text: Laki luottolaitostoiminnasta (8.8.2014/610).

text: Maksulaitoslaki (30.4.2010/297).

text: Sijoitusrahastolaki (29.1.1999/48).

text: Sijoituspalvelulaki (14.12.2012/747).

text: Laki arvo-osuusjärjestelmästä ja selvitystoiminnasta (16.6.2017/348).

text: Laki kaupankäynnistä rahoitusvälineillä (28.12.2017/1070). 7

text: Council Decision 98/415/EC of 29 June 1998

text: on the consultation of the European Central Bank by national authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42).

text: See Opinions

text: and

text: . All ECB opinions are published on the ECB’s website at www.ecb.europa.eu. 9 See paragraph 22 of Opinion

text: ; see also paragraph 2.1 of Opinion

text: . 10 See footnotes 8 and 12.

text: See Disclosure Report TARGET2 assessment against the principles for financial market infrastructures (June 2016) at https://www.ecb.europa.eu and EURO1 PFMI Disclosure Report by EBA CLEARING S.A.S. (20 August 2015) at https://www.ebaclearing.eu. 12 To the extent that the situation would fall within the definition of an emergency situation, as defined in the Law on emergency powers, this would entail the enactment of a government decree on emergency powers in the field of financial markets (as provided for in the Law on emergency powers, currently in force). In view of preparedness for acting in emergency situations, the views expressed in the past ECB opinions regarding emergency powers legislation that applies in respect of the Finnish financial markets, in particular regarding the definition of an emergency situation, remain valid. See paragraph 7 of ECB Opinion

text: and paragraph 9 and 14 of

text: Regulation of the European Central Bank

text: (EU) No 795/2014

text: of 3 July 2014 on oversight requirements for systemically important payment systems (ECB/2014/28) (OJ L 217, 23.7.2014, p. 16). 14 The said guidance was published by the Committee on Payments and Market Infrastructures and the Board of the International Organizsation of Securities Commissions (CPMI-IOSCO) in June 2016, available at https://www.bis.org. 15 See Article 15 of the SIPS Regulation. 16 European Banking Authority Guidelines of 26 September 2017 on internal governance under Directive

text: ), p. 53-54.

text: Articles 4(1)

text: (e) and 6(4) of

text: Council Regulation (EU) No 1024/2013 of 15 October 2013

text: conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63). 18 See Articles

text: and

text: (c)(i) and (iii) of

text: conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63); Articles

text: and

text: of Regulation (EU) No 468/2014 of the European Central Bank of 16 April 2014 establishing the framework for cooperation within the Single Supervisory Mechanism between the European Central Bank and national competent authorities and with national designated authorities (SSM Framework Regulation) (ECB/2014/17) (OJ L 141, 14.5.2014, p. 1). 19

text: Regulation (EU) No 260/2012

text: of the European Parliament and of the Council of 14 March 2012 establishing technical and business requirements for credit transfers and direct debits in euro and amending

text: Regulation (EC) No 924/2009

text: (OJ L 94, 30.3.2012, p. 22).

title: Opinion of the European Central Bank of 26 October 2018 on the review of Finnish law concerning preparedness obligations applicable in the financial sector (CON/2018/46)

text: OPINION OF THE EUROPEAN CENTRAL BANK of 26 October 2018 on the review of Finnish law concerning preparedness obligations applicable in the financial sector (

text: ) Introduction and legal basis

text: On 16 August 2018, the European Central Bank (ECB) received a request from the Finnish Ministry of Finance for an opinion on a proposal to further specify so-called preparedness obligations in the field of financial market services to ensure the uninterrupted availability of functions vital to society, including (1) 1 2 amendments to the Law on credit institutions , the Law on payment institutions , the Law on investment 3 4 funds , the Law on investment services , the Law on the book-entry system, clearing and settlement 5 6 operations , and the Law on trading in financial instruments ; (2) a draft law on a Joint Working Group for incident management in the financial market; and (3) a draft government decree to specify the functions and services the performance of which the addressees of the preparedness obligations shall ensure (hereinafter collectively referred to as the ‘proposal’). The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and the second, fifth and sixth indents of

text: , as the proposal relates to means of payment, payment and settlement systems, rules applicable to financial institutions insofar as they materially influence the stability of financial institutions and markets and the ECB’s tasks concerning the prudential supervision of credit institutions pursuant to Article 127(6) of the Treaty. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

text: 1. Purpose of the proposal

text: 1.1 The proposal elaborates on the existing preparedness obligations imposed on credit institutions, payment institutions, investment funds, investment service providers, the central securities depository, and the stock exchange (collectively referred to as ‘addressees’) under Finnish law. Credit and payment institutions, investment funds and investment service providers are already

text: obliged to ensure that they can perform tasks and provide services free of interruption, as far as possible, also in emergency situations, by participating in preparedness planning regarding financial markets and by planning contingency measures. The proposal requires these entities to ensure the performance of their tasks and the provision of their services, in particular by means of maintaining sufficient data systems and data repositories in Finland, and by other arrangements deemed sufficient for ensuring their uninterrupted operation in Finland. Regarding investment service providers, for which the preparedness obligation currently concerns only keeping custody of securities, the obligation would be extended to ensuring that the issue, trading, clearing and settlement of securities are also safeguarded. The stock exchange, which is currently required to ensure its functioning despite interferences and during peak times as well, is tasked with similar preparedness obligations as the other addressees. Regarding the central securities depository, only editorial amendments to the law are proposed (to align the current wording with the new wording of the preparedness obligations imposed on the other addressees) as, in substance, the existing preparedness obligations correspond to those in the proposal. 1.2 Regarding credit institutions, payment institutions and investment service providers, the proposal recommends a government decree to specify the functions and services of these entities the performance of which is to be ensured also in emergency situations. In respect of credit and payment institutions, these include: (1) services for making cash deposits into a payment account or cash withdrawals from a payment account as well as operations related to the provision and maintenance of a payment account; (2) the execution of a payment transaction, as an account transfer, involving the transfer of funds to the payment account of a payment service provider (PSP) as a direct debit, with a payment card or with another payment instrument; (3) the issuance of a payment instrument into circulation; (4) the approval and processing of a payment transaction based on a contract made with a payee, leading to funds being transferred to the payee; and (5) functions whereby an account transfer is made into a Finnish account located at another credit or payment institution and functions whereby an account transfer coming from such an account can be received. In respect of investment funds, these include the activities listed in Articles 53 and 54 of the Law on investment funds to ensure the maintenance of a fund unit register that would record basic information on the fund unit-holder, such as the number of units held, a breakdown of the different types of shares and series of shares and the date of registration of the fund unit, as well as to ensure that in the case of a new issuance the issue price will be paid within regular timeframes. The provision of a share certificate upon request of a fund unit-holder would also be available. In respect of investment service providers, these include: (1) the receipt and transmission of orders in relation to financial instruments; (2) the execution of orders in relation to financial instruments on behalf of clients; (3) the management of financial instruments on the basis of an agreement with the client whereby the decisive authority regarding investment is given wholly or partly to the investment service provider; (4) the organisation of the issue of financial instruments into circulation, or the sale thereof, by providing an associated subscription or purchasing commitment; (5) the organisation of the issue of financial instruments without subscription or purchasing commitment; (6) services linked to the guarantee of the issue of financial instruments; and (7) the storage and maintenance of financial instruments on behalf of the client. 1.3 The proposal also calls for a decree of the Ministry of Finance to be prepared to regulate the principles and arrangements involved in preparedness planning in the financial market. It is further

text: proposed that the Finnish Supervisory Authority (FSA) issues ordinances on the preparedness obligations, covering in particular: (1) the technical details of preparedness planning; (2) the documents related to preparedness planning; (3) the technical requirements for and general information on the use of the relevant systems and infrastructures; and (4) technical matters in respect of the abovementioned points. The proposal also contains sanctions for non-compliance with the preparedness obligations. 1.4 The proposal further provides for a draft law on a Joint Working Group, which would be established through a decision of the Ministry of Finance, to plan and coordinate preparedness measures in the financial market. The duties of this Joint Working Group would include: (1) planning and coordinating measures necessary for the management of both emergency circumstances and serious disruptive situations occurring under normal conditions; (2) acquiring and delivering information necessary for the management of disruptive situations, and serving as support for decision-making by public authorities; and (3) supporting the operators who are able to mitigate the negative effects of the disruptive situations on society, e.g. by conveying and analysing information on disruptive situations. The draft law on the Joint Working Group also contains related provisions on the processing of confidential information.

text: 2. General observations

text: The ECB understands that the basic purpose of the draft law is to impose an obligation on the addressees to: (1) plan and prepare in advance measures that would be used in emergency situations and during serious disruptive situations occurring under normal conditions; and (2) to establish and maintain systems and infrastructures that are located in Finland, in order to ensure their uninterrupted functioning also in emergency situations, in addition to the existing European and international infrastructures. Against this backdrop, the ECB wishes to make a number of general observations on the proposal. 2.1 Consultation of European Commission on the proposal The ECB notes that it has previously issued opinions to the Finnish authorities on emergency powers legislation that applies in respect of the Finnish financial markets . Since the proposal affects Union law falling outside the competence of the ECB, in the areas of international and national security, and may affect the internal market for financial services, the Ministry of Finance may wish to consult the European Commission on the proposal if it has not already done so . For its part, the ECB would highlight that, in accordance with Article 4(3) of the Treaty on European Union, pursuant to the principle of sincere cooperation Member States are obliged to facilitate the achievement of the ECB’s tasks and refrain from taking any measures which could jeopardise the ECB’s or the ESCB’s objectives. This principle, similar to the views expressed in the ECB’s past opinions , should be noted in respect of the areas covered by this opinion. 2.2 Necessity and proportionality of the proposal

text: The ECB understands that most of the relevant infrastructures that are being used in Finland in the financial market sector are either European or global in nature. These infrastructures provide for contingency measures and fall back solutions that are not physically located in Finland. As contingency measures have already been put in place , the ECB would recommend that the Finnish authorities further consider the necessity and proportionality of the proposal in view of the high costs that, the ECB understands, will be caused by the establishment and maintenance of additional national infrastructures. 2.3 Impact of the proposal on TARGET2, Target2-Securities and ESCB infrastructures 2.3.1 The ECB understands that the proposal was prepared in view of the situation that the Finnish financial sector is cut off entirely from European and other financial market infrastructures (FMIs), including TARGET2 and Target2-Securities (T2S), due to an incident during normal circumstances or during an emergency situation. In such a scenario, the ability of Suomen Pankki to engage in single monetary policy operations and to provide regular liquidity to Finnish counterparties, through participation of the counterparties in monetary policy operations, would also be disrupted . In the event that the Finnish financial sector and Suomen Pankki were cut off from TARGET2 and T2S, those systems, including accounts and assets held in them by Finnish participants, would continue to operate normally, and branches or subsidiaries of those participants from outside Finland having the relevant permissions may continue to make transactions. In the event that a back-up solution becomes available in Finland and starts using TARGET2 and/or T2S balances from the last known account position, it would be possible for debits to be made on the same account in both TARGET2 and/or TS2 as well as in the Finnish back-up system, which could eventually lead to the participant, in effect, being granted uncollateralised credit (for TARGET2) or selling securities twice (in T2S). When planning preparedness measures, it is important to avoid such scenarios and to ensure legal certainty of bookings. 2.3.2 As member of the Eurosystem, Suomen Pankki has a Treaty based obligation to participate in the implementation of the single monetary policy that is conducted via the TARGET2 infrastructure, which also transmits large-value payments in general. As appropriate, the measures proposed by the proposal do not address TARGET2, T2S or other infrastructures of the European System of Central Banks (ESCB). In this respect, the ECB would like to stress that any preparedness measures should not be arranged in such a manner that they would have an adverse effect on the performance of ESCB tasks, or prejudice Eurosystem competencies. For the avoidance of doubt, it should also be made clear that the proposal is not intended to apply even indirectly to ESCB infrastructures such as TARGET2 or T2S or prejudice the offering of their services. 2.4 Oversight of systemically important payment systems

text: By way of background information in connection with the implementation of the proposal, the Finnish authorities may wish to take note that Regulation of the European Central Bank

text: (EU) No 795/2014

text: of 3 July 2014 on oversight requirements for systemically important payment systems (ECB/2014/28) (hereinafter the ‘SIPS Regulation’), which covers both large-value and retail payment systems of systemic importance, operated either by a Eurosystem central bank or a private entity, and the non-legally binding oversight frameworks for retail payment systems and for payment instruments have recently introduced a number of requirements addressing new risks, including those related to operational and security risks such as cyber resilience, for which the CPMI-IOSCO guidance on cyber resilience for financial market infrastructures has been taken into account . 2.5 Eurosystem cyber resilience strategy for FMIs The Finnish authorities may also wish to take note of the Eurosystem cyber resilience strategy for FMIs, which is intended to support the implementation of the CPMI-IOSCO guidance from an oversight perspective. The strategy aims to develop a range of tools which can be used by regulators and markets to: (1) facilitate effective cyber resilience, by enhancing the ‘cyber readiness’ of individual FMIs that are overseen by the Eurosystem central banks, and ensure that measures are in place to support this; and (2) foster collaboration among FMIs, their critical service providers and the relevant authorities. In addition, the Eurosystem is developing a range of tools that can be used by FMIs to enhance their cyber resilience such as a European red team testing framework, cyber surveys and focused assessments, to assess the level of cyber maturity of Eurosystem payment systems and to develop cyber resilience oversight expectations to provide more detailed guidance to payment system operators. It is essential that Finnish FMIs’ level of soundness is guaranteed and that the proposed amendments follow the Eurosystem’s cyber resilience strategy. 2.6 Prudential supervision of credit institutions The proposal assigns the FSA the power to issue legally binding instructions to credit institutions concerning the use and functioning of the fall back systems that market participants are obliged to establish to ensure full functioning of the infrastructures in all situations. The ECB understands that these powers relate to the existing tasks of the FSA concerning supervision of operational risks and cyber security. Credit institutions should establish a sound business continuity management plan to ensure their ability to operate on an ongoing basis and limit losses in the event of severe business disruption . According to the explanatory memorandum accompanying the proposal, the new FSA powers would be limited to cover preparedness planning and technical requirements of data systems and data repositories in Finland, and other arrangements deemed sufficient for ensuring their uninterrupted operation in Finland, for instance, the interconnectedness of fall back systems. For significant credit institutions, these powers fall under the exclusive supervisory task of the ECB

text: regarding robust governance arrangements, and arrangements and mechanisms for the sound management of their risks . Moreover, under Union law there is an obligation to exchange information between the ECB and the national competent authorities, and the national competent authorities, under the conditions laid down by law, are required to inform the ECB about material supervisory procedures concerning less significant institutions and to transmit to the ECB material draft supervisory decisions related to these institutions in order to enable the ECB to exercise oversight over the functioning of the Single Supervisory Mechanism . Hence, the ECB recommends that the proposal require the FSA to share information, in a timely and efficient manner, about any exceptional situation affecting the performance of the tasks and the exercise of the powers conferred on the ECB for prudential supervisory purposes, as well as the measures planned or adopted by the FSA. 2.7 SEPA Regulation The preparedness obligations for Finnish PSPs outlined in the proposal are expected to be compliant with the requirements for the SEPA schemes under

text: Regulation (EU) No 260/2012

text: of the European Parliament and of the Council of 14 March 2012 establishing technical and business requirements for credit transfers and direct debits in euro, in particular the requirements for ‘reachability’ and ‘interoperability’ for PSPs when executing transactions .

text: This opinion will be published on the ECB’s website.

text: Done at Frankfurt am Main, 26 October 2018

text: [signed]

text: The President of the ECB

text: Mario DRAGHI


text: Council Decision 98/415/EC of 29 June 1998

text: on the consultation of the European Central Bank by national authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42).

text: Zakon o informacijski varnosti (ZinfV )(2018) (Official Gazette of the Republic of Slovenia, No 30/18).

text: Directive (EU) 2016/1148

text: of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).

text: See the Annex to the draft decree and Articles 13 and 14 of the draft decree.

text: See Article 2 of the draft decree.

text: Zakon o Banki Slovenije (ZBS-1) (2002) (Official Gazette of the Republic of Slovenia, No 72/06 – official consolidated text, 59/11 and 55/17).

text: Zakon o kritični infrastrukturi (ZKI) (2017) (Official Gazette of the Republic of Slovenia, No 75/17). The ECB was consulted on that Law and issued Opinion

text: See e.g. paragraph 2.1 of Opinion

text: , paragraph 2.1 of Opinion

text: , paragraph 2.2 of Opinion

text: , paragraph 2.2 of Opinion

text: and paragraph 3.1 of Opinion

text: . All ECB opinions are published on the ECB’s website at www.ecb.europa.eu. 12 See e.g.

text: Article 15

text: (4a) of

text: Regulation (EU) No 795/2014

text: of the European Central Bank of 3 July 2014 on oversight requirements for systemically important payment systems (ECB/2014/28) (OJ L 217, 23.7.2014, p. 16). 13 Available on the Bank for International Settlements’ website at: www.bis.org.

text: See

text: Article 15

text: , which imposes an obligation on SIPS operators to take the following steps: (i) review, audit and test systems, operational policies, procedures and controls periodically and after significant changes; (ii) establish an effective cyber resilience framework with appropriate governance measures in place; (iii) identify their critical operations and supporting assets, and have appropriate measures in place to protect them from, detect, respond to and recover from cyber attacks; (iv) regularly test the established measures; and (v) have a sound level of situational awareness of cyber threats, including through a process of continuous learning. 15 Available on the Bank for International Settlements’ website. 16 See e.g. paragraph 2.2 of Opinion

text: , paragraph 2.2 of Opinion

text: , paragraph 3.1.1 of Opinion

text: and paragraph 3.2.1 of Opinion

text: . 17 Guideline ECB/2012/13 of the European Central Bank of 18 July 2012 on TARGET2-Securities (OJ L 215, 11.8.2012, p. 19). 18 Available on the ECB’s website. 19 Available on the ECB’s website. 20 Decision ECB/2014/35 of the European Central Bank of 13 August 2014 on the identification of TARGET2 as a systemically important payment system pursuant to

text: Regulation (EU) No 795/2014

text: on oversight requirements for systemically important payment systems (OJ L 245, 20.8.2014, p. 5). 21 As described in paragraph 1.3, the draft decree includes in the list of essential services ‘activity of processing financial transactions and settlement activity, including credit card transactions and payment transactions’, and ‘administration of financial markets’ (operating and supervising financial markets other than by State authorities: collective safekeeping of securities, determining and executing obligations arising from securities transactions and maintaining a central register of holders of book-entry securities).

text: See the Eurosystem’s ‘Revised oversight framework for retail payment systems’ (February 2016), available on the ECB’s website. 23 See the Eurosystem’s ‘Overview of payment systems’, available on the ECB’s website. 24 See the Eurosystem’s ‘Oversight expectations for links between retail payment systems’, available on the ECB’s website. 25 See paragraph 2.4.4 of ECB Opinion

text: and paragraph 3.2.3 of Opinion

text: . 26 Zakon o plačilnih storitvah, storitvah izdajanja elektronskega denarja in plačilnih sistemih (ZPlaSSIED) (2018) (Official Gazette of the Republic of Slovenia No 7/18 and 9/18 – corr.). 27 See also paragraph 2.4.4 of Opinion

text: See paragraph 3.2.4 of Opinion

text: . 29 Ibid. 30 P. 9. 31 See paragraph 3.3.1 of Opinion

text: Directive (EU) 2015/2366

text: of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives

text: and

text: and

text: Regulation (EU) No 1093/2010

text: , and repealing Directive

text: (OJ L 337, 23.12.2015, p. 35). 33 See paragraph 2.4.3 of Opinion

text: and paragraph 3.4.2 of Opinion

text: . 34 See paragraph 3.4.3 of Opinion

text: . 35

text: Regulation (EU) No 909/2014

text: of the European Parliament and of the Council of 23 July 2014 on improving securities settlement in the European Union and on central securities depositories and amending Directives

text: and

text: and

text: Regulation (EU) No 236/2012

text: (OJ L 257, 28.8.2014, p. 1). 36 Supervision of KDD is regulated in the Law on the financial instruments market (2007) (Zakon o trgu finančnih instrumentov (ZTFI) (Official Gazette of the Republic of Slovenia No 108/10 – official consolidated text, 78/11, 55/12, 105/12 – ZBan-1J, 63/13 – ZS-K, 30/16 and 9/17) and the Decree on the implementation of the EU Regulation on improving securities settlement in the European Union and on central securities depositories (2016) (Uredba o izvajanju Uredbe (EU) o izboljšanju ureditve poravnav vrednostnih papirjev v Evropski uniji in o centralnih depotnih družbah (Official Gazette of the Republic of Slovenia No 60/16). The Securities Market Agency issues authorisation to, and supervises, KDD in the provision of notary services and central maintenance services and other related non-banking-type ancillary services.

text: Council Regulation (EU) No 1024/2013 of 15 October 2013

text: conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63). 38 See

text: Articles 4(1)

text: (e) and 6(4) of

text: Regulation (EU) No 1024/2013

text: . 39 See

text: Article 64(1) of Directive 2013/36/EU

text: of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive

text: and repealing Directives

text: and

text: (OJ L 176, 27.6.2013, p.338), see also paragraph 4.1 of Opinion

text: and paragraph 3.5.1 of Opinion

text: . 40 See

text: Article 4(1)

text: (52) of

text: Regulation (EU) No 575/2013

text: of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending

text: Regulation (EU) No 648/2012

text: (OJ L 176, 27.6.2013, p.1). 41 See

text: Article 16(2)

text: (e) of

text: Regulation (EU) No 1024/2013

text: See paragraph 2.12 of Opinion

text: , paragraph 3.5 of Opinion

text: , paragraph 4.3 of Opinion

text: and paragraph 3.5.2 of Opinion

text: . 43 See Articles 21 and 22 of the Law on information security. 44 See Article 32 of the Law on information security. 45 See Article 35 of the Law on information security. 46 See Articles 13(9) and 23 of the Law on information security. 47 See

text: Articles 27

text: to 30 of Directive

text: of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending

text: Council Directive 82/891/EEC

text: , and Directives

text: and

text: , and Regulations

text: (EU) No 1093/2010

text: and

text: (EU) No 648/2012

text: , of the European Parliament and of the Council (OJ L 173, 12.6.2014, p. 190). 48 See

text: Article 32(1)

text: (a) of Directive

text: See

text: Article 31(2)

text: (a) of Directive

text: . 50 See paragraphs 4.4 and 4.5 of Opinion

text: . 51 See Section XI of the Law on information security. 52 See also paragraph 4 of Opinion

text: and paragraph 3.5 of Opinion

text: . 53 See paragraph 4.6 of Opinion

text: .54 See also the Annex to the draft decree which lists a central banking service ‘acting as banker for the government sector, including with regard to sub-accounts for pension, health and social insurance’ as an essential service. 54 See also the Annex to the draft decree which lists a central banking service ‘acting as banker for the government sector, including with regard to sub-accounts for pension, health and social insurance’ as an essential service.

publisher: Europeiska centralbanken

sprak: en

title: Opinion of the European Central Bank of 8 November 2018 on designation of essential services and operators of essential services for the purpose of network and information systems security (CON/2018/47)

serie: con

text: OPINION OF THE EUROPEAN CENTRAL BANK of 8 November 2018 on designation of essential services and operators of essential services for the purpose of network and information systems security (

text: ) Introduction and legal basis

type: rubrik

text: On 5 October 2018 the European Central Bank (ECB) received a request from the Slovenian Ministry of Public Administration for an opinion on a draft decree on the designation of essential services and a more detailed methodology for the designation of the operators of essential services (hereinafter the ‘draft decree’). The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and the third, fifth and sixth indents of

text: Article 2(1) of Council Decision 98/415/EC

text: , as the draft decree relates to Banka Slovenije, payment and settlement systems and rules applicable to financial institutions insofar as they materially influence the stability of financial institutions and markets, and the tasks conferred on the ECB concerning the prudential supervision of credit institutions pursuant to Article 127(6) of the Treaty. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

type: stycke

text: 1. Purpose of the draft decree

text: 1.1 The draft decree is to be adopted by the Government of the Republic of Slovenia as an implementing regulation under the Law on information security . The latter transposed

text: Directive (EU) 2016/1148

text: of the European Parliament and of the Council into Slovenian legislation. It lays down a framework the aim of which is to ensure that appropriate information systems-related security measures are taken to prevent, notify and react to cyber incidents. The Law on information security designates the national security incident response teams and their tasks, and sets up the national competent authority for information security (hereinafter the ‘national information security authority’), which also acts as a single point of contact on information security. It also lays down the competences and duties of the national information security authority and provides to it and its inspectors the powers and means to enforce compliance by the providers of relevant services.

text: 1.2 The Law on information security applies to the following service providers: (i) operators of essential services; (ii) digital service providers; and (iii) state administration authorities managing information systems and providing information services necessary for the smooth functioning of the State and for safeguarding national security. As regards the operators of essential services, it foresees that this will include entities operating in the relevant sectors as specified by the Law, including, inter alia, banking and financial market infrastructures. The Law empowers the Government to designate individual entities as operators of essential services. First, however, it requires the Government to draw up a more detailed list of essential services from the relevant sectors, and to specify in more detail the methodology for the designation of the operators of those services . It is the purpose of the draft decree to address these elements. 1.3 As regards the detailed list of services, the draft decree lists individual services using the standard classification of activities. In the banking sector the draft decree specifies the following services : (i) ‘central banking’ (acting as banker for the government sector, including with regard to subaccounts for pension, health and social insurance); (ii) ‘other monetary intermediation’ (acceptance of deposits and granting of loans by banks, savings banks and credit unions); and (iii) ‘other activities auxiliary to financial services, except insurance and pension funds’ (the activity of processing financial transactions and settlement activity, including credit card transactions and payment transactions). In the financial market infrastructures sector the draft decree specifies the following: (i) ‘administration of financial markets’ (operating and supervising financial markets other than by State authorities: collective safekeeping of securities, determining and executing obligations arising from securities transactions and maintaining a central register of holders of book-entry securities); and (ii) ‘securities brokerage’ (trading in securities traded on a trading venue pursuant to the law governing the market in financial instruments and related activities, and securities brokerage). 1.4 The draft decree explicitly states that it (i) does not apply to services the provision of which depends on information systems operated by the European System of Central Banks (ESCB); (ii) does not apply to services the provision of which depends on information systems operated by Banka Slovenije which are supervised by the ESCB; and (iii) is without prejudice to the supervision of information systems falling within the competence of Banka Slovenije or the ESCB governed by laws of the European Union or by laws of the Republic of Slovenia adopted on the basis of Union laws . Further, the draft decree provides that the designation of individual entities as operators of essential services in the banking sector requires the prior consent of Banka Slovenije if the provision of such services depends on information systems of Banka Slovenije which are not information systems excluded by the draft decree as described in points (i) and (ii) above and which are used by Banka Slovenije for the performance of its tasks pursuant to the Law on Banka

text: Slovenije , the Statute of the European System of Central Banks and of the European Central Bank (hereinafter the ‘Statute of the ESCB’) and Union laws . 1.5 In addition to any designation of operators of essential services on the basis of the draft decree as described above, the Law on information security also requires the Government to designate as operators of essential services the operators of critical infrastructures designated pursuant to the 9 10 Law on critical infrastructures , .

text: 2 General observations

text: 2.1 As previously noted , the ECB supports the aim of

text: Directive (EU) 2016/1148

text: of ensuring a high common level of network and information security across the Union and of achieving a consistent approach in this field across business sectors and Member States. It is important to ensure that the internal market is a safe place to do business and that all Member States have a certain minimum level of preparedness for cybersecurity incidents . 2.2 As regards specific provisions of the draft decree concerning information systems operated or ‘supervised’ by Banka Slovenije and/or the ESCB as described in paragraph 1.5, the ECB understands that the term ‘supervision’ (Slovene: nadzor) as used in the draft decree includes both ‘supervision’ and ‘oversight’. Under Slovenian law the term ‘supervision’ may be understood as referring to the concepts of both ‘supervision’ and ‘oversight’, as those terms are understood in, for example, the English language.

text: 3 Impact of the draft decree on systemically important payment systems (SIPS) and TARGET2-Securities

text: 3.1 The ECB in its oversight role, on the basis of Articles

text: and

text: and the first indent of Article 34.1 of the Statute of the ESCB, adopted

text: Regulation (EU) No 795/2014

text: . This Regulation implements the Principles for financial market infrastructures (PFMIs) issued by the Committee on Payment and Settlement Systems (CPSS) and the International Organization of Securities Commissions (IOSCO) in a legally binding manner. It recently introduced a number of new requirements for SIPS operators addressing new risks, including those related to operational and security risks

text: (such as cyber resilience) , taking into account, inter alia, the Committee on Payments and Market Infrastructures (CPMI)-IOSCO Guidance on cyber resilience for financial market infrastructures which was published in 2016 . Among listed SIPS, TARGET2 plays a distinct role, as it is owned and operated by the Eurosystem and subject to strict regulation and oversight. 3.2 The ECB understands, on the basis of

text: Article 2(1)

text: and (2) of the draft decree, which exempts services provided using information systems operated by the ESCB or operated by Banka Slovenije and supervised or overseen by the ESCB from the scope of the draft decree, that such services are, consequently, also exempt from the scope of the Law on information security. The ECB welcomes this, as it should help to ensure that the Slovenian legislation on information security does not encroach on the ESCB’s competences, consistent with the principles of the primacy of Union law and of central bank independence pursuant to Article 130 of the Treaty . 3.3 In particular, the ECB understands that, on the basis of Article 2(1) of the draft decree, TARGET2- Securities (T2S) services would be exempt from the scope of the relevant legislation, since pursuant to Article 6 of Guideline ECB/2012/13 of the European Central Bank and Article 7 of the T2S Framework Agreement , T2S is operated by the ESCB. Further, in line with the Governing Council’s decision in its Eurosystem oversight policy framework (revised version of July 2016) , T2S falls under Eurosystem oversight competences under Articles 127(2) of the Treaty and Articles 3(1) and 22 of the Statute of the ESCB. 3.4 The ECB also understands that, on the basis of Article 2(2) of the draft decree, the Slovenian component of TARGET2 is exempt from the scope of the draft decree and the Law on information security, since Banka Slovenije acts as the operator of that component. TARGET2 has been identified, pursuant to Decision ECB/2014/35 of the European Central Bank , as a SIPS and is overseen by the ECB as competent authority under

text: Regulation (EU) No 795/2014

text: . 3.5 The ECB understands that Article 2(3) of the draft decree aims to limit the impact of the draft decree on supervision or oversight which is performed by Banka Slovenije or ESCB central banks on the basis of Union law such that any designation of operators of essential services pursuant

text: to the draft decree, and the consequential application of the Law on information security to such designated operators, will be without prejudice to the performance of that supervision or oversight. In addition to exempting the Slovenian component of TARGET2 from the scope of the Law on information security, the ECB understands that, on the basis of

text: Article 2(3)

text: , the relevant Slovenian legislation will not encroach on the Eurosystem’s competences in the field of SIPS, including through any supervisory powers of the national information security authority and its inspectors under the Law on information security.

text: 4 Impact of the draft decree on non-SIPS

text: 4.1 Non-SIPS include non-systemically important large-value payment systems (LVPS) and nonsystemically important retail payment systems (non-SIRPS). Under the revised oversight framework for retail payment systems non-SIRPS have been divided into two distinct groups: prominently important retail payments systems (PIRPS) and other retail payments systems (ORPS). The Slovenian local retail clearing and payment systems have been classified as PIRPS or ORPS and the ECB understands that in the present case, as their services are of the type included in the list of essential services pursuant to the draft decree, the operators of those systems or some of them might be designated as operators of essential services, thereby falling within the Law on information security and becoming subject to the supervisory measures of the national information security authority and its inspectors. 4.2 Under the Eurosystem’s oversight policy framework, non-systemically important LVPS and non- SIRPS must follow the CPSS-IOSCO PFMIs and non-SIRPS must additionally follow the oversight expectations for links between retail payment systems (OELRPS) . Both the CPSS-IOSCO PFMIs and the OELRPS are soft law instruments, meaning that non-systemically important LVPS, PIRPS and ORPS are subject to oversight standards (which are comparable to the standards under

text: Regulation (EU) No 795/2014

text: ), however there is, strictly speaking, no Union legislation regulating the oversight or supervision of these systems . Banka Slovenije is given supervisory and oversight competence over non-SIPS pursuant to the Law on payment services, services concerning issuing electronic money and payment systems , which in this particular matter does not implement Union ‘laws’ as described in this paragraph 4.2 above . 4.3 The Revised oversight framework for retail payment systems specifies that all retail payment systems are an integral part of the payment and settlement landscape of the euro area and thus fall within the scope of oversight. Hence, the Eurosystem has an interest in ensuring that the oversight framework and standards applicable to such systems are not prejudiced through the implementation of

text: Directive (EU) 2016/1148

text: or when introducing other network and information

text: security-related laws . 4.4 If it is intended that non-SIPS are excluded from the scope of the draft decree and the Law on information security, the ECB suggests that, in the interest of legal certainty, it is explicitly clarified that the relevant legislation does not encroach on the oversight of non-SIPS by Banka Slovenije or the ESCB that are subject to applicable oversight frameworks, guidelines and principles. If the Slovenian authorities, however, consider it necessary to include non-SIPS within the scope of the draft decree and the Law on information security, it notes that

text: Article 27(2)

text: (5) of the Law on information security foresees that the national information security authority cooperates with the regulators and supervisors of the sectors in which the respective essential services are provided. The ECB suggests that, in applying this, effective information-sharing and cooperation arrangements are put in place to ensure that the national information security authority shares information about actual and potential cyber incidents as well as measures planned or adopted by the national information security authority which affect non-SIPS with Banka Slovenije in a timely and efficient manner in order to enable Banka Slovenije to fulfil its tasks under the Treaty and Slovenian law. It would, in any case, be advisable to clarify the exact scope of the draft decree and the Law on information security and the supervisory powers of the national information security authority and its inspectors in relation to non-SIPS to avoid potential confusion on the applicable standards and the powers of the relevant authorities .

text: 5 Impact of the draft decree on critical service providers

text: The revised Eurosystem oversight policy framework covers critical service providers. Similar to the case of non-SIPS, it cannot be excluded that the draft decree and the supervisory powers of the national information security authority could cover critical service providers for which the applicable oversight measures, insofar as soft law instruments, would not be considered Union laws within the meaning of Article 2(3) of the draft decree. It is therefore suggested that the Slovenian authorities take existing oversight arrangements into consideration in their application of the Law on information security, if such application would affect critical service providers .

text: 6 Impact of the draft decree on payment services and payment instruments and schemes

text: 6.1 The Eurosystem oversight policy framework identifies payment instruments, such as cards, credit transfers, direct debit and electronic money, as an ‘integral part of payment systems’, and thus includes these within the scope of its oversight. For payment instruments, the role of primary overseer (for the Eurosystem) is assigned by reference to the national anchor of the payment scheme and the legal incorporation of its governance authority. For credit transfer and direct debit schemes within the Single Euro Payments Area, as well as some of the international card payment schemes, the ECB has the primary oversight role. Payment service providers (PSPs) are subject

text: to

text: Directive (EU) 2015/2366

text: of the European Parliament and of the Council , which is applicable as of January 2018, as implemented into national law. While PSPs are therefore subject to Union and Slovenian legislation (including regulations based on Union legislation), the oversight of international and domestic card schemes is not subject to Union legislation as such . 6.2 It is not fully clear to the ECB if various payment schemes and instruments are covered by the type of services listed in the draft decree as ‘other activities auxiliary to financial services, except insurance and pension funds’. It is thus suggested that the same clarification, effective informationsharing and cooperation framework as mentioned in paragraph 4.4 are provided and put in place in relation to and between the authorities responsible for the oversight of payment schemes, instruments and services and the national information security authority .

text: 7 Impact of draft decree on central securities depositories (CSDs)

text: 7.1 CSDs are strictly regulated and supervised by different authorities pursuant to

text: Regulation (EU) No 909/2014

text: of the European Parliament and of the Council , which sets out requirements pertaining to operational risk. Furthermore, CSDs should take note of the CPMI-IOSCO Cyber Guidance, which is applicable to all financial market infrastructures. 7.2 In addition to the supervisory competences entrusted to national competent authorities (NCAs) under

text: Regulation (EU) No 909/2014

text: , it should be noted that national authorities, in particular the members of the ESCB, may be entrusted with oversight competences in relation to CSDs. In this regard,

text: recital 8

text: of

text: Regulation (EU) No 909/2014

text: states that the Regulation should be without prejudice to the responsibilities of the ECB and the national central banks to ensure efficient and sound clearing and payment systems within the Union and other countries and that the Regulation should not prevent the members of the ESCB from accessing information relevant for the performance of their duties, including the oversight of CSDs and other financial market infrastructures. 7.3 KDD d.d., the Slovenian CSD, is supervised by Banka Slovenije and the Slovenian Securities Market Agency and overseen by Banka Slovenije . While KDD appears to be covered by the type of services listed in the draft decree, such as collective safekeeping of securities, determining and executing obligations arising from securities transactions and maintaining a central register of

text: holders of book-entry securities, the ECB understands that the Law on information security should be without prejudice to the supervision and oversight of the KDD, given that such supervision and oversight is performed on the basis of Union legislation. The draft decree should, however, be amended to clarify that the national information security authority’s responsibilities are without prejudice to and are aligned with the tasks not only of Banka Slovenije but also of the Securities Market Agency.

text: 8 Impact of draft decree on credit institutions

text: 8.1 Pursuant to Article 2(3) of the draft decree, the draft decree is without prejudice to the supervision of information systems falling within the competence of Banka Slovenije or of the ESCB. Thus, the ESCB’s competence under Union law and the supervision of information systems under Banka Slovenije’s competence should not be affected by the draft decree. However, the ECB understands that some credit institutions established in Slovenia can be designated as operators of essential services, and thus would need to comply with their obligations under the Law on information security. Against this background, the following points are noted. 8.2

text: Council Regulation (EU) No 1024/2013

text: confers tasks on the ECB concerning the prudential supervision of credit institutions with a view to contributing to their safety and soundness and in order to protect the stability of the financial system of the Union and each Member State. The ECB is responsible for the effective and consistent functioning of the Single Supervisory Mechanism (SSM) and exercises oversight over the SSM’s functioning, based on a distribution of responsibilities between the ECB and NCAs, including Banka Slovenije. In particular, the ECB carries out its task of authorising and withdrawing the authorisations of all credit institutions. For significant credit institutions the ECB also has the task, among others, of ensuring compliance with relevant Union law imposing prudential requirements on credit institutions, including the requirement to have in place robust governance arrangements, including sound risk management processes and internal control mechanisms . To this end, the ECB is given all supervisory powers to intervene in the activity of credit institutions that are necessary for the exercise of its functions . 8.3 The prudential supervision of credit institutions also covers topics related to cybersecurity and the protection of infrastructures relevant for the operation of credit institutions as part of the prudential supervision of operational risk, meaning the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events . In this respect, the ECB has the power, among others, to restrict or limit the business, operations or network of an institution or to request the divestment of activities that pose excessive risks to the soundness of an institution . Since the

text: assessment of the adequacy of the internal governance arrangements of credit institutions is one of the core competences of prudential supervisors, the draft decree and the requirements under the Law on information security should not interfere with the tasks that prudential supervisors carry out in this respect . 8.4 Under the Law on information security, the national information security authority has a range of powers to address cybersecurity incidents. In particular, it may, in the case of a major or critical cybersecurity incident and cyber attack or a threat thereof, impose such relevant and proportionate measures on the addressees of the Law as are deemed necessary and proportionate to prevent the continuation of an ongoing incident or the realisation of a threatening incident and to eliminate the consequences of incidents and to limit the expected consequences of a threat thereof . The inspectors of the national information security authority, when enforcing compliance with the Law, may also impose measures to eliminate any identified shortcomings . They may also prohibit providers of essential services from using their information system until established shortcomings have been eliminated, but only in extreme cases, and taking into account the significance of the sector in which they are operating and of their system and activities, if such a measure does not threaten supply in an individual sector or the provision of their services . 8.5 It is acknowledged that the tasks of the ECB and Banka Slovenije as prudential supervisors are in a number of critical respects distinct from the tasks and competences of national security incident response teams and the national information security authority. Nevertheless, there could be an overlap where the actions of the latter could affect the prudential supervision of credit institutions under Union and Slovenian law. This would be most evident if the national information security authority and its inspectors chose, when using their powers under the Law on information security, to restrict the use of an information system. If the use of an information system used by a significant credit institution for the provision of payment services was restricted, this could significantly impact the continuous operation and financial standing of the institution. Additionally, informing the affected persons or the general public about cyber incidents could have an impact on public confidence in the affected institution. The ECB and the NCAs within the SSM are responsible for the assessment of recovery plans and taking early intervention measures under Directive

text: of the European Parliament and of the Council . Further, the primary responsibility for determining that a significant credit institution is failing or likely to fail as a condition for resolution lies with the ECB . In the case of resolution, one of the resolution

text: objectives is to ensure the continuity of critical functions , which can include the continuing functioning of the credit institution’s payment function . 8.6 Under the Law on information security administrative pecuniary sanctions may also be imposed where the relevant service providers do not comply with their obligations under the Law . 8.7 In the light of the above, and since Article 2(3) of the draft decree currently only refers to the ESCB’s competences under Union law and to the supervision of information systems (and not the supervision of credit institutions), the ECB suggests clarifying that the scope of the Law on information security and any powers granted to the competent authorities thereunder are also without prejudice to the competences, tasks and powers of the ECB (and Banka Slovenije) under

text: Regulation (EU) No 1024/2013

text: and Slovenian law . To enable the ECB and Banka Slovenije to fulfil their tasks within the SSM, the ECB also recommends that an effective framework should be put in place to ensure that the national information security authority shares information about actual and potential cyber incidents affecting significant supervised entities, as well as measures planned or adopted by it. Where relevant, the national information security authority should share information with Banka Slovenije and, through Banka Slovenije, with the ECB in a timely and efficient manner. The Slovenian legislator may also wish to consider the interaction of the national information security authority’s powers under the Law on information security with the resolutionrelated procedures and powers of the relevant authorities .

text: 9 Other information systems of Banka Slovenije

text: Article 6(4)

text: the draft decree relates to information systems of Banka Slovenije which are not operated by the ESCB, nor by Banka Slovenije under the supervision of the ESCB, but which are used by Banka Slovenije for the discharge of its duties pursuant to the Law on Banka Slovenije, the Statute of the ESCB or Union legislation. The ECB understands that an example of an information system that would fall within the scope of this provision is the infrastructure for the maintenance of the treasury account system, which Banka Slovenije uses to maintain the accounts of State bodies . On the basis of the explanatory memorandum to the draft decree which clarifies that the relevant provision is similar in its purpose to the equivalent provision in the Law on critical infrastructures as regards Banka Slovenije’s critical infrastructures, the ECB assumes that the intention of the legislator in drafting

text: Article 6(4)

text: was to require Banka Slovenije’s consent before any relevant decisions can be adopted under the Law on information security relating to any information system that falls within the scope of this provision, in particular the system for the maintenance of the treasury account system. As

text: Article 6(4)

text: is drafted unclearly its wording should be reviewed in the interest of legal certainty.

text: 10 Miscellaneous

text: For the sake of legal certainty it should be ensured that the exemptions and safeguards laid down in the draft decree also apply to operators of critical infrastructures in their capacity as operators of essential services. This opinion will be published on the ECB’s website. Done at Frankfurt am Main, 8 November 2018. [signed]

text: The President of the ECB

text: Mario DRAGHI

type: vagledning

utgivare: ecb


text: Council Decision 98/415/EC of 29 June 1998

text: on the consultation of the European Central Bank by national authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42). 3 See the website of the MNB at www.mnb.hu.

text: See ECB Opinion

text: , ECB Opinion

text: and ECB Opinion

text: . All ECB opinions are available on the ECB’s website at www.ecb.europa.eu. 6 Article 282(4) of the Treaty and Article 42.2 of the Statute of the European System of Central Banks and of the European Central Bank. 7 See ‘Instant Payments – a Winning Bet?’ available on the European Payments Council’s website at www.europeanpaymentscouncil.eu.

text: Guideline

text: (EU) 2017/2082

text: of the European Central Bank of 22 September 2017 amending Guideline ECB/2012/27 on a Trans-European Automated Real-time Gross settlement Express Transfer system (TARGET2) (ECB/2017/28) (OJ L 295, 14.11.2017, p. 97). 9 For further information, see the ECB website at https://www.ecb.europa.eu. 10 See the website of the Bank for International Settlements at https://www.bis.org/cpmi/publ/d101a.pdf.

title: Opinion of the European Central Bank of 8 November 2018 on the minimum reserve requirements of the Magyar Nemzeti Bank (CON/2018/48)

text: OPINION OF THE EUROPEAN CENTRAL BANK of 8 November 2018 on the minimum reserve requirements of the Magyar Nemzeti Bank (

text: ) Introduction and legal basis

text: On 3 September 2018 the European Central Bank (ECB) received a request from the Magyar Nemzeti Bank (MNB) for an opinion on a draft decree of the Governor of the Magyar Nemzeti Bank (hereinafter the ‘draft decree’) amending the MNB decree on the calculation, the method of allocation and placement of the minimum reserves (hereinafter the ‘MNB decree’). On 16 October 2018, the ECB received a further request from the MNB on supplemental provisions contained in the draft decree. The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and

text: Article 2(2) of Council Decision 98/415/EC

text: , as the draft decree relates to draft legislative provisions on the instruments of monetary policy of a Member State whose currency is not the euro. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

text: 1. Purpose of the draft decree

text: 1.1 The MNB decided in 2016 to launch an instant payment system in Hungary on 1 July 2019 with the intention to make payments available between Hungarian payment accounts within 5 seconds, 24 hours a day, seven days a week and 365 days a year. GIRO Zrt., a company wholly owned by the MNB, will develop the central infrastructure for the system and provide for the clearing and settlement of transactions between payment service providers. The system will ensure instant and final settlement of payments between payment service providers by pre-funding payment orders using deposits made by the payment service providers into a ‘custody account’ opened by the MNB and operated by GIRO Zrt. . 1.2 The draft decree amends the MNB decree to take into account this development in the context of the MNB’s minimum reserves system. Under the draft decree, a credit institution may fully or partly include its share in the funds held in the custody account in its minimum reserve holdings. The draft decree provides that if a credit institution wishes to comply with its minimum reserve requirements in this manner, it is required to notify to the MNB the amount of its custody account balance that it intends to use for this purpose.

text: 1.3 The draft decree also introduces provisions regulating the manner in which the MNB may modify the previously determined required reserves when a credit institution modifies its statistical balance sheet after the preliminary determination of the reserve requirement. 1.4 The draft decree also repeals certain provisions of the MNB Decree on the requirements of business regulations and other regulations in respect of payment system operators , which provide that the prices applied by GIRO Zrt. have to be set for each service provided by it in a way that enables participants to decide whether they wish to use the given service.

text: 2. General observations

text: 2.1 The ECB understands that, under the instant payment system proposed by the MNB, each participant can decide at the end of each day which portion of its custody account balance is to be considered as fulfilling its minimum reserve requirements. The amount communicated to the MNB by each participant for the purpose of fulfilling its minimum reserve requirements would be remunerated at the MNB interest rate applicable to holdings of reserve requirements, i.e. the base rate. Any remaining amount of the custody account balance pertaining to a participant in excess of those counted as reserve holdings would not be regarded as excess reserves, which are currently remunerated at the MNB’s overnight deposit facility rate minus 15 basis points. As a necessary precondition for the above arrangements, the ECB understands that GIRO Zrt. would report to the MNB each participant’s share in the total balance of the custody account. The ECB understands that this set-up is aimed at supporting the liquidity management of the banking sector following the introduction of the instant payment system. 2.2 The ECB has noted in earlier opinions that Member States whose currency is not the euro retain their powers in the field of monetary policy according to national law . In those opinions, the ECB noted that, once the euro is introduced, Hungary’s monetary policy will need to be consistent with the Eurosystem’s operational framework and credit institutions should therefore be familiar with the requirements that would apply to them once the single monetary policy is implemented in Hungary. 2.3 The treatment of funds held in a central bank account in relation to the operation of an instant payment system for the purpose of applying minimum reserve requirements is necessarily determined by the monetary policy framework of the relevant central bank, as well as by the features of the particular instant payment solution. In this respect, instant payments are a relatively new development . Developments in the area of instant payments are dynamic due to continuous innovation in the payments industry. Central banks are involved in ongoing dialogue with stakeholders from the payments industry and facilitate instant payments solutions, inter alia by providing services supporting the settlement of instant payments. In the euro area, the Eurosystem has been involved in facilitating the emergence of instant payments, in order to foster innovation

text: and integration in this field. In 2017, the Eurosystem introduced a service supporting the emergence of instant payments, a new settlement procedure for ancillary systems known as ‘settlement procedure 6 real-time’ . Also, in 2017 the ECB decided to develop the new TARGET Instant Payment Settlement (TIPS) service, which will enable the settlement of individual instant payment orders in central bank money 24 hours a day, seven days a week and 365 days a year, with immediate or close to immediate processing. TIPS is scheduled to start operating in November 2018 . 2.4 As regards the amendments to the rules for pricing of services provided by GIRO Zrt., the ECB understands that in the future GIRO Zrt. could set a ‘package-based’ fee for the use of the services it offers, and would thus no longer be required to apply prices for each of its services separately. The ECB notes that according to the Principles for financial market infrastructures (PFMI) issued by the Committee on Payment and Settlement Systems and the International Organization of Securities Commissions , financial market infrastructures should in principle publicly disclose their fees for the individual services that they offer, with the aim to enable participants to compare the costs to those of alternative arrangements. Against this background, the ECB understands that the MNB, as the overseer of payment systems in Hungary, assessed the application of a packagebased fee against the PFMI as unproblematic, in the absence of alternative arrangements.

text: This opinion will be published on the ECB’s website.

text: Done at Frankfurt am Main, 8 November 2018.

text: [signed]

text: The President of the ECB

text: Mario DRAGHI


text: on the consultation of the European Central Bank by national authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42).

text: Council Regulation (EU) No 1024/2013 of 15 October 2013

text: conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63).

text: Decision ECB/2014/5 of the European Central Bank of 31 January 2014 on the close cooperation with the national competent authorities of participating Member States whose currency is not the euro (OJ L 198, 5.7.2014, p. 7).

text: Published in Darjaven Vestnik No 59, 21 July 2006.

text: See Article 44 of the Law on BNB.

title: Opinion of the European Central Bank of 9 November 2018 on national legislation to be adopted for the purpose of establishing close cooperation between the European Central Bank and Българска народна банка (Bulgarian National Bank) (CON/2018/49)

text: OPINION OF THE EUROPEAN CENTRAL BANK of 9 November 2018 on national legislation to be adopted for the purpose of establishing close cooperation between the European Central Bank and the Bulgarian National Bank (

text: ) Introduction and legal basis

text: On 18 July 2018 the European Central Bank (ECB) received a first request from the Minister of Finance for an opinion on a draft law amending the Law on credit institutions, the Law on the Bulgarian National Bank and the Law on recovery and resolution. On 11 October 2018, the ECB received a second request from the Minister of Finance for an opinion on a revised draft law amending the Law on credit institutions and the Law on the Bulgarian National Bank (hereinafter the ‘draft law’). The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and the third and sixth indents of

text: Article 2(1) of Council Decision 98/415/EC

text: , as the draft law relates to Българска народна банка (Bulgarian National Bank (BNB)), rules applicable to financial institutions insofar as they materially influence the stability of financial institutions and markets and the ECB’s tasks concerning the prudential supervision of credit institutions pursuant to Article 127(6) of the Treaty. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

text: 1. Purpose of the draft law

text: 1.1 Introduction The draft law has been prepared in the broader context of the request filed on 18 July 2018 by the Republic of Bulgaria to establish close cooperation between the ECB and BNB, in line with the existing procedures established under

text: Article 7 of Council Regulation (EU) No 1024/2013

text: (hereinafter the ‘SSM Regulation’) and under Decision ECB/2014/5 of the European Central Bank on close cooperation . In this respect, the draft law introduces changes to national legislation to comply with the prerequisites for the establishment of close cooperation between the ECB and the national competent authority (NCA) of a Member State whose currency is not the euro, in order to allow the ECB to carry out its tasks concerning the prudential supervision of credit institutions established in that Member State.

text: 1.2 Role of the ECB and BNB once close cooperation is established The draft law introduces a new Chapter 11a into the Law on credit institutions in order to ensure that BNB will abide by guidelines or requests issued by the ECB, and will take the necessary measures to implement the ECB’s legal acts adopted pursuant to the SSM Regulation, including by issuing the necessary administrative acts. The draft law further specifies that BNB will issue individual administrative acts only upon a request of the ECB, and in full compliance with such request, for the exercise of supervisory tasks with respect to significant credit institutions and in the context of common procedures, while for the exercise of supervisory tasks with respect to less significant credit institutions BNB will issue such administrative acts in compliance with ECB requests to the extent that the ECB has made such requests. The draft law requires BNB to notify the ECB of such administrative acts without undue delay. The draft law also refers to the exercise of macroprudential tasks under Article 5 of the SSM Regulation, and specifies that BNB will comply with ECB requests for the application of higher requirements for capital buffers or the application of more stringent measures aimed at addressing systemic or macroprudential risks. 1.3 Exchange of confidential information The draft law introduces amendments to both the Law on credit institutions and the Law on BNB that aim to ensure that, for the purposes of the exchange of information within the framework of close cooperation established with the ECB under the SSM Regulation, BNB will provide the ECB with all necessary information for the performance of the ECB's tasks under the SSM Regulation, including information that is covered by bank and professional secrecy. 1.4 Supervisory fees The draft law supplements the Law on BNB by introducing the obligation for BNB to collect annual fees in order to cover its own administrative expenses related to the supervision and resolution of credit institutions in accordance with a BNB ordinance. 1.5 BNB governance The draft law replaces the current provision in the Law on BNB that provides for the Deputy Governor of BNB in charge of banking supervision to exercise supervision in accordance with the rules provided for by law and the regulations for its enactment , with a provision that supervision over the banking system will be exercised by the Deputy Governor under the terms and conditions of close cooperation with the ECB. The draft law amends the provisions in the Law on BNB concerning the BNB Governing Council’s powers to clarify that the following powers, in respect of credit institutions, will be carried out in accordance with the close cooperation established with the ECB under Article 7 of the SSM Regulation: (i) to grant, refuse and withdraw the licences of credit institutions; (ii) to apply supervisory measures and early intervention measures; (iii) to grant approval, permission and consent in the cases provided for under national and Union law. In addition the draft law provides that once close cooperation is established, the rules on the

text: independence of BNB, the Governor and the members of the BNB Governing Council do not apply to the ECB in carrying out its tasks pursuant to the SSM Regulation. 1.6 Provision of information for the purpose of conducting comprehensive assessment of credit

text: The draft law introduces a new paragraph 13a to the transitional and final provisions of the Law on credit institutions that creates an obligation for credit institutions established in the Republic of Bulgaria to provide the ECB, and any third parties that carry out activities on behalf of the ECB, with all necessary information in connection with ECB assessments that are required for participation in the Single Supervisory Mechanism. In particular, credit institutions will be obliged to provide information to the ECB and to allow the ECB to access their accounting registers and systems. Credit institutions will also be obliged to allow the ECB to access their premises, and those of consolidated entities, to conduct on-site examinations. 1.7 Fines and penalties The draft law provides that the administrative penalty provisions of the Law on credit institutions will apply in respect of requests issued by the ECB for the imposition of pecuniary sanctions or fines in the context of close cooperation. 1.8 Termination of close cooperation The draft law provides that the close cooperation provisions of the Law on credit institutions will cease to apply (1) from the date of termination of close cooperation pursuant to Article 7 of the SSM Regulation or (2) from the date on which the derogation pursuant to Article 139 of the Treaty is abrogated in respect of the Republic of Bulgaria in accordance with Article 140(2) of the Treaty.

text: 2. General observations

text: 2.1 The ECB welcomes the draft law as part of the process leading to the establishment of close cooperation between the ECB and BNB pursuant to Article 7 of the SSM Regulation. The ECB notes that the request and adoption of this opinion are necessary on the basis of

text: Article 2

text: and

text: Article 3(2)

text: (b) of Decision ECB/2014/5. 2.2 It is highlighted that, pursuant to Article 7(2) of the SSM Regulation and

text: Article 3(2)

text: (b) of Decision ECB/2014/5, the scope of this opinion pertains to the national legislation to be adopted by the Republic of Bulgaria to ensure that legal acts adopted by the ECB pursuant to the SSM Regulation are binding and enforceable in the Republic of Bulgaria and that BNB is obliged to adopt any measure requested by the ECB in relation to the supervised entities in accordance with Article 7(4) of the SSM Regulation. 2.3 This opinion is without prejudice to the assessment to be conducted by the ECB in accordance with Article 4 of Decision ECB/2014/5, which will include a broader assessment of the relevant national legislation, also taking into account the practical implementation of such legislation.

text: 3. Observations regarding close cooperation between ECB and BNB

text: 3.1 Establishment and termination of close cooperation 3.1.1 The ECB welcomes the introduction of a new Chapter 11a into the Law on credit institutions, aimed at addressing in a cohesive manner several aspects related to the establishment and operation of close cooperation with the ECB. In particular, it is understood that the new Chapter 11a will be read in accordance with the other provisions of the Law on credit institutions, so that the exercise of prudential supervision over credit institutions established in the Republic of Bulgaria will take place under the framework provided for in the SSM Regulation. 3.1.2 The ECB also welcomes that the application of the new Chapter 11a will be linked to the duration of the close cooperation between the ECB and BNB, starting from the date on which close cooperation will begin as indicated in the ECB decision establishing close cooperation, until termination of close cooperation either under Article 7 of the SSM Regulation or from the date on which the derogation pursuant to Article 139 of the Treaty is abrogated in respect of the Republic of Bulgaria in accordance with Article 140(2) of the Treaty. This approach will facilitate the transition from one system to the other and will ensure clarity with respect to the applicable legal framework before, during and after close cooperation. 3.2 Role of the ECB and BNB once close cooperation is established 3.2.1 In order to ensure that supervised entities and groups established in a Member State in close cooperation will be in a position comparable to supervised entities and groups established in euro area Member States, Article 7 of the SSM Regulation sets as a precondition for the establishment of close cooperation that the requesting Member State ensures that its NCA abides by any guidelines or requests issued by the ECB and that it adopts the relevant national legislation to ensure that its NCA will be obliged to adopt any measure in relation to credit institutions requested by the ECB. This requirement is further specified under

text: Article 3(2)

text: (a) of the Decision ECB/2014/5, which provides that the relevant national legislation has to ensure that acts adopted by the ECB under the SSM Regulation are binding and enforceable. 3.2.2 Against this background, the ECB welcomes the provisions of the draft law that ensure that BNB will abide by guidelines or requests issued by the ECB, and will take the necessary measures, including issuing individual administrative acts, to implement the ECB’s legal acts adopted pursuant to the SSM Regulation. In particular, the ECB understands that the provisions of the draft law aim to ensure compliance with the abovementioned requirements and that the ECB is able to exercise its supervisory tasks under the framework of close cooperation. 3.2.3 In addition, the ECB welcomes the clarification in the draft law on the exercise of supervisory tasks in respect of significant and less significant credit institutions, especially that BNB will act only upon the ECB’s request for the supervision of significant credit institutions and in the context of common procedures. 3.3 BNB governance The provisions of the draft law relating to the governance of BNB enhance clarity and ensure consistency in BNB’s governance, by providing that BNB’s supervisory tasks will be performed under the framework of the established close cooperation with the ECB.

text: 3.4 Exchange of information The ECB welcomes the provisions of the draft law relating to the exchange of information under the framework established by the SSM Regulation which will ensure that no uncertainty will arise as to the regime applicable to the exchange of information in the context of close cooperation. 3.5 Supervisory fees Regarding the possibility for BNB to collect annual fees from supervised entities, notably in relation to banking supervision, it is understood that this provision of the draft law falls under the scope of Article 30(5) of the SSM Regulation, namely the right of NCAs to levy fees in accordance with national law, to the extent that supervisory tasks have not been conferred on the ECB, or in respect of costs of cooperating with and assisting the ECB and acting on its instructions. 3.6 Provision of information for the purpose of conducting comprehensive assessment of credit

text: 3.6.1 The ECB understands that the draft law aims to ensure compliance with the undertaking of the Republic of Bulgaria to provide the ECB with all information on credit institutions established in that Member State that the ECB may require for the purpose of carrying out a comprehensive assessment of those credit institutions, in line with

text: Article 7(2)

text: (b) of the SSM Regulation. In particular, it is understood that the consulting authority is fulfilling this undertaking by imposing obligations directly upon credit institutions. 3.6.2 Nonetheless, it is stressed that this approach should not be read as affecting the position of the ECB in relation to Bulgarian credit institutions or as conferring powers on the ECB which may go beyond what is provided for under the SSM Regulation. As mentioned above, even after the establishment of close cooperation, BNB will remain the authority responsible for adopting decisions addressed to Bulgarian credit institutions. It is understood that this will also be the case for the purpose of the assessments necessary to establish close cooperation, in line with the Treaty and the SSM Regulation.

text: Done at Frankfurt am Main, 9 November 2018.

text: [signed]

text: The President of the ECB

text: Mario DRAGHI


text: Council Decision 98/415/EC of 29 June 1998

text: on the consultation of the European Central Bank by national authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42).

text: Ustawa z dnia 21 lipca 2006 r. o nadzorze nad rynkiem finansowym (Dz. U. z 2018 r. poz. 621, z późn. zm.).

text: Directive

text: of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive

text: and repealing Directives

text: and

text: (OJ L 176, 27.6.2013, p. 338).

text: Regulation (EU) No 575/2013

text: of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending

text: Regulation (EU) No 648/2012

text: (OJ L 176, 27.6.2013, p. 1).

text: Council Regulation (EC) No 2533/1998 of 23 November 1998

text: concerning the collection of statistical information by the European Central Bank (OJ L 318, 27.11.1998, p. 8).

text: Ustawa z dnia 5 sierpnia 2015 r. o nadzorze makroostrożnościowym nad systemem finansowym i zarządzaniu kryzysowym w systemie finansowym, Dz.U. 2015 poz. 1513.

text: The law on the macroprudential oversight implemented Recommendation

text: of the European Systemic Risk Board of 22 December 2011 on the macro-prudential mandate of national authorities (OJ C 41, 14.2.2012, p. 1.). See also ECB Opinion

text: See, e.g., paragraph 2 of ECB Opinion

text: . All ECB opinions are published on the ECB’s website at www.ecb.europa.eu.

text: Committee on Payment andSettlement Systems and the Technical Committee of the International Organization of Securities Commissions (IOSCO), Principles for financial market infrastructures, particularly Principle 11: ‘A CSD should have appropriate rules and procedures to help ensure the integrity of securities issues and minimise and manage the risks associated with the safekeeping and transfer of securities. A CSD should maintain securities in an immobilised or dematerialised form for their transfer by book entry.’

text: Regulation (EU) No 909/2014

text: of the European Parliament and of the Council of 23 July 2014 on improving securities settlement in the European Union and on central securities depositories and amending Directives

text: and

text: and

text: Regulation (EU) No 236/2012

text: (OJ L 257, 28.8.2014, p. 1).

title: Opinion of the European Central Bank of 9 November 2018 on the strengthening of financial supervision and investor protection (CON/2018/50)

text: OPINION OF THE EUROPEAN CENTRAL BANK of 9 November 2018 on the strengthening of financial supervision and investor protection (

text: ) Introduction and legal basis

text: On 18 September 2018 the European Central Bank (ECB) received a request from the Polish Parliament for an opinion on a draft law amending certain laws to strengthen financial supervision and investor protection (hereinafter the ‘draft law’). The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and the third and sixth indents of

text: Article 2(1) of Council Decision 98/415/EC

text: , as the draft law relates to Narodowy Bank Polski (NBP) and rules applicable to financial institutions insofar as they materially influence the stability of financial institutions and markets. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

text: 1. Purpose of the draft law

text: 1.1 The draft law proposes to amend a series of laws, including the Law on the supervision of the financial market , in order to strengthen financial supervision and investor protection. In this respect, the draft law introduces three main categories of changes. First, the draft law proposes changes to the structure, financing and membership of Komisja Nadzoru Finansowego (current KNF, the Polish Financial Supervision Authority), as well as to the sharing of information obtained in the course of KNF’s activities. Second, the draft law introduces the obligatory dematerialisation of certain securities. Third, the draft law proposes to establish Fundusz Edukacji Finansowej (FEF, the Financial Education Fund). 1.2 Changes to the structure, financing and membership of the current KNF, exchange of information

text: and identification of systemic risk

text: The draft law proposes to abolish the current KNF and to replace it with the new KNF. The new KNF would comprise the KNF Office and the KNF. The KNF Office would be a state legal entity with its own legal personality. The KNF Office would have the task of providing support services in relation to supervision, and would report to the Prime Minister. Within the KNF Office there would

text: be a separate body or organ - the KNF - which would be competent in the field of supervision over the financial market. The KNF would have the same tasks as the current KNF. All current KNF employees would remain employed by the KNF Office. The main reason for establishing the KNF Office, as a legal person, is to ensure its independence in the management of its own funds. The KNF Chairman would be responsible for managing the current activities of the KNF Office and would represent the KNF Office externally. The draft law also proposes to extend KNF’s membership to include representatives of the Prime Minister and, in an advisory capacity, Bankowy Fundusz Gwarancyjny (the Bank Guarantee Fund), the President of Urząd Ochrony Konkurencji i Konsumentów (UOKiK, the Office of Competition and Consumer Protection) and the Minister responsible for coordinating special services. According to the explanatory memorandum, the extension of KNF’s membership aims to ensure better coordination of state bodies in financial markets by allowing for a more efficient identification of risks. The draft law includes provisions that will enable an exchange of information obtained in the course of KNF’s activities between institutions that will be represented in KNF. In addition, the draft law proposes that KNF and NBP shall exchange information, including protected information, which is necessary to perform their tasks. Furthermore, the draft law will enable the sharing of certain information related to KNF’s activities with other public bodies or persons heading them, including Agencja Bezpieczeństwa Wewnętrznego (the Internal Security Agency), Agencja Wywiadu (the Foreign Intelligence Agency), Służba Kontrwywiadu Wojskowego (the Military Counterintelligence Service), Służba Wywiadu Wojskowego (the Military Intelligence Service), Centralne Biuro Antykorupcyjne (the Central Anti-Corruption Bureau), Krajowa Administracja Skarbowa (the National Revenue Administration) and the Police. Under the draft law the KNF Chairman must inform the Prime Minister about systemic risk identified in the financial system. 1.3 Introduction of obligatory dematerialisation of certain securities The draft law introduces the obligatory dematerialisation of corporate bonds, investment certificates issued by closed investment funds and covered bonds, irrespective of whether or not such securities are the subject of a public offer or intended for trading on any trading venue. The main purpose of these changes is to increase the transparency of the identity of the issuer and the volume of the issuance of these securities as well as strengthen investor protection and flexibility, on the basis that only entities that are best prepared for this purpose (i.e. brokerage houses and banks which have a licence for securities accounts) will record these securities and that investors will have the flexibility to transfer these securities to other entities. In addition, creating one central repository of information about debt securities issued and their maturity will improve access to such information for KNF, other entitled bodies and investors. The draft law also proposes to introduce the concept of an issuing agent which will make it easier for issuers to record debt securities in the depository and shorten the relevant process. 1.4 Establishment of FEF

text: The draft law proposes to establish the FEF. The main purpose of FEF is to increase the financial awareness of Polish citizens, in particular through setting out an educational strategy, organising and supporting educational projects and information campaigns and co-operating with the Minister responsible for education. FEF will be supported by Rada Edukacji Finansowej (the Council of Financial Education (hereinafter, the ‘FEF Council’)) which will comprise a representative, each appointed by the Minister responsible for financial institutions, of, among others, each of the following: (i) the Minister responsible for financial institutions, (ii) the Minister responsible for education, (iii) the KNF Chairman, (iv) the NBP President, (v) the President of UOKiK and (vi) Rzecznik Finansowy (the Financial Ombudsman). The FEF Council will be responsible for FEF’s strategy and ways of performing its tasks, and for supervising how these tasks are performed. The FEF Council will also supervise how FEF manages its funds and will decide on FEF’s rules of procedure. FEF will be administered by the Central Securities Depository of Poland and funded through, among other things, sanctions imposed, among others, by KNF, the President of UOKiK and Rzecznik Finansowy.

text: 2. Specific observations

text: 2.1 Composition of the new KNF and the authority of the Prime Minister Regarding the authority of the Prime Minister in respect of the new KNF, the ECB notes that, in accordance with

text: Article 4(4) of Directive 2013/36/EU

text: Member States must ensure that the competent authorities have, among other things, the independence necessary to carry out the functions relating to prudential supervision, investigations and penalties set out in that Directive and in

text: Regulation (EU) No 575/2013

text: . 2.2 Exchange of information The ECB understands that the draft law effectively requires the sharing of information between KNF and NBP which is necessary to perform their tasks, and that certain information obtained in the course of KNF’s activities may also be exchanged with a number of other bodies, including those which will be represented in the new KNF. However, the draft law does not otherwise specify the exact scope of information that may be subject to exchange. Accordingly, the ECB has two observations. First, the ECB notes that NBP is subject to

text: Council Regulation (EC) No 2533/98

text: concerning the collection of statistical information by the ECB.

text: Article 8(1) of Council Regulation (EC) No 2533/98

text: provides that the European System of Central Banks (ESCB), of which NBP is part, shall use confidential statistical information exclusively for the exercise of the tasks of the ESCB except in a limited number of circumstances, including, as regards the ECB and national central banks, if that

text: statistical information is used in the field of prudential supervision. The ECB invites the Polish authorities to consider whether the sharing of information proposed by the draft law, in particular with other public bodies or persons heading them whose tasks do not include prudential supervision, complies with the above exception. Second, to the extent that information that could be exchanged between the various bodies as proposed by the draft law constitutes confidential information for the purposes of Directive

text: , the ECB draws attention to

text: Articles 53

text: to 62 of that Directive which set out the conditions under which confidential information may be shared with third parties, and which refer to specific permitted recipients in this respect. The ECB invites the Polish authorities to consider whether the sharing of information proposed by the draft law complies with these provisions. 2.3 Identification of systemic risk The provision of the draft law under which the KNF Chairman must inform the Prime Minister about systemic risk identified in the financial system is imprecise, as it is not clear whether it concerns informing the Prime Minister about systemic risk identified by KNF or by the Komitet Stabilności Finansowej (KSF, the Financial Stability Committee). In that respect the ECB understands that, in accordance with the Law on the macroprudential oversight of the financial system and crisis management , KSF (whose board includes the NBP President, as Chairman in respect of macroprudential oversight tasks) is the competent authority responsible for macroprudential supervision in Poland. One of the tasks of KSF is to identify systemic risks. Against that background, the ECB invites Polish authorities to clarify the relevant provision to avoid any conflicts of competence between KNF and KSF in respect of the identification of systemic risks. 2.4 Dematerialisation of certain securities The ECB welcomes the obligatory dematerialisation of the relevant securities and their recording in a central securities depository (CSD), as proposed by the draft law, as this will contribute to the elimination of the operational complexities and risks related to handling physical securities in Poland, and to the reduction of settlement and custody costs , as recommended in the CPSS- IOSCO Principles . It is also noted that, for those securities admitted to trading or traded on trading venues, the dematerialisation is in line with the requirements in Article 3 of Regulation (EU) No

text: 909/2014 on transferable securities and the recording of such securities in book-entry form in a CSD. 2.5 Council of Financial Education Fund The draft law proposes that the Minister responsible for financial institutions appoints a representative of the NBP President to the FEF Council. In this respect, the ECB understands that the intention of the draft law is that the representative of the NBP President is to be first selected by NBP in accordance with its statutory rules and then only formally appointed by the relevant Minister. The ECB would recommend that the wording of the draft law is clarified accordingly in order to avoid any uncertainty. An ability of the Minister to select as well as appoint the representative of the NBP President could be considered as interfering with the institutional independence of NBP as laid down in Article 130 of the Treaty and Article 7 of the Statute of the ESCB and the ECB, according to which the governments of the Member States undertake not to seek to influence the members of the decision-making bodies of the national central banks in the performance of their tasks. 2.6 FEF will be administered by the Central Securities Depository of Poland, which will also perform FEF’s tasks. By contrast, the role of the FEF Council – of which a representative of the NBP President will be a member – will be limited mainly to setting out FEF’s strategy and ways of performing such tasks. On that basis, the ECB understands that no new task is proposed to be conferred on NBP.

text: This opinion will be published on the ECB’s website.

text: [signed]

text: The President of the ECB

text: Mario DRAGHI