Opinion of the European Central Bank of 30 December 2024 on oversight of payment systems (CON/2024/42)
Date: 2024-12-30
Institutions: European Central Bank
Subjects: legal basis, statistics

ECB-PUBLIC 

EN 

OPINION OF THE EUROPEAN CENTRAL BANK 

of 30 December 2024 

on oversight of payment systems 

(CON/2024/42) 

Introduction and legal basis 

On 27 September 2024, the European Central Bank (ECB) received a request from the Banco de Portugal 

(BdP) for an opinion on a draft notice and a draft instruction on oversight of payment systems (hereinafter 

together referred to as the ‘draft regulations’). 

The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the 

Functioning of the European Union and Article 2(1), third and fifth indents, of Council Decision 98/415/EC1, 

as  the  draft  regulations  relate  to  the  BdP  and  to  payment  and  settlement  systems.  In  accordance  with 

Article 17.5, first sentence, of the Rules of Procedure of the European Central Bank, the Governing Council 

has adopted this opinion. 

1. 

Purpose of the draft regulations 

1.1  According  to  the  Organic  Law  of  the  Banco  de  Portugal2  and  the  Legal  Framework  of  Credit 

Institutions  and  Financial  Companies 3,  one  of  the  tasks  of  the  BdP  is  to  regulate,  oversee  and 

promote  the  smooth  operation  of  payment  systems,  within  the  scope  of  its  participation  in  the 

European  System  of  Central  Banks  (ESCB).  The  Legal  Framework  of  Credit  Institutions  and 

Financial  Companies  further  provides  that  entities  carrying  out  any  activity  within  the  scope  of 

payment systems must inform the BdP that they are carrying out such activity and provide to the BdP 

all the information that it may request4. 

1.2  The draft regulations are the first regulations issued by the BdP based on the above legal provisions. 

They aim at providing a more robust legal framework for the function of overseeing payment systems 

in Portugal by defining the obligations of certain entities that carry out activities within the scope of 

such systems. As mentioned in the explanatory memorandum accompanying the draft notice, it is 

intended to strengthen the conditions under which the BdP exercises its oversight function, as it was 

considered necessary to adopt regulatory instruments to establish a legal framework at national level 

that more clearly specifies the information, notification and/or communication obligations that such 

1  

2  
3  

4  

Council Decision 98/415/EC of 29 June 1998 on the consultation of the European Central Bank by national 
authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42). 

Lei Orgânica do Banco de Portugal, aprovada pela Lei n.º 5/98, de 31 de Janeiro. See Article 14. 
Regime Geral das Instituições de Crédito e Sociedades Financeiras – RGICSF, aprovado pelo Decreto-Lei n.º 
298/92, de 31 de Dezembro. See Article 92(1), subparagraph (a).  

See Article 117-B of the Legal Framework of Credit Institutions and Financial Companies.  

 
 
 
 
 
 
ECB-PUBLIC 

entities  must  comply  with.  Thus,  the  draft  regulations  seek  to  increase  the  transparency  of  these 

obligations while creating a legally binding framework at national level for such entities.  

1.3  Scope of the draft regulations 

The draft regulations define the entities that fall within their scope and are not currently covered by 

other prudential, macroprudential, or conduct-monitoring measures issued by the BdP5 with the very 

same purpose. These entities are, in particular, specified as those that (1) operate or process retail 

payment systems; (2) hold payment instrument schemes or payment instrument arrangements; or 

(3)  provide  cash  withdrawal  services  through  automated  teller  machines  (ATMs)  (hereinafter  the 

‘specified entities’) 6.  

1.4  General reporting obligations 

The draft regulations establish reporting obligations under which all of the specified entities that carry 

out their activity in Portugal will be obliged to notify the BdP of the commencement, modification and 

termination  of  their  activity7.  In  particular,  the  draft  regulations  specify  the  information  to  be 

communicated  by  those  entities  at  each  of  these  stages 8.  The  draft  regulations  provide  that  an 

activity is considered to be carried out in Portugal whenever the services provided under such activity 

are made available to payment services users and/or providers established in Portugal9. Therefore, 

entities  that  carry  out  their  activity  in  Portugal,  but  which  are  not  established  in  Portugal,  will  be 

subject to such reporting obligations. However, the remaining obligations discussed in paragraphs 

1.5 to 1.7 will not be applicable to such entities, since these are only applicable to entities that are 

established in Portugal and which carry out their activities in the context of payment systems. 

1.5  Assessment actions 

The  draft  regulations  envisage  that,  in  its  oversight  function  in  the  context  of  the  ESCB,  the  BdP 

undertakes assessment actions in respect of entities established in Portugal which carry out their 

activities  in  the  field  of  payment  systems 10.  These  assessments  are  performed  on  the  basis  of 

existing Eurosystem frameworks and guidance. In this context, these entities are obliged to provide 

certain information to the BdP11. It is expressly clarified that these assessment actions are carried 

out without prejudice to the possibility of the BdP requesting additional information or carrying out 

other assessment  actions in compliance with the  applicable framework laid down by the ESCB12. 

The draft regulations further clarify that all of the specified entities that are established in Portugal 

must provide the BdP with any information it deems necessary to enable it to monitor their activities 

in the context of the performance of its oversight function. The draft regulations also contain various 

provisions  of  a  procedural  nature  related  to  assessments  and  other  oversight  actions  of  the  BdP 

which may give rise to the issuance of recommendations and observations by the BdP13. 

5  
6  
7  
8  
9  
10  
11  
12  
13  

See Articles 1 and 2 of the draft notice.  

See Article 2(1) of the draft notice.  
See Article 1(1) of the draft notice.  

See Articles 3 to 5 of the draft notice.  
See Article 2(2) of the draft notice.  

See Article 8 of the draft notice.  
See points 2 to 6 of the draft instruction.  
See Article 8(3) of the draft notice.  

See points 7 to 10 of the draft instruction.  

2 

 
 
 
ECB-PUBLIC 

1.6  Reporting of major incidents 

The draft regulations provide that entities established in Portugal which (1) operate or process retail 

payment  systems  or  (2)  hold  payment  instrument  schemes  or  payment  instrument  arrangements 

must report to the BdP all major incidents that may affect their activity and may have an operational 

or security-related nature14. For this purpose, major incidents are defined as consisting of one or a 

series of connected unforeseen events which have or may have an adverse impact on the integrity, 

availability,  confidentiality,  authenticity  and/or  continuity  of  payment-related  services15.  These 

entities  will  be  obliged  to  provide  certain  information 16  to  allow  the  BdP  to  assess  the  incident  in 

question.  

1.7  Reporting of statistical information 

The draft regulations provide that entities established in Portugal which (1) operate or process retail 

payment  systems  or  (2)  provide  cash  withdrawal  services  through  ATMs  must  report  to  the  BdP 

statistical information on their operations and payment services17. The specific statistical information 

to be sent by these entities is already established in a previous regulation issued by the BdP18.  

2 

General observations 

2.1  Pursuant to Article 127(2), fourth indent, of the Treaty, as mirrored in Article 3.1, fourth indent, of the 

Statute of the European System of Central Banks and of the European Central Bank (hereinafter the 

‘Statute of the ESCB’), the Eurosystem has the task of promoting the smooth operation of payment 

systems. Article 22 of the Statute of the ESCB furthers the performance of this task. Based on the 

foregoing, the ECB and the national central banks (NCBs) should use the powers available to them 

to promote the smooth operation of clearing and payment systems. Oversight responsibilities are, 

inter alia, key to this basic task19. 

2.2  The ECB emphasises that the draft regulations are based on the relevant provisions of the Organic 

Law of the Banco de Portugal20, which states that it is the BdP’s responsibility to regulate, oversee 

and promote the proper functioning of payment systems, specifically in the context of its participation 

in the ESCB.  

2.3  The ECB welcomes that the explanatory memoranda accompanying the draft regulations expressly 

indicate  that  the  draft  regulations  must  not  hinder  the  oversight  to  be  performed  by  other  central 

banks within the ESCB, including the ECB, over entities that carry out their activities in the field of 

payment systems 21. Subject to the specific observations set out below, the ECB further welcomes 

that  the  draft  regulations  are  based  on  existing  Eurosystem  oversight  frameworks  and  guidance, 

14  
15  
16  
17  
18  
19  

20  
21  

See Article 1(3) and Article 9 of the draft notice.  
See Article 9(2) of the draft notice.  

See point 12 of the draft instruction.  
See Article 1(4) and Article 10 of the draft notice.  

See Instruction No 19/2012.  
See Section 3.1 of the Eurosystem oversight policy framework, revised version (July 2016), available on the ECB’s 
website at www.ecb.europa.eu. See also paragraph 2.2 of Opinion CON/2020/9. All ECB opinions are published on 
EUR-Lex. 
See Article 14 of the Organic Law of the Banco de Portugal, approved by Law No 5/98 of 31 January.  

See page 2 of the explanatory memorandum accompanying the draft notice.  

3 

 
 
 
 
ECB-PUBLIC 

where available, and that the intention of the draft regulations is not to overlap with other applicable 

ESCB  frameworks.  The  ECB  also  welcomes  that  the  draft  regulations  cover  the  collection  of 

information required for the exercise of the BdP’s oversight tasks in the context of these frameworks.  

2.4  Based  on  the  above,  the  ECB  understands  that  the  draft  regulations  are  without  prejudice  to  the 

principles  and  rules  set  out  under  any  existing  or  future  Eurosystem  framework  and/or  ECB 

regulations potentially applicable to entities established in Portugal, including in the event that these 

entities  become  of  pan-European  relevance  in  accordance  with  the  applicable  Eurosystem 

frameworks and/or regulations. In the same vein, the ECB notes that the draft regulations are to be 

adopted by the BdP without prejudice to the general regulatory power of the ECB under Article 22 of 

the  Statute  of  the  ESCB.  In  the  exercise  of  such  power,  the  ECB  may  in  the  future  adopt  new 

regulations  which  would  be  applicable  to  the  entities  that  fall  under  the  Eurosystem  frameworks 

referred to in the draft regulations. In such a case, the ECB regulations would prevail over national 

regulations.     

2.5  The above observations are in line with the Eurosystem oversight policy framework, which describes 

the role of the Eurosystem in the field of oversight. They are also in line with the respective applicable 

Eurosystem frameworks, i.e. the Eurosystem revised oversight framework for retail payment systems 

(hereinafter the ‘RPS framework’) and the Eurosystem oversight framework for electronic payment 

instruments,  schemes  and  arrangements  (hereinafter  the  ‘PISA  framework’).  Pursuant  to  the 

Eurosystem’s  policies,  for  the  purpose  of  overseeing  individual  payment  systems,  schemes  and 

arrangements, the  Eurosystem assigns primary oversight responsibility to the central  bank that  is 

best placed to fulfil this function, either by virtue of its proximity to the overseen entity (e.g. where the 

system is legally incorporated in its jurisdiction) or by virtue of national laws that attribute specific 

oversight responsibilities to the central bank concerned, subject to any Treaty-based requirements. 

This  is  typically  the  case  for  systems  and  entities  with  a  clear  national  anchor,  i.e.  being  legally 

incorporated  in  a  jurisdiction  or  serving  that  particular  national  market 22,  such  as  the  payment 

systems and entities intended to be covered by the draft regulations 23. When there is no national 

anchor, the body entrusted with primary oversight responsibility is the NCB of the country where a 

system,  scheme  or  arrangement  is  legally  incorporated,  unless  the  Governing  Council  decides 

otherwise and assigns the primary oversight responsibilities to the ECB.  

2.6  Under the draft regulations, the BdP’s assessment of retail payment systems will be based on the 

RPS framework as well as the Eurosystem’s Cyber Resilience Oversight Expectations (CROE)24 and 

the BdP’s assessment of the obliged entities responsible for the functioning of payment schemes 

and arrangements will be based on the PISA framework. The ECB welcomes the draft regulations, 

which provide a more robust legal basis for the BdP’s tasks relating to the oversight of these entities, 

thereby strengthening its oversight function25. Transitioning from a national framework based on soft 

law instruments and recommendations to a legally binding framework will facilitate the addressing of 

compliance  issues  by  entities  carrying  out  payment  system-related  activities.  The  ECB  also 

See Section 5.2 of the Eurosystem oversight policy framework, revised version (July 2016). 

See paragraph 2.3 of Opinion CON/2020/9. 

22  
23  
24        See point 3 of the draft instruction. 
25   

See, for example, paragraph 2.1 of Opinion CON/2020/9, paragraph 2.3 of Opinion CON/2021/28 and paragraph 2.1 
of Opinion CON/2021/33.  

4 

 
 
 
ECB-PUBLIC 

welcomes the BdP’s intention to reinforce and clarify its role as overseer of payment systems and 

payment  schemes  and  arrangements  by  imposing  legally  binding  requirements  on  the  obliged 

entities.  The  draft  regulations  are  thus  expected  to  facilitate  the  consistent  and  harmonised 

application by the BdP of Eurosystem standards when conducting its oversight of payment systems 

in Portugal 26. 

2.7  On that note, the ECB highlights the importance of the draft regulations’ consistency with the existing 

Eurosystem  frameworks.  To  achieve  such  consistency,  considering  also  that  the  Eurosystem 

frameworks are subject to amendments and alterations, the BdP might consider favouring the use of 

cross-references to these frameworks in the draft regulations, instead of further specifications when 

these simply repeat the content of such frameworks27.  

2.8  The ECB understands that the BdP continues to apply Eurosystem oversight expectations for links 

between retail payment systems 28. 

3. 

Specific observations 

3.1    Scope of the draft regulations 

3.1.1  According to the explanatory memoranda accompanying the draft regulations, the draft regulations 

should not hinder the oversight to be performed by other central banks within the ESCB, including 

the ECB, over entities that carry out their activities in the context of payment systems. Even in the 

absence  of  direct  references  in  the  provisions  of  the  draft  regulations  themselves,  the  ECB 

understands that the draft regulations do not intend to interfere with the implementation of Regulation 

(EU)  No  795/2014  of  the  European  Central  Bank  (ECB/2014/28) 29  (hereinafter  the  ‘SIPS 

Regulation’), which applies to systemically important payment systems (SIPS) on the basis of certain 

quantitative and qualitative criteria30.  

3.1.2  Having said that, the draft regulations do not define ‘payment systems’ or provide an exhaustive list 

of  entities  considered  to  operate  in  the  field  of  retail  payment  systems  or,  in  particular,  expressly 

exclude SIPS from their scope of application31. The ECB would therefore welcome the introduction 

of an explicit clarification in the draft regulations 32 to the effect that their scope of application does 

not  cover  payment  systems  classified  as  SIPS  under  the  SIPS  Regulation.  Additionally,  the  ECB 

would welcome further clarification to the effect that the draft regulations only apply to prominently 

important  retail  payment  systems  and  other  retail  payment  systems  as  defined  under  the  RPS 

framework.  

See paragraph 2.1 of Opinion CON/2023/14. 

26  
27        See, for example, points 2.3.2 and 5.3.2 of the draft instruction. 
28  

29  

30  
31  
32  

Eurosystem, ‘Oversight expectations for links between retail payment systems’, 29 November 2012, available on the 
ECB’s website at www.ecb.europa.eu. 
See Regulation of the European Central Bank (EU) No 795/2014 of 3 July 2014 on oversight requirements for 
systemically important payment systems (ECB/2014/28) (OJ L 217, 23.7.2014, p. 16). 
See Article 1(3) of Regulation (EU) No 795/2014 (ECB/2014/28). 
See Article 2 of the draft notice. 

In particular, in Article 1 of the draft notice. 

5 

 
 
 
 
ECB-PUBLIC 

3.1.3  The ECB would further welcome the introduction of a provision33 specifying that the exercise of the 

BdP’s oversight tasks and the obligations introduced by the draft regulations are without prejudice to 

the  oversight  powers  and  tasks  of  the  ECB  and  other  NCBs  resulting  from  the  application  of 

Eurosystem  frameworks  and  will  respect  the  ECB’s  competences  as  primary  overseer  and  the 

legitimate exercise of other NCBs’ oversight powers and tasks in the context of the ESCB, thereby 

reflecting  in  the  enacting  terms  the  clarification  contained  in  the  explanatory  memoranda 

accompanying the draft regulations. The introduction of this provision would clarify that obligations 

under the draft regulations relating to assessments under the existing Eurosystem frameworks will 

respect  the  Eurosystem’s  assignment  of  the  primary  oversight  responsibility  in  line  with  the 

Eurosystem frameworks and as determined by the Governing Council. The ECB also points out that 

the application of the obligations under the draft regulations and the exercise of the BdP’s oversight 

tasks  must  respect  the  principles  of  proportionality  and  ensure  that  duplication  of  reporting 

requirements is avoided to the extent possible.  

3.1.4  Furthermore,  regarding  the  interplay  of  the  draft  regulations  with  the  Eurosystem  frameworks,  it 

should be clarified whether the draft regulations are to cover only the entities that fall within the RPS 

and PISA frameworks following the respective Eurosystem classification exercises. With regard to 

the entities that fall under the PISA framework, the ECB draws attention to the Eurosystem exemption 

policy  that  complements  the  PISA  framework  pursuant  to  which  every  three  years  the  ECB 

coordinates a Eurosystem-wide exercise to identify those payment schemes/arrangements that fall 

within the scope of the PISA framework and those that should be exempted from it, also in view of 

the  Eurosystem  oversight  focus  on  those  schemes  and  arrangements  that  have  reached  a 

considerable level of importance for the euro area. On the basis of the above, considering that the 

oversight assessments on payment instruments and schemes in the draft regulations are based on 

the  PISA  framework,  clarification  as  to  whether  the  draft  regulations  also  cover  entities  that  are 

granted an exemption from the PISA framework would be advisable.  

3.1.5  In the same vein, the ECB also notes that, under the draft instruction, the respective entities must 

carry out self-assessments under the RPS and PISA frameworks within a maximum of one year after 

starting their activities. The ECB highlights that the stipulated timelines risk not taking into account 

the outcome of the Eurosystem’s classification exercises and the exemption policy enshrined in the 

PISA framework. The ECB therefore suggests that the timeline for conducting the self-assessment 

should be initiated only following the notification to the relevant entity that it is subject to the draft 

regulations and/or Eurosystem frameworks.  

3.1.6  Further to the above, the ECB would suggest the introduction of clarifications on the subject matter 

of  the  draft  regulations,  particularly  in  the  article  setting  out  their  object  and  scope34,  which,  as 

currently drafted, does not reflect their actual scope, which extends beyond information reporting to 

cover the BdP’s assessment of the required information and issues of compliance with the principles 

underpinning the Eurosystem frameworks and related oversight actions. In particular, it is suggested 

to include a provision clearly setting out that the BdP will use the information collected from entities 

established  in  Portugal  that  fall  within  the  scope  of  the  draft  regulations  for  the  conduct  of 

33  
34  

In particular, in Article 1 of the draft notice. 

Article 1 of the draft notice. 

6 

 
 
 
ECB-PUBLIC 

assessments under the Eurosystem frameworks and also for other oversight actions. The ECB takes 

the view that this would be in line with the articles introduced in the draft regulations that specify the 

BdP’s oversight duties 35, as well as the provisions that set out obligations for entities to conduct self-

assessments and those that specify that the BdP’s assessments and other oversight actions may 

result in the issuance of recommendations and/or observations by the BdP36.  

3.1.7  Additionally, the provision setting out the scope of application 37 provides that an entity is considered 

to  operate  within  the  field  of  retail  payment  systems  ‘in  particular’  when  it  falls  into  one  of  the 

predefined categories. The use of the expression ‘in particular’ indicates that the list of entities which 

may fall within the draft regulations’ scope of application is non-exhaustive, potentially giving rise to 

issues of legal uncertainty.  

3.1.8  Finally, the draft regulations provide that an entity will be considered to operate in the field of retail 

payment systems and, therefore, subject to the draft regulations, where, inter alia, it holds payment 

schemes and payment arrangements 38. The Eurosystem oversight framework for electronic payment 

instruments, schemes and arrangements provides that the principles contained therein are aimed at 

the governance bodies of such schemes and arrangements 39. The achievement of consistency in 

the  terminology  used  in  the  draft  regulations  regarding  its  application  to  payment  schemes  and 

arrangements  with  that  used  in  the  Eurosystem  oversight  framework  would  ensure  greater 

coherence and legal certainty.  

3.2  Enforcement measures  

3.2.1  The ECB understands that the BdP has the possibility to apply enforcement measures or sanctions 

in respect of the entities included within the scope of application of the draft regulations through the 

general  provisions  contained  in  the  Legal  Framework  of  Credit  Institutions  and  Financial 

Companies40, even though the draft regulations do not expressly refer to the enforcement measures 

available to the BdP in the event of non-compliance with the notification requirements pertaining to 

commencement, modification or cessation of business and the information required for the oversight 

assessments 41.  In this context, the ECB also notes that, in respect of the assessments carried out 

by the BdP under the draft regulations, the BdP may issue recommendations and/or observations 42, 

but the draft regulations do not explicitly set out the distinction between each type of measure, their 

legal nature and whether or not they are legally binding. The draft regulations are also silent on the 

ultimate consequences that stem from the issuance of an observation. The recommendations are 

ranked by reference to their degree of criticality 43. Entities subject to a recommendation must draw 

35        See Article 8 of the draft notice. 
36  
37   
38        See Article 2(1), subparagraphs (b) and (c), of the draft notice. 
39  

See Articles 7, 8 and 9 of the draft instructions.  
See Article 2(1) of the draft notice.  

40  

See Section 3 of the Eurosystem oversight framework for electronic payment instruments, schemes and 
arrangements. 
See, in particular, Articles 117-B(2) and 210(i) of the Legal Framework of Credit Institutions and Financial 
Companies. 
See Articles 3, 4 and 5 of the draft notice. 
41  
42  
See point 8.1 of the draft instruction. 
43        See point 9.2 of the draft instruction. 

7 

 
 
 
ECB-PUBLIC 

up an action plan for the implementation of the recommendation and share it with the BdP44, which 

is to monitor its implementation 45.  

3.3  Pan-European service providers established outside Portugal 

3.3.1 The ECB notes that pan-European payment service providers that carry out activities in Portugal, but 

which are not established in Portugal, will only be subject to the limited set of obligations contained 

in the draft regulations to notify the BdP of the commencement, modification and termination of their 

activity in Portugal. The ECB therefore understands that, apart from these very limited notification 

obligations,  the  primary  purpose  of  the  draft  regulations  is  to  regulate  payment  system  activities 

undertaken by entities that are established in Portugal.  

3.4  Alignment of the draft regulations with other Eurosystem frameworks and guidance 

3.4.1  The  ECB  understands  that  the  draft  regulations  also  cover  the  BdP’s  oversight  responsibilities  in 

respect of entities responsible for the provision of critical services to payment systems, schemes and 

arrangements46. The BdP’s assessment of the provision of these critical services is to be based on 

the assessment methodology for the oversight expectations applicable to critical service providers 47, 

published  by  the  Bank  for  International  Settlements  (BIS)48.  The  ECB  also  notes  that  the  BdP’s 

assessment should follow any relevant Eurosystem guidance.  

3.4.2  Regarding the assignment by the draft regulations of oversight responsibilities to the BdP in respect 

of the cyber resilience of retail payment systems, the ECB welcomes that the exercise by the BdP of 

its oversight responsibilities in this respect is to be based on the CROE 49.  

3.4.3  The draft regulations require the obliged entities to report to the BdP any major incidents affecting 

their activity, which may be operational or security incidents. The ECB welcomes the alignment of 

the draft regulations with Eurosystem guidance regarding major incident reporting. Additionally, the 

ECB recommends that the draft regulations should clarify that the BdP will share relevant information 

about major incidents with the Eurosystem and on a case-by-case basis with the ESCB.   

3.5  Collection of statistical information  

3.5.1  Regarding the requirements under the draft regulations for obliged entities to provide the BdP with 

statistical  information  on  the  payment  transactions  and  services  carried  out  in  the  course  of  their 

activities 50, and for the BdP to detail, by way of a regulation, the statistical information to be provided 

by  the  obliged  entities 51,  the  ECB  understands  that  such  information  is  currently  specified  in  a 

previous  regulation  issued  by  the  BdP52.  The  obliged  entities  may  already  be  required  to  report 

information  concerning  their  payment  activities  under  Directive  (EU)  2015/2366  of  the  European 

44        See point 9.3 of the draft instruction. 
45        See point 9.4 of the draft instruction. 
46   
See point 6.1 of the draft instruction. 
47   

See Bank of International Settlements, ‘Assessment methodology for the oversight expectations applicable to critical 
service providers’ (December 2014), available on the BIS’s website at www.bis.org. 

48   
49   

50   
51  
52  

See point 6.2 of the draft instruction.  
Eurosystem ‘Cyber resilience oversight expectations for financial market infrastructures’ (December 2018), available 
on the ECB’s website at www.ecb.europa.eu.   
See Article 10(1) of the draft notice.  
See Article 10(2) of the draft notice. 

See Instruction No 19/2012.  

8 

 
 
 
 
ECB-PUBLIC 

Parliament and of the Council53 to the designated national competent authority and, under Regulation 

(EU) No 1409/2013 (ECB/2013/43)54, to the BdP. Any further reporting requirements imposed by the 

BdP should take account of, and not duplicate or conflict with, the reporting requirements imposed 

on  the  obliged  entities  under  Directive  (EU)  2015/2366  and  Regulation  (EU)  No  1409/2013 

(ECB/2013/43). This is necessary to comply with the statistical principles that govern the production 

of statistics by the ESCB under Article 3a of Council Regulation (EC) No 2533/9855, including cost-

effectiveness and minimisation of the reporting burden. 

This opinion will be published on EUR-Lex. 

Done at Frankfurt am Main, 30 December 2024. 

[signed] 

The President of the ECB 

Christine LAGARDE 

53    Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services 
in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 
1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35). 

54    Regulation (EU) No 1409/2013 of the European Central Bank of 28 November 2013 on payments statistics 

(ECB/2013/43) (OJ L 352, 24.12.2013, p. 18). 

55    Council Regulation (EC) No 2533/98 of 23 November 1998 concerning the collection of statistical information by the 

European Central Bank (OJ L 318, 27.11.1998, p. 8). 

9