10  
11  

12  

See Article 16 of the draft regulation. 

See Articles 17 and 18 of the draft regulation. 
See Article 19 of the draft regulation. 

See Article 21 of the draft regulation. 

Available on the Bank for International Settlements’ website at www.bis.org. 

Regulation  (EU)  No  795/2014  of  the  European  Central  Bank  of  3  July  2014  on  oversight  requirements  for 
systemically important payment systems (ECB/2014/28) (OJ L 217, 23.7.2014, p. 16). 

Eurosystem  oversight  policy  framework,  Revised  version  (July  2016)  available  on  the  ECB’s  website  at 
www.ecb.europa.eu. 

2 

 
 
ECB-PUBLIC 

2.4 

Furthermore,  the  ECB  welcomes  the  alignment  of  the  draft  regulation  with  the  CPMI-IOSCO’s 
Guidance  on  cyber  resilience  for  financial  market  infrastructures13,  which  the  ECB  has 

operationalised  in  its  cyber  resilience  oversight  expectations  for  financial  market  infrastructures 

(CROE)14. The ECB suggests that any guidance to be developed under the draft regulation should 

be aligned with the CROE. 

2.5 

Finally, the ECB notes that the recitals to the draft regulation contain, inter alia, a list of frameworks 

which have been considered by the Banca d’Italia. For the sake of clarity, the ECB would suggest 

referring to Regulation (EU) 2021/728 of the European Central Bank (ECB/2021/17)15, which is the 

most recent amending legal act to the SIPS Regulation, instead of Regulation (EU) No 2017/2094 

of  the  European  Central  Bank  (ECB/2017/32)16.  Alternatively,  the  Banca  d’Italia  may  consider 

including a dynamic reference to the SIPS Regulation.  

This opinion will be published on EUR-Lex.  

Done at Frankfurt am Main, 21 September 2021. 

[signed] 

The President of the ECB 

Christine LAGARDE 

13  
14  

15  

16  

Available on the Bank for International Settlements’ website at www.bis.org. 

Cyber resilience oversight expectations for financial market infrastructures (December 2018) available on the ECB’s 
website at www.ecb.europa.eu.  
Regulation (EU) 2021/728 of the European Central Bank of 29 April 2021 amending Regulation (EU) No 795/2014 on 
oversight requirements for systemically important payment systems (ECB/2021/17) (OJ L 157, 5.5.2021, p. 1). 

Regulation  (EU)  2017/2094  of  the  European  Central  Bank  of  3  November  2017  amending  Regulation  (EU) 
No 795/2014  on  oversight  requirements  for  systemically  important  payment  systems  (ECB/2017/32)  (OJ  L  299, 
16.11.2017, p. 11). 

3