title: Opinion of the European Central Bank of 11 November 2019 on the security of network and information systems (CON/2019/38)

text: OPINION OF THE EUROPEAN CENTRAL BANK of 11 November 2019 on the security of network and information systems (

text: ) Introduction and legal basis

text: On 10 October 2019 the European Central Bank (ECB) received a request from the Banco de España, on behalf of the Secretaría de Estado para el Avance Digital (SEAD, the Spanish State Secretary for Digital Progress), for an opinion on a draft royal decree (hereinafter the ‘draft royal decree’) on the security of network and information systems (NIS). The draft royal decree implements Royal decree-law No 12/2018 of 8 September 2018 on the security of network and information systems . The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and the third, fifth and sixth indents of

text: Article 2(1) of Council Decision 98/415/EC

text: , as the draft royal decree relates to the Banco de España, payment and settlement systems, rules applicable to financial institutions insofar as they materially influence the stability of financial institutions and markets, and the tasks conferred upon the ECB concerning the prudential supervision of credit institutions pursuant to Article 127(6) of the Treaty. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

text: 1. Purpose of the draft royal decree

text: 1.1 The purpose of the draft royal decree is to further implement certain aspects of Royal decree-law No 12/2018. These legal acts transpose

text: Directive (EU) 2016/1148

text: of the European Parliament and of the Council into Spanish law. The legal acts also complement the relevant legislation enacted in Spain prior to the adoption of

text: Directive (EU) 2016/1148

text: , in particular Law No 8/2011of 28 April, on protection measures for critical infrastructures . 1.2 Designation of the Banco de España and the Comisión Nacional del Mercado de Valores as

text: competent authorities

text: 1.3 The draft royal decree designates the Banco de España, for the purpose of NIS, as the competent authority for credit institutions as operators of essential services, insofar as they are not critical operators. Neither Royal decree-law No 12/2018 nor the draft royal decree identify any operators of

text: 1 Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de información (BOE núm. 2018, de 8 de septiembre de 2018).

text: Council Decision 98/415/EC of 29 June 1998

text: on the consultation of the European Central Bank by national authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42).

text: Directive (EU) 2016/1148

text: of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).

text: 4 Ley 8/2011, de 28 de abril, por la que se establecen medidas para la protección de infraestructuras críticas (BOE núm. 102, de 29 de abril de 2011). essential services. Should a credit institution be classified as a critical operator, the competent authority would be the Centro Nacional de Protección de Infraestructuras y Ciberseguridad (CNPIC, National Centre for the Protection of Infrastructures and Cybersecurity), which is part of the Secretaría de Estado de Seguridad (the State Secretary for Security), which in turn is part of the Ministerio del Interior (the Ministry of Home Affairs). 1.4 The draft royal decree confers upon the competent authorities the task of supervising compliance with the obligations imposed on operators of essential services relating to the NIS and the notification of incidents. Operators of essential services must cooperate with the competent authority and provide all information required. Under the draft royal decree, competent authorities may conduct inspections for the purpose of carrying out their tasks. Under the draft royal decree, the Banco de España as a competent authority may also adopt delegated regulations (circulares) to ensure effective communication with credit institutions and oversee applicable requirements. 1.5 The draft royal decree sets forth that its provisions apply without prejudice to the competences and tasks conferred upon the Banco de España, the ECB and the ESCB pursuant to the Treaty, the Statute of the European System of Central Banks and the European Central Bank (hereinafter the ‘Statute of the ESCB’),

text: Council Regulation (EU) No 1024/2013

text: . The provisions of the draft royal decree also appliy without prejudice to Law No 13/1994 of 1 June on the autonomy of the Banco de España . The provisions of the draft royal decree only apply to the Banco de España insofar as they do not conflict with the relevant rules applicable to the Banco de España and are compatible with the Banco de España’s nature, tasks and independence. 1.6 The draft royal decree also designates, for the purpose of the NIS, the Comisión Nacional del Mercado de Valores (CNMV, the Spanish Securities Commission) as the competent authority for investment service companies and managing companies of collective investment institutions. Should such an entity be designated as acritical operator, the competent authority would be the State Secretary for Security, through the CNPIC. 1.7 Obligations of operators of essential services 1.8 The draft royal decree establishes certain security requirements for the operators of essential services that are applicable, among others, to credit institutions designated as such, and consist of: (i) the requirement to adopt security policies, which as a minimum must cover the following: risk analysis, management, management of third party or suppliers’ risks, detection and management of incidents, recovery plans and business continuity, and system interconnections; and (ii) the requirement to designate a person responsible for the security of information as a point of contact for the relevant competent authority who will liaise with that authority in the event of security incidents. The tasks assigned to the person responsible for the security of information include preparing security policies, overseeing their implementation, and notifying any incidents to the competent authority. Under the draft royal decree, that person must be staffed with personnel who have adequate knowledge and experience, and sufficient resources to carry out their tasks and must be independent from the persons responsible for the security of network and information systems.

text: Council Regulation (EU) No 1024/2013 of 15 October 2013

text: conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions (OJ L 287, 29.10.2013, p. 63).

text: 6 Ley 13/1994, de 1 de junio, de Autonomía del Banco de España (BOE no. 131, de 2 de junio de 1994). 1.9 Operators of essential services must manage and resolve security incidents affecting network and information systems used in the provision of their services, including those detected by the operator itself and those notified by the competent authority or the relevant Computer Security Incident Response Team (CSIRT). Operators of essential services must also notify the competent authority, through the relevant CSIRT, of incidents where the impact level is high, very high or critical. Furthermore, they must notify the competent authority of incidents that may affect the network and information systems used to provide the essential services, even if the incident has not yet caused real adverse effects. 1.10 Other measures 1.11 The draft royal decree also includes provisions for cooperation among the different CSIRTs and between CSIRTs and competent authorities through a National Platform for Notifications and Oversight of Cyber Incidents, which ensures the secure exchange of information. 1.12 The draft royal decree includes an annex containing a national instruction on the notification and management of cyber incidents, which sets out criteria for the classification of cyber incidents, a ratings system to assign a hazard level to cyber incidents, and a template setting out the information to be reported by operators of essential services to competent authorities.

text: 2. General observations

text: 2.1 As previously noted by the ECB , the ECB supports the aim of

text: Directive (EU) 2016/1148

text: of ensuring a high common level of network and information security across the Union and of achieving a consistency of approach in this field across business sectors and Member States. It is important to ensure that the internal market is a safe place to do business and that all Member States have a certain minimum level of preparedness for cybersecurity incidents. Concurrently, it should be ensured that the provisions of the national legislation transposing

text: Directive (EU) 2016/1148

text: are coordinated with the Eurosystem’s competences and respect the principle of independence of central banks enshrined in Article 130 of the Treaty. In line with the ECB’s recommendation,

text: recital 14

text: of

text: Directive (EU) 2016/1148

text: states that the Directive does not affect the Eurosystem’s oversight of payment and settlement systems . On the other hand, NIS benefits from synergies and economies of scale. In particular, dedicated national competent authorities have the potential to become repositories of considerable resources and expertise which the Eurosystem may draw upon in the area of NIS. Moreover, recognition of the ECB and its decision-making bodies’ independence does not have the consequence of separating the Eurosystem entirely from the Union and exempting it from every rule of Union law . The national implementing measures of

text: Directive (EU) 2016/1148

text: are not prima facie precluded from applying to the Eurosystem .

text: 7 See paragraph 2.1 of Opinion

text: ; paragraph 2.1 of Opinion

text: ; paragraph 2.2 of Opinion

text: ; paragraph 2.2 of Opinion

text: and paragraph 2.2 of Opinion

text: . All ECB opinions are published on the ECB’s website at www.ecb.europa.eu.

text: 8 See also paragraph 2.2 of Opinion

text: ; paragraph 2.2 of Opinion

text: ; and paragraph 3.1.1 of Opinion

text: 9 See paragraph 3.1 of Opinion

text: and paragraph 3.5 of Opinion

text: 10 See judgment of the Court of Justice of 10 July 2003, Commission v ECB,

text: , ECLI:EU:C:2003:395, paragraphs 134 to 136.

text: 11 See paragraph 2.2 of Opinion

text: . 2.2 Against this background, the ECB welcomes the designation of the Banco de España as a sectoral authority for NIS purposes. It also welcomes that the provisions of the draft royal decree apply without prejudice to the competences and tasks conferred upon the Banco de España, the ECB and the ESCB pursuant to the Treaty, the Statute of the ESCB,

text: Regulation (EU) No 1024/2013

text: , and Law No 13/1994 . Thereby the draft royal decree applies to the Banco de España only insofar as it does not conflict with the relevant rules applicable to the Banco de España and is compatible with the Banco de España’s nature, tasks and independence. 2.3 The designation of the Banco de España as a sectoral NIS authority ensures that it may benefit from the resources and information specific to the NIS area, in particular being informed about actual and potential cyber incidents or threats in the financial sector’s systems and infrastructures, and about planned and adopted measures, in an effective and timely manner . On the other hand, the draft royal decree ensures that the Banco de España may carry out its tasks as a sectoral NIS authority without prejudice to its tasks as part of the Eurosystem and the Single Supervisory Mechanism (SSM). In this respect, the ECB understands that the clarification that the draft royal decree applies without prejudice to the competences and tasks conferred upon the Banco de España, including as part of the ESCB and the SSM, pursuant to the Treaty, the Statute of the ESCB,

text: Regulation (EU) No 1024/2013

text: and Law No 13/1994, means that the draft royal decree applies in respect of all competences and tasks of the Banco de España and not only in respect of its designation as a sectoral NIS authority. 2.4 The ECB also welcomes that the draft royal decree shall apply without prejudice to the competences and tasks conferred upon the ECB pursuant to the Treaty, the Statute of the ESCB and

text: Regulation (EU) No 1024/2013

text: . 2.5 In addition, the ECB stands ready to cooperate with the Spanish authorities in relation to the systems and infrastructures which the Eurosystem oversees or operates, such as payment systems, instruments and schemes, and the prudential supervision of credit institutions, with a view to ensuring that best practices with regard to NIS are established and followed . The ECB has previously called for the establishment of such effective cooperation and information-sharing arrangements between the national NIS authorities and, through the national central banks (NCBs), 15 16 the ECB . In this respect, the ECB understands that Banco de España may share the relevant information it receives from different stakeholders in its capacity as a sectoral NIS authority with the ECB in a timely and efficient manner within the framework of the respective responsibilities of the Banco de España and the ECB .

text: 3. Impact of the draft royal decree on payment systems and securities settlement systems

text: 3.1 Impact on other operators of essential services within the financial and tax strategic sector

text: 12 Fourth additional provision of the draft royal decree.

text: 13 See paragraphs 3.2.4 and 3.4.3 of Opinion

text: and paragraph 4.4 of Opinion

text: 14 See paragraph 6.3 of Opinion

text: 15 See paragraphs 2.3 and 6.2 of Opinion

text: and paragraphs 2.4, 3.1.6, 3.2.4 and 4.7 of Opinion

text: 16 This understanding is based in Article 14 of the Royal Decree-law No. 12/2018, which allows the exchange of information between authorities, and the general secrecy provisions that apply to Banco de España.

text: 17 See paragraph 4.3 of Opinion

text: , paragraph 6.2 of Opinion

text: and paragraph 2.4 of Opinion

text: . 3.1.1 Law No 8/2011 identifies the ‘financial and tax system’ as a strategic sector, i.e., as an area of economic activity that provides an essential service. Essential services are defined both in Law No 8/2011 and Royal decree-law No 12/2018 as services necessary for: (i) the maintenance of basic social functions, health, security, the economic and social welfare of citizens; or (ii) the efficient functioning of State institutions and public authorities that rely on network and information systems. Royal decree-law No 12/2018 clarifies that ‘operators of essential services’ are public or private entities that provide essential services within one of the strategic sectors identified in Law No 8/2011. Royal decree-law No 12/2018 also makes clear that an operator will be classified as an operator of essential services if an incident suffered by such an operator may have significant disruptive effects on the supply of the services depending, inter alia, on the alternatives available or the number of service users. 3.1.2 The draft royal decree explicitly designates the NIS competent authorities for credit institutions, insurance companies, managing companies of collective investment institutions and investment service companies qualifying as operators of essential services for the financial and tax system, where these do not qualify as critical operators. However, it does not expressly designate NIS competent authorities for other entities also belonging to the financial and tax system, such as operators of trading venues, or central counterparties (CCPs), to which Annex II of

text: Directive (EU) 2016/1148

text: makes express reference, or other payment and securities settlement systems, where these do not qualify as critical operators, or provide additional guidance on what constitutes an operator of essential services. The ECB understands that these other infrastructures, over which the ECB or the Banco de España have an oversight role, might have been designated as critical operators, in which case the NIS competent authority would be the State Secretary for Security, through the CNPIC, based on the designation set out in Royal Decree-law No 12/2018. In this respect, it is unclear whether the Banco de España itself is also bound by the obligations on operators of essential services imposed by the draft royal decree, in its capacity as operator of a systemically important payment system (SIPS), such as the Spanish component of TARGET2, namely TARGET2-Banco de España. 3.2 Impact on operators of market infrastructures: systemically important payments systems 3.2.1 In its oversight role and on the basis of Articles

text: and

text: and the first indent of Article 34.1 of the Statute of the ESCB, the ECB adopted

text: Regulation (EU) No 795/2014

text: of the European Central Bank (ECB/2014/28) .

text: Regulation (EU) No 795/2014

text: (ECB/2014/28) implements the Principles for financial market infrastructures (PFMIs) issued by the Committee on Payment and Settlement Systems (CPSS) and the International Organization of Securities Commissions (IOSCO) (hereinafter the ‘CPSS-IOSCO PFMIs’) which are legally binding and cover both large-value and retail payment systems of systemic importance, operated either by a Eurosystem central bank or a private entity.

text: Regulation (EU) No 795/2014

text: of the European Central Bank of 3 July 2014 on oversight requirements for systemically important payment systems (ECB/2014/28) (OJ L 217, 23.7.2014, p. 16).

text: 19 Available on the Bank for International Settlements’ website at www.bis.org. 3.2.2 Thus, SIPS are subject to regular assessment against the requirements of

text: Regulation (EU) No 795/2014

text: (ECB/2014/28) related to operational risk , which allows the competent Eurosystem central bank, as competent authority, to verify that the systems are in compliance. In cases of noncompliance, the competent Eurosystem central bank has the power to impose sanctions or corrective measures to ensure compliance . Amendments to

text: Regulation (EU) No 795/2014

text: (ECB/2014/28) recently introduced a number of new requirements for SIPS operators addressing new risks, including those related to operational and security risks, such as cyber resilience , taking into account, inter alia, the Guidance on cyber resilience for financial market infrastructures which was published in 2016 by the Committee on Payments and Market Infrastructures (CPMI) and IOSCO (hereinafter the ‘CPMI-IOSCO Guidance on cyber resilience’). 3.2.3 Furthermore, in line with the requirements set out in

text: Directive (EU) 2016/1148

text: Regulation (EU) No 795/2014

text: (ECB/2014/28) already provides competent Eurosystem central banks with the power to obtain information concerning, inter alia, major and minor incidents, the nature and type of the incidents, their seriousness and their duration . The amended

text: Regulation (EU) No 795/2014

text: (ECB/2014/28) further enhanced competent Eurosystem central banks’ powers to conduct on-site inspections and request independent reviews of and investigations into the functioning of the systems. 3.2.4 Among listed SIPS, TARGET2 plays a distinct role, as it is owned and operated by the Eurosystem 27. and subject to strict regulation and oversight While the draft royal decree does not refer explicitly to SIPS, the ECB understands that the Spanish component of TARGET2, TARGET2-Banco de España, for which Banco de España acts as an operator, could potentially fall within the scope of the draft royal decree. TARGET2 has been identified, pursuant to Decision ECB/2014/35 of the European Central Bank , as a SIPS and is overseen by the ECB as the competent authority under

text: Regulation (EU) No 795/2014

text: (ECB/2014/28). 3.2.5 The ECB understands that the draft royal decree does not prejudice in any respect the competence of the Eurosystem with respect to the oversight of SIPS, given that such oversight is performed on

text: 20 See

text: Article 15 of Regulation (EU) No 795/2014

text: (ECB/2014/28), which imposes an obligation on SIPS operators to take steps such as: (a) establish comprehensive physical and information security policies that adequately identify, assess and manage all potential vulnerabilities and threats, (b) to ensure that critical information technology systems can resume operations within specified timeframes where an event poses a significant risk of disrupting the SIPS’ operations etc.

text: 21 See paragraph 3.4 of Opinion

text: 22 Amendments introduced by

text: Regulation (EU) 2017/2094

text: of the European Central Bank, of 3 November 2017, amending

text: Regulation (EU) No 795/2014

text: on oversight requirements for systemically important payment systemsb (ECB/2017/32

text: 23 See

text: Article 15

text: (1a) and (4a) of

text: Regulation (EU) No 795/2014

text: (ECB/2014/28), which imposes an obligation on SIPS operators to take the following steps: (i) review, audit and test systems, operational policies, procedures and controls periodically and after significant changes; (ii) establish an effective cyber resilience framework with appropriate governance measures in place; (iii) identify their critical operations and supporting assets, and have appropriate measures in place to protect them from, detect, respond to and recover from cyber-attacks; (iv) regularly test the established measures; and (v) have a sound level of situational awareness of cyber threats, including through a process of continuous learning.

text: 24 Available on the Bank for International Settlements’ website.

text: 25 See

text: Article 21

text: (1a) of

text: Regulation (EU) No 795/2014

text: 26 See

text: Articles 21

text: (1b) and (1c) of

text: Regulation (EU) No 795/2014

text: 27 See paragraph 3.1.5 of Opinion

text: 28 Decision ECB/2014/35 of the European Central Bank of 13 August 2014 on the identification of TARGET2 as a systemically important payment system pursuant to

text: Regulation (EU) No 795/2014

text: on oversight requirements for systemically important payment systems (OJ L 245, 20.8.2014, p. 5). the basis of ECB regulations. As noted in paragraph 2.5, the ECB understands that the information that the Banco de España receives as a sectoral NIS authority about actual and potential cyber incidents, as well as planned or adopted measures which may affect SIPS and TARGET2, may be shared with the ECB in a timely and efficient manner. 3.3 Impact on non-systemically important payment systems 3.3.1 Non-systemically important payment systems (non-SIPS) include non-systemically important largevalue payment systems (LVPS) and non-systemically important retail payment systems (non- SIRPS). Under the revised oversight framework for retail payment systems , non-SIRPS have been divided into two distinct groups: prominently important retail payments systems (PIRPS) and other retail payment systems (ORPS). The Sistema Nacional de Compensación Electrónica (the Spanish local retail payment system) has been classified as belonging to the group of PIRPS . The ECB understands that its services could be included in the list of essential services pursuant to the draft royal decree and that the operators of this system might be designated as an operator of essential services. 3.3.2 Under the Eurosystem’s oversight policy framework, non-SIRPS must follow the CPSS-IOSCO PFMIs and the Oversight expectations for links between retail payment systems (OELRPS) . Both the CPSS-IOSCO PFMIs and the OELRPS are soft law instruments, meaning that non-systemically important LVPS, PIRPS and ORPS are subject to oversight standards comparable to the standards under

text: Regulation (EU) No 795/2014

text: (ECB/2014/28) however there is no Union legislation regulating the oversight or supervision of these systems . The Banco de España’s competences in relation to oversight over non-SIPS are also conferred pursuant to Law No 13/1994 . 3.3.3 The revised oversight framework for retail payment systems specifies that all retail payment systems are an integral part of the payment and settlement landscape of the euro area and thus fall within the scope of oversight. Hence, the Eurosystem has an interest in ensuring that the oversight framework and standards applicable to such systems are not prejudiced through the implementation of

text: Directive (EU) 2016/1148

text: or when introducing other NIS-related laws . 3.3.4 If the intention is for non-SIPS to be within the scope of the draft royal decree, the ECB understands that the draft royal decree does not prejudice the Banco de España’s ability to carry out its oversight tasks. As suggested in paragraph 2.5, the ECB understands that the Banco de España may share with the ECB any relevant information on non-SIPS it receives as a sectoral NIS authority. 3.4 Impact on payment services, payment instruments and payment schemes 3.4.1 The Eurosystem oversight policy framework identifies payment instruments (such as cards, credit transfers, direct debit and electronic money) as an ‘integral part of payment systems’ and thus

text: 29 See the Eurosystem’s ‘Revised oversight framework for retail payment systems’ (February 2016), available on the ECB’s website at www.ecb.europa.eu.

text: 30 See the Eurosystem’s ‘Overview of payment systems’, available on the ECB’s website.

text: 31 See the Eurosystem’s ‘Oversight expectations for links between retail payment systems’, available on the ECB’s website.

text: 32 See paragraph 2.4.4 of ECB Opinion

text: , paragraph 3.2.3 of Opinion

text: and paragraph 3.2.2 of Opinion

text: 33 See

text: Article 7

text: and Article 16 of Law No 13/1994.

text: 34 See paragraph 3.4.2 of Opinion

text: , paragraph 4.3 of Opinion

text: and paragraph 3.2.3 of Opinion

text: . includes these within the scope of its central banking oversight. For payment instruments, the role of primary overseer for the Eurosystem is assigned by reference to the national anchor of the payment scheme and the legal incorporation of its governance authority. For credit transfer schemes and direct debit schemes within the Single Euro Payments Area, as well as some of the international card payment schemes, the ECB has the primary oversight role. Payment service providers (PSPs), including credit institutions, payment institutions and electronic money institutions, are subject to

text: Directive (EU) 2015/2366

text: of the European Parliament and of the Council , which is applicable as of January 2018, as implemented into national law. The legal and regulatory framework sets out requirements pertaining to operational and security risks and incident reporting. Nevertheless, prudential supervisors need to exercise careful judgment when deciding whether to publish information concerning individual cybersecurity incidents, to ensure public confidence in the affected institutions is not undermined. Furthermore, the European Banking Authority (EBA) has produced guidelines on the security measures for the management of operational and security risks in relation to payment services under

text: Directive (EU) 2015/2366

text: , and is preparing draft guidelines on information and communication technology (ICT) and security risk management which are intended to harmonise standards applicable to PSPs regarding ICT security, incident reporting, project management and business continuity. Therefore, PSPs are subject to Union legislation, Spanish legislation, and regulations based on Union legislation. However, the oversight of international and domestic card schemes is not subject to Union legislation as such . 3.4.2 The ECB understands that the various payment schemes, instruments and PSPs may potentially fall within the scope of the draft royal decree. The ECB reiterates its understanding that the Banco de España may share with the ECB any relevant information it receives as a sectoral NIS authority in a timely and efficient manner and in accordance with the framework of respective responsibilities of the Banco de España and the ECB. 3.5 Impact on central securities depositories 3.5.1 Central securities depositories (CSDs) are strictly regulated and supervised by different authorities pursuant to

text: Regulation (EU) No 909/2014

text: of the European Parliament and of the Council , which sets out requirements pertaining to operational risk. Furthermore, CSDs should take note of the CPMI-IOSCO Guidance on cyber resilience which applies to all financial market infrastructures. 3.5.2 In addition to the supervisory competences entrusted to national competent authorities (NCAs) under

text: Regulation (EU) No 909/2014

text: , national authorities, and in particular the members of the ESCB, are entrusted with the oversight of authorisation and supervision of CSDs in their capacity

text: Directive (EU) 2015/2366

text: of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives

text: and

text: and

text: Regulation (EU) No 1093/2010

text: , and repealing Directive

text: (OJ L 337, 23.12.2015, p. 35).

text: 36 Guidelines on the security measures for operational and security risks of payment services under

text: Directive (EU) 2015/2366

text: (PSD2) (

text: ), of 12 January 2018.

text: 37 See the EBA Guidelines on internal governance under Directive

text: of 26 September 2017 (

text: ) and the draft EBA Guidelines on ICT and security risk management of 13 December 2018 (EBA/CP/2018/15) available on the EBA’s website at www.eba.europa.eu.

text: 38 See paragraph 2.4.3 of Opinion

text: , paragraph 3.4.2 of Opinion

text: and paragraph 3.4.1 of Opinion

text: Regulation (EU) No 909/2014

text: of the European Parliament and of the Council of 23 July 2014 on improving securities settlement in the European Union and on central securities depositories and amending Directives

text: and

text: and

text: Regulation (EU) No 236/2012

text: (OJ L 257, 28.8.2014, p. 1). as ‘relevant authorities’ . In this regard,

text: recital 8

text: of

text: Regulation (EU) No 909/2014

text: states that the Regulation should apply without prejudice to the responsibilities of the ECB and the NCBs to ensure efficient and sound clearing systems and payment systems within the Union and other countries. Recital 8 also states that

text: Regulation (EU) No 909/2014

text: should not prevent the members of the ESCB from accessing information relevant to the performance of their duties , including the oversight of CSDs and other financial market infrastructures . 3.5.3 Iberclear is the Spanish Central Securities Depository, authorised under

text: Regulation (EU) No 909/2014

text: and supervised by the CNMV. Pursuant to

text: Regulation (EU) No 909/2014

text: , Iberclear is the operator of a securities settlement system which is overseen jointly by the Banco de España and the CNMV. Insofar as Iberclear may be an operator of essential services and may fall within the scope of the draft royal decree, the ECB understands that the draft royal decree would apply without prejudice to the Banco de España’s tasks in relation to oversight, also taking into account that such oversight is performed on the basis of Union legislation. 3.6 Eurosystem cyber resilience strategy for Financial Market Infrastructures 3.6.1 The ECB understands that the provisions of the draft royal decree apply without prejudice to the Eurosystem cyber resilience strategy for Financial Market Infrastructures (FMIs) , which is intended to support the implementation of the CPMI-IOSCO Guidance on cyber resilience from an oversight perspective. The objectives of this strategy are to: (i) improve the cyber resilience of the euro area financial sector as a whole by enhancing the ‘cyber readiness’ of individual FMIs that are overseen by the Eurosystem central banks; and (ii) foster collaboration among FMIs, their critical service providers and the relevant authorities. As part of the strategy, the Eurosystem has developed a range of tools that can be used by FMIs to enhance their cyber resilience, such as a European red team testing framework , and other tools, such as cyber surveys and focused assessments to assess the level of cyber maturity of Eurosystem payment systems and to develop cyber resilience oversight expectations , which will provide more detailed guidance to payment system operators.

text: 4. Impact of the draft royal decree on credit institutions

text: Recital 13

text: of

text: Directive (EU) 2016/1148

text: states that requirements in respect of information systems, which often exceed the requirements provided for under

text: Directive (EU) 2016/1148

text: , are set out in a number of Union legal acts, including the rules on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms. Member States should consider those requirements in their application of provisions transposing

text: Directive (EU) 2016/1148

text: as lex specialis. Indeed, the Union legal acts harmonising the area of supervision of credit institutions

text: 40 See

text: Article 12 of Regulation (EU) No 909/2014

text: 42 See paragraph 7.3 of Opinion

text: ; paragraph 7.2 of Opinion

text: ; and 3.5.2 of Opinion

text: 43 See more at https://www.ecb.europa.eu/paym/cyber-resilience/fmi/html/index.en.html

text: 44 See the Eurosystem’s Framework for Threat Intelligence-based Ethical Red Teaming (TIBER-EU) (May 2018), available on the ECB’s website.

text: 45 See the Eurosystem’s ‘Cyber resilience oversight expectations for financial market infrastructures’ (CROE) (December 2018), available on the ECB’s website. include

text: Regulation (EU) No 575/2013

text: of the European Parliament and of the Council and Directive

text: of the European Parliament and of the Council , jointly establishing the CRR/CRDIV framework. 4.2 The ECB and the Banco de España are the competent authorities exercising specified supervisory powers under the CRR/CRDIV framework, by virtue of

text: Regulation (EU) No 1024/2013

text: which confers specific tasks on the ECB concerning the prudential supervision of credit institutions within the euro area and makes the ECB responsible for the effective and consistent functioning of the Single Supervisory Mechanism (SSM) within which specific supervisory responsibilities are distributed between the ECB and the participating NCAs, including the Banco de España. In particular, the ECB carries out the task to authorise and to withdraw the authorisations of all credit institutions. For significant credit institutions the ECB also has the task, among others, to ensure compliance with the relevant Union law that imposes prudential requirements on credit institutions, including the requirement to have in place robust governance arrangements, such as sound risk management processes and internal control mechanisms . To this end, the ECB is given all supervisory powers to intervene in the activity of credit institutions that are necessary for the exercise of its functions. 4.3 The prudential supervision of credit institutions, as exercised by the ECB and the Banco de España within the SSM, covers several aspects related to cybersecurity as part of the prudential supervision of operational risk, which means the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events . In addition, the EBA has produced guidelines on internal governance covering aspects of IT risks , and, as noted in paragraph 3.4.1, draft guidelines on ICT and security risk management which are intended to harmonise requirements for credit institutions, investment firms and payment service providers as regards ICT security, incident reporting, project management and business continuity. Further EBA Guidelines are under development, concerning inclusion of cyber risk aspects in the Supervisory Review and Evaluation Process . The ECB has developed comprehensive IT risk questionnaires for supervised credit institutions that are fed into their SREP outcomes and also uses insights on cyber-security issues that may be drawn from thematic reviews, on-site inspections and reports of cyber incidents . Such insights may form the basis for ad hoc institution-specific recommendations and general sector-wide comparisons and policies. At the same time, prudential supervisors need

text: Regulation (EU) No 575/2013

text: of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending

text: Regulation (EU) No 648/2012

text: (OJ L 176, 27.6.2013, p. 1).

text: 47 Directive

text: of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive

text: and repealing Directives

text: and

text: (OJ L 176, 27.6.2013, p. 338).

text: 50 Guidelines on Internal Governance (

text: ), of 21 March 2018.

text: 51 See the EBA Guidelines on internal governance under Directive

text: of 26 September 2017 (

text: ) and the draft EBA Guidelines on ICT and security risk management of 13 December 2018 (EBA/CP/2018/15), available on the EBA’s website.

text: 52 See the EBA’s draft Guidelines on ICT Risk Assessment under the Supervisory Review and Evaluation process (SREP) of 6 October 2016 (EBA/CP/2016/14), available on the EBA’s website.

text: 53 See also the Newsletter article of 13 February 2019 on ‘IT and cyber risk - the SSM perspective’, available on the ECB’s website. to exercise careful judgment when deciding to publish information concerning individual cybersecurity incidents so as to not undermine public confidence in the affected credit institutions. 4.4 Moreover, the ECB and the NCAs within the SSM are responsible for the assessment of recovery plans and taking early intervention measures under Directive

text: of the European Parliament and of the Council (as transposed into national law). Further, the primary responsibility for determining that a significant credit institution is failing or likely to fail as a condition to the resolution of a credit institution lies with the ECB . In the case of resolution, one of the resolution objectives is to ensure the continuity of critical functions , which can include the continuing functioning of the credit institution’s payment and cash circulation systems. 4.5 Central banks are excluded from the scope of Directive

text: and are thus not supervised institutions falling within the scope of

text: Regulation (EU) No 575/2013

text: . Therefore, neither the ECB nor the Banco de España falls within the scope of the ‘banking sector’ for the purposes of point (3) of Annex II to

text: Directive (EU) 2016/1148

text: . 4.6 In this context, the ECB welcomes the designation of the Banco de España as a sectoral NIS authority for credit institutions which are operators of essential services but not critical operators. There are undoubtedly overlaps in the prudential supervision of operational risk for credit institutions and the supervision of compliance with credit institutions obligations as operators of essential services. The ECB also welcomes the draft royal decree’s explicit clarification that Banco de España should carry out its NIS tasks without prejudice to its supervisory tasks in the context of the SSM. In this respect, the ECB notes that there is an obligation to ensure the exchange of information between the ECB and the national competent authorities under Union law. The national competent authorities are required to provide the ECB with all information necessary for the purposes of carrying out the tasks conferred upon the ECB pursuant to

text: Regulation (EU) No 1024/2013

text: . In this context, the ECB reiterates its understanding that the Banco de España may share with the ECB any relevant information it receives as a sectoral NIS authority in a timely and efficient manner and within the framework of the respective responsibilities of the Banco de España and the ECB.

text: 5. NIS-related role of the Banco de España

text: 5.1 The draft royal decree designates the Banco de España as the competent authority for credit institutions in their capacity as operators of essential services insofar as they are not critical operators. Such supervision consists of overseeing the compliance by credit institutions as operators of essential services with their NIS obligations, including the power to request documents

text: 54 See

text: Articles 27

text: to 30 of Directive

text: of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending

text: Council Directive 82/891/EEC

text: , and Directives

text: and

text: , and Regulations

text: (EU) No 1093/2010

text: and

text: (EU) No 648/2012

text: , of the European Parliament and of the Council (OJ L 173, 12.6.2014, p. 190).

text: 57 See paragraph 2.4 of Opinion

text: and paragraph 4.5 of Opinion

text: 58 See

text: Article 6(2)

text: and

text: Article 6(7)

text: (c)(i) and (iii) of

text: Regulation (EU) No 1024/2013

text: Article 21(1)

text: , Articles

text: and

text: of Regulation (EU) No 468/2014 of the European Central Bank of 16 April 2014 establishing the framework for cooperation within the Single Supervisory Mechanism between the European Central Bank and national competent authorities and with national designated authorities (SSM Framework Regulation) (ECB/2014/17) (OJ L 141, 14.5.2014, p. 1). and conduct inspections if necessary. The Banco de España must also cooperate with other competent authorities regarding the performance of its NIS tasks, including in the provision of technical advice on the suitability of security measures adopted by credit institutions. The Banco de España must liaise and cooperate with the relevant CSIRTs. Royal decree-law No 12/2018 confers sanctioning powers upon competent authorities for minor and severe breaches of NIS obligations. 5.2 Many of the Banco de España’s tasks as a sectoral authority, including supervising compliance by credit institutions and liaising and coordinating with other authorities, are already carried out by the Banco de España in its role as prudential supervisor of credit institutions. The draft royal decree significantly overlaps with the prudential supervisory tasks of the Banco de España within the framework of the SSM, in particular regarding the supervision of operational risk where Banco de España must examine the adequacy of internal processes, crisis management procedures, continuity plans and IT risks. Thus, the task conferred upon the Banco de España by the draft royal decree is related to, and overlaps with, the prudential supervisory tasks conferred upon the ECB and the NCBs under the Treaty and the Statute of the ESCB. This task is not atypical. Many NCBs are assigned prudential supervisory tasks and there are a number of Member States in which NCBs have been entrusted with NIS-specific tasks, including the identification of operators of essential services and/or the supervision of their compliance with cybersecurity obligations .

text: 59 In Belgium the National Bank of Belgium (NBB) has been appointed under the Law of 1 July 2011 on the security and protection of critical infrastructures as the sectoral authority for the financial sector responsible for the identification, designation and monitoring of critical infrastructures. The NBB has also been appointed under the national legislation transposing

text: Directive (EU) 2016/1148

text: as the sectoral authority responsible to ensure compliance by credit institutions and central counterparties, in their capacity as operators of essential services, with their obligations so far as concerns incident notifications. The provisions on security requirements, internal and external audit, control, verifications and inspections, which apply to all other sectors, are waived in respect of operators of essential services in the financial sector. See paragraphs 1.2, 1.3 and 1.5 of Opinion

text: . In Croatia the Cybersecurity Law implementing

text: Directive (EU) 2016/1148

text: , adopted in July 2018, entrusted Hrvatska narodna banka (HNB) with tasks related to the identification of operators of essential services, the supervision of operators and the receipt of incident notifications. The HNB has to assess whether they comply with cybersecurity obligations, entailing supervision once every two years or if an operator of essential services fails to comply with obligations under the law. The HNB is empowered to request and receive from operators of essential services data needed to assess the security level of their network and information systems, including documented security policies and evidence of effective implementation of security measures. The HNB is also empowered to issue mandatory guidance, to submit indictments and to receive reports on incidents. In Ireland Statutory Instrument No 360 of 2018 EU (Measures for a high common level of security of network and information systems) Regulations 2018 conferred the following tasks on the Central Bank of Ireland: (i) preparing and maintaining a list of essential services in the relevant sector; (ii) designating a person as an operator of essential services in the relevant sector; (iii) establishing and maintaining a Register of Operators of Essential Services containing particulars of operators of essential services in the banking/FMI sector, and (iv) bringing and prosecuting summary proceedings for an offence under the Regulations committed by an operator of essential services. In the Netherlands Article 28 of the Act on the security of network and information systems (Wet beveiliging netwerk- en informatiesystemen) and the Order in Council on security of network and information systems (Besluit beveiliging netwerk- en informatiesystemen) confers on competent authorities the powers to initiate a security audit, give binding instructions and impose administrative sanctions and enforcement measures. The obligations related to security audit and instructions do not apply to financial infrastructures and financial institutions, but these entities remain however subject to the obligation to report incidents. The main tasks of DNB are therefore receiving incident notifications and imposing enforcement measures and sanctions for breaches of the obligation to report incidents. Although cybersecurity clearly relates to national security, due to the strong overlap with the prudential supervisory tasks of the Banco de España, in particular as regards the supervision of operational risk, it can be concluded that the draft royal decree does not confer genuinely new tasks on the Banco de España in this respect. This opinion will be published on the ECB’s website. Done at Frankfurt am Main, 11 November 2019. [signed] The President of the ECB Christine LAGARDE


publisher: Europeiska centralbanken

sprak: en

title: Opinion of the European Central Bank of 20 November 2019 on tax disincentives for the use of cash (CON/2019/39)

serie: con

text: OPINION OF THE EUROPEAN CENTRAL BANK of 20 November 2019 on tax disincentives for the use of cash (

text: ) Introduction and legal basis

type: rubrik

text: On 19 November 2019 the European Central Bank (ECB) received a request from the Greek Ministry of Finance for an opinion on certain draft amendments to the Greek Income Tax Law seeking to further expand already existing tax disincentives for the use of cash (hereinafter the ‘draft amendments’). The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty and the second indent of

text: Article 2(1) of Council Decision 98/415/EC

text: , as the draft amendments relate to means of payment. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

type: stycke

text: 1. Purpose of the draft amendments

text: 1.1 According to the explanatory report accompanying the draft amendments, the objective of the draft amendments is to incentivise electronic transactions when purchasing goods and services, with the aim to (i) reduce tax evasion and (ii) broaden the tax base, for reasons of public interest. 1.2 The draft amendments build on already existing legislative measures adopted in 2016 that promote the broader use of electronic payment instruments in Greece. One such legislative measures which was adopted in 2016 and remains in force provides that the eligibility of taxpayers to avail of existing income tax credits for income earned from employment and pensions is conditioned on compliance with an obligation to pay a certain amount of expenses by means of electronic payments according to a minimum quota of a taxpayer’s annual income. If the minimum quota of epayments is not reached, an additional 22% tax is charged on the difference , and taxpayers are

text: 1 Law 4172/2013 on taxation of income, urgent measures for implementing laws 4046/2012, 4093/2012, 4127/2013 and other provisions (Government Gazette A 167/23.7.2013).

text: Council Decision 98/415/EC of 29 June 1998

text: on the consultation of the European Central Bank by national authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42).

text: 3 Article 16 of the Greek Income Tax Law.

text: 4 This tax is an additional ‘penalty’ tax which will is payable on top of the other types of income tax applicable to the respective taxpayer. no longer eligible to benefit from currently applicable income tax credits . The minimum quotas of e-payments currently increase progressively on the basis of income brackets, as follows: for income between EUR 1-10 000, the minimum e-payments threshold is 10 %; for income between EUR 10 001-30 000, the minimum e-payments threshold is 15 %; and for income exceeding EUR 30 001, the minimum e-payments threshold is 20 % with however a lower ceiling of EUR 30 000 . 1.3 Another already-existing legislative measure which was adopted in 2016 and remains in force provides that any single cash payment for the acquisition of goods and services exceeding EUR 500 for consumer-to-business transactions is prohibited and that such payment may only be made via electronic means . 1.4 The draft amendments propose to increase the minimum threshold for e-payments that must be reached by taxpayers to 30 % and to make it applicable to all income brackets uniformly with a ceiling of EUR 20 000 . The 22 % additional tax on the difference between the increased minimum e-payments threshold and the income actually spent via e-payments remains unaltered. The definition of e-payments or of expenses realised through electronic means of payments for the purposes of the draft amendments remains unaltered. This definition comprises expenditure which is incurred by the taxpayer for the acquisition of goods and services in Greece or Member States of the European Union or the European Economic Area via electronic means of payments, such as credit and debit cards, bank wire transfers, e-wallets, and payment accounts held with a payment service provider . The expenditure that may be counted towards the minimum e-payment threshold remains unaltered. It comprises expenditure for the acquisition of goods and services which belong to the twelve categories of the consumer price index of the Hellenic Statistical Authority . 1.5 The draft amendments also provide that the required minimum e-payments threshold is 20 % of real income in cases where e-payments of income and property tax, rents and loans to credit institutions have been made and amount to 60 % or more of real income . 1.6 The draft amendments propose to lower existing income tax credits , but provide that taxpayers will continue to benefit from such lower income tax credits even if they do not meet the revised

text: 5 The currently applicable income tax credit is: (a) for taxable income not exceeding EUR 20,000: (i) EUR 1 900 for a taxpayer without dependent children; (ii) EUR 1 950 for a taxpayer with one dependent child; (iii) EUR 2 000 for a taxpayer with two dependent children; and (iv) EUR 2 100 for a taxpayer with three dependent children; (b) for taxable income exceeding EUR 20 000 the tax credit under (a) above is reduced by EUR 10 for every EUR 1 000 of taxable income earned from employment and pensions (paragraphs 1 and 2 of Article 16 of the Greek Income Tax Law).

text: 6 Paragraph 3 of Article 16 of the Greek Income Tax Law.

text: Article 20

text: paragraph 3 of law 3842/2010 as amended by 69 of law 4446/2016.

text: Article 7

text: 9 For this purpose, the terms ‘payment account’ and ‘payment service provider’ are as defined in Directive 2015/2366 of the European Parliament and of the Council on payment services in the internal market, amending Directives

text: and

text: and

text: Regulation (EU) No 1093/2010

text: , and repealing Directive

text: (OJ L 337, 23.12.2015, p. 35).

text: 10 These are as follows: Group 1: food and non-alcoholic beverages; Group 2: alcoholic beverages and tobacco; Group 3: clothing and footwear; Group 4: housing, with the exception of expenditure for rent; Group 5: household equipment and services; Group 6: health; Group 7: transport, with the exception of expenditure for circulation tolls and for the purchase of vehicles except bicycles; Group 8: communications; Group 9: recreation and cultural activities with the exception of expenditure for the purchase of yachts, airplanes and aircrafts; Group 10: education; Group 11: hotels, cafés and restaurants; Group 12: miscellaneous goods and services

text: Article 7

text: para 1 of the draft amendments amending Article 15 of the Greek Income Tax Law. minimum e-payments threshold . The draft amendments also propose to lower the introductory income tax rates for taxable income earned from employment and pensions and maintain largely unaltered the current list of taxpayers who are exempted from the obligation to meet the revised minimum e-payments threshold. 1.7 The draft amendments propose to extend the obligation to meet the minimum e-payments threshold to income earned from real estate . In accordance with the draft amendments, failure to meet the threshold would result in the taxpayer being liable to pay an additional 22 % tax on the difference up unto the threshold for this category of income as well. 1.8 The draft amendments exclude the following from the deductible business expenditure: (i) all expenses related to the acquisition of goods or services of a value exceeding EUR 300 which have not been paid via electronic means of payment or a payment service provider; and (ii) expenses for rent which have not been paid via electronic means of payment or a payment service provider . 1.9 The draft amendments provide that certain tax deductions arising out of expenses for the acquisition of services related to the energy, functional and aesthetical upgrade of buildings will only be available if the relevant payments have been made via electronic means of payment . 1.10 It is understood that the draft amendments are intended to apply for income earned after 1 January 2020.

text: 2. General observations

text: 2.1 The ECB recalls that it was not consulted by the Greek authorities pursuant to Articles 127(4) and 282(5) of the Treaty on the existing provisions of the Income Tax Law which were adopted in 2016 in order to promote the broader use of electronic payment instruments in Greece. 2.2 Under the Treaty, the European System of Central Banks (ESCB) is required to act, inter alia, in accordance with the principle of an open market economy with free competition, favouring an

text: 12 These are proposed to be reduced to the following: (a) (i) EUR 777 for a taxpayer without dependent children; (ii) EUR 810 for a taxpayer with one dependent child; (iii) EUR 900 for a taxpayer with two dependent children; (iv) EUR 1 120 for a taxpayer with three dependent children; and (v) EUR 1340 for a taxpayer with four dependent children; for every additional dependent child the tax credit is increased by EUR 220 per child; (b) for taxable income exceeding EUR 12 000, the tax credit under (a) above is reduced by EUR 20 for every EUR 1 000 of taxable income earned from employment and pensions up to the amount of the tax credit under (a), provided however that the reductions in the tax credit under (b) do not apply to taxpayers with five (5) or more dependent children (Article 9 of the draft amendments amending Article 16 of the Greek Income Tax Law).

text: Article 7

text: para 1 of the draft amendments amending Article 15 of the Greek Income Tax Law, read together with Article 9 of the draft amendments amending Article 16 of the Greek Income Tax Law.

text: 14 These are proposed to be reduced to the following: from 22 % currently to 9 % for income between EUR 0 – EUR 10 000; for income between EUR 10 001 – EUR 20 000 the tax rate remains unaltered at 22 %; from 29 % to 28 % for income between EUR 20 001 - EUR 30 000; from 37 % to 36 % for income between EUR 30 001 - EUR 40 000; from 45 % to 44 % for income exceeding EUR 40 001 (Article 6 of the draft amendments amending Article 15 of the Greek Income Tax Law).

text: Article 7

text: para 2 of the draft amendments amending Article 40 of the Greek Income Tax Law. According to paragraph 4 of Article 40 of the Greek Income Tax Law as it currently stands, income earned from real estate is taxable separately according to the following scale: income between EUR 0 – EUR 12 000 is taxed with a 15 % rate; income between EUR 12 001 – EUR 35 000 is taxed with a 35 % rate; and income exceeding EUR 35 001 is taxed with a 45 % rate.

text: 16 Article 13 of the draft amendments amending Article 23 of the Greek Income Tax Law.

text: 17 Article 16 of the draft amendments amending

text: Article 39

text: A of the Greek Income Tax Law. efficient allocation of resources . The ESCB has the basic task of promoting the smooth operation of payment systems , and the ECB has the exclusive right to authorise the issue of euro banknotes within the Union . The euro banknotes issued by the ECB and the national central banks of the euro area shall be the only banknotes to have the status of legal tender status within the euro area . 2.3

text: Commission Recommendation 2010/191/EU

text: (hereinafter the ‘Commission Recommendation’) states that the acceptance of payments in cash should be the rule, but acknowledges that cash may be refused for reasons related to the ‘good faith principle’, without this constituting a breach of the legal tender status of cash. Neither Union law nor the Commission Recommendation explicitly addresses whether, nor to what extent, it may be permissible to introduce a more general limitation to the obligation to accept euro cash payments. Therefore, Union law must be interpreted in order to ascertain the conditions that a limitation on payments in euro notes and coins should fulfil, including the conditions that should be fulfilled to comply with the legal tender status of euro banknotes and coins when general limitations to the obligation to accept cash payments are introduced . 2.4 The draft amendments must comply with Union law; in particular, any limitation to cash payments needs to comply with the legal tender status of euro banknotes . In this context,

text: recital 19

text: of

text: Council Regulation (EC) No 974/98

text: , which states that ‘limitations on payments in notes and coins, established by Member States for public reasons, are not incompatible with the status of legal tender of euro banknotes and coins, provided that other lawful means for the settlement of monetary debts are available’ , has been taken into account in previous ECB opinions considering the introduction of cash limitations under draft national laws. While the ECB acknowledges that lawful means for the settlement of monetary debts other than cash payments, are generally available in Greece , their availability across all parts of society, at comparable costs to cash payments, should be closely verified by the Greek authorities. This is because these other means may have different characteristics compared to cash payments and hence may not be fully equivalent alternatives.

text: 18 See Article 127(1) of the Treaty and Article 2 of the Statute of the European System of Central Banks and of the European Central Bank (hereinafter the ‘Statute of the ESCB’).

text: Commission Recommendation 2010/191/EU of 22 March 2010

text: on the scope and effects of legal tender of euro banknotes and coins (OJ L 83, 30.3.2010, p 70).

text: 23 See paragraph 2.1 of Opinion

text: , paragraph 3.1 of Opinion

text: , paragraph 2.3 of Opinion

text: , paragraph 2.2 of Opinion

text: , paragraph 2.2 of Opinion

text: 24 See also paragraph 2.4 of Opinion

text: , paragraph 2.5 of Opinion

text: and paragraph 2.3 of Opinion

text: Council Regulation (EC) No 974/98 of 3 May 1998

text: on the introduction of the euro (OJ L 139, 11.5.1998, p. 1).

text: 26 See, for example, Opinions

text: and

text: 27 See paragraph 2.1 of Opinion

text: and paragraph 3.1 of Opinion

text: . 2.5 In this respect, the ECB notes that Directive

text: of the European Parliament and of the Council has made it easier for Union consumers to obtain payment accounts and related electronic payment services as alternatives to cash . In Greece, Directive

text: has been transposed by Law 4465/2017, which establishes the legal framework for the creation of the conditions for making a minimum set of banking services accessible to all consumers. However, such banking services and electronic payment services offered by commercial entities may be subject to charges. 2.6 The ECB acknowledges that the draft amendments’ objectives of (i) combating tax evasion and (ii) broadening the tax base, while maintaining fiscal balance after the decreases in corporate income tax and personal income tax may, in general, constitute ‘public reasons’ justifying the disincentivisation through taxation of, and the resulting limitation on, the use of cash payments. However, any such limitation needs to comply with the legal tender status of euro banknotes enshrined in Articles 128(1) and 282(3) of the Treaty. Therefore, it would need to be demonstrated that the proposed cash payment limitations affecting the legal tender status of euro banknotes would be effective as regards the achievement of the public objectives that are being legitimately pursued by the limitations. Hence, there should be clear evidence that such limitations are likely, in fact, to achieve the stated public goal of combating tax evasion. 2.7 Direct or indirect limitations on cash payments should also be proportionate to the objectives pursued and should not go beyond what is necessary to achieve such objectives, especially in view of the fact that the measures set out in the draft amendments affect transactions made by taxpayers who are natural persons and that they build on already existing legislative measures adopted in 2016 that impose direct limitations on cash by prohibiting all cash payments exceeding EUR 500 for consumer-to-business transactions . Any adverse impact of the proposed limitations should therefore be carefully weighed against the anticipated public benefits. When considering whether a limitation is proportionate, the adverse impact of the limitation in question should always be considered, as well as whether alternative measures could be adopted that would fulfil the relevant objective and have a less adverse impact . 2.8 Furthermore, it should be borne in mind that the ability to pay in cash remains particularly important for certain groups in society that, for various legitimate reasons, prefer to use cash rather than

text: 28 Directive

text: of the European Parliament and of the Council of 23 July 2014 on the comparability of fees related to payment accounts, payment account switching and access to payment accounts with basic features (OJ L 257, 28.8.2014, p. 214).

text: 29 Within the framework previously created by Directive

text: of the European Parliament and of the Council of 13 November 2007 on payment services in the internal market amending Directives

text: and

text: and repealing Directive

text: (OJ L 319, 5.12.2007, p. 1), which introduced the legal basis for the creation of an internal market for payments within the Union and allowed for the creation of the Single Euro Payments Area (SEPA) (the Payment Services Directive 1). The Payment Services Directive 1 has been since replaced by Directive 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives

text: and

text: and

text: Regulation (EU) No 1093/2010

text: , and repealing Directive

text: (OJ L 337, 23.12.2015, p. 35) (the Payment Services Directive 2).

text: 30 See paragraph 1.2 above.

text: 31 See, for example, paragraph 2.3 of Opinion

text: , paragraph 2.3 of Opinion

text: , paragraphs 2.6 and 2.7 of Opinion

text: , paragraphs 2.5 and 2.6 of Opinion

text: , paragraph 3.3 of Opinion

text: , paragraph 2.7 of Opinion

text: , paragraph 2.6 of Opinion

text: and paragraph 2.5 of Opinion

text: . other payment instruments. Cash is generally also appreciated as a payment instrument because it is, as legal tender, widely accepted, fast and facilitates control over the payer’s spending. Moreover, it is a means of payment that allows citizens to instantly settle a transaction and is the only method of settlement in central bank money and at face value which does not carry the legal possibility of imposing a fee for the use thereof. Also, cash payments do not require a functional technical infrastructure and related investment, and are always available; this is of particular relevance in the case of outage of electronic payments. Additionally, cash payments facilitate the inclusion of the entire population in the economy by allowing it to settle any kind of financial transaction in this way . 2.9 It should be noted that

text: Directive (EU) 2015/849

text: of the European Parliament and of the Council , while confirming the vulnerability of large cash payments to money laundering and terrorist financing, requires that persons trading in goods, who are otherwise not obliged entities under that Directive, be classified as obliged entities and apply customer due diligence measures only to the extent that payments are made or received in cash in amounts of EUR 10 000 or more. This implies that the draft law should establish a proportionate threshold for limits on cash payments, taking into account the objectives of such limits . 2.10 Against this background, the ECB considers that the existing limit on cash payments of EUR 500 for consumer-to-business transactions, and the new tax incentives discouraging companies from spending cash in excess of EUR 300, are disproportionate in light of the potentially adverse impact on the cash payment system. In case the legislator wishes to preserve cash payment limitations, higher thresholds should be chosen and a degree of flexibility should be introduced in the draft amendments. Cash transactions above the defined thresholds should be permitted as long as the parties are able to ensure that the payment is traceable by identifying the amount, the reason for the transaction and the parties involved. In addition, competent authorities are invited to assess whether the remaining restrictions on cash payments are proportionate and compatible with the legal tender status of euro banknotes , in order to ensure that the effects of these measures do not go beyond what is necessary for achieving the objective of combating tax evasion. This opinion will be published on the ECB’s website.

text: 32 See paragraph 2.6 of Opinion

text: , paragraph 3.4 of Opinion

text: , paragraph 2.8 of Opinion

text: , paragraph 2.7 of Opinion

text: , paragraph 2.6 of Opinion

text: Directive (EU) 2015/849

text: of the European Parliament and of the Council of 29 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending

text: Regulation (EU) No 648/2012

text: of the European Parliament and of the Council, and repealing Directive

text: of the European Parliament and of the Council and

text: Commission Directive 2006/70/EC

text: (OJ L 141, 5.6.2015, p. 73).

text: 34 See, for example, paragraph 3.2 of Opinion

text: , paragraph 2.10 of Opinion

text: and paragraph 3.2 of Opinion

text: . See also paragraphs 2.2 and 2.3 of Opinion

text: . Done at Frankfurt am Main, 20 November 2019. [signed] The President of the ECB Christine LAGARDE

type: vagledning

utgivare: ecb


text: Návrh zákona ktorým sa mení a dopĺňa zákon č. 384/2011 Z. z. o osobitnom odvode vybraných finančných inštitúcií a o doplnení niektorých zákonov v znení neskorších predpisov. 2

text: Council Decision 98/415/EC of 29 June 1998

text: on the consultation of the European Central Bank by national authorities regarding draft legislative provisions (OJ L 189, 3.7.1998, p. 42). 3 The liabilities are subject to the following deductions: (i) the amount of the bank’s own funds, provided that its value is positive; (ii) the value of financial resources provided to the branch of a foreign bank on a long term basis; and (iii) the value of subordinated debt.

text: See Opinion

text: , Opinion

text: , Opinion

text: and Opinion

text: . All ECB opinions are published on the ECB’s website at www.ecb.europa.eu. 5 See, for example, paragraph 2.1 of Opinion

text: and paragraph 3.1.1 of Opinion

text: . 6 See paragraph 3.1.1 of Opinion

text: . 7 See paragraph 3.2.1 of Opinion

text: . 8 See paragraph 3.2.1 of Opinion

text: , paragraph 2.1 of Opinion

text: and paragraph 3.1.2 of Opinion

text: . 9 See paragraph 4.1 of Opinion

text: . 10 See also paragraph 3.2.1 of Opinion

title: Opinion of the European Central Bank of 26 November 2019 on increasing the special levy on selected financial institutions (CON/2019/40)

text: OPINION OF THE EUROPEAN CENTRAL BANK of 26 November 2019 on increasing the special levy on selected financial institutions (

text: ) Introduction and legal basis

text: On 5 November 2019 the European Central Bank (ECB) received a request from the Ministry of Finance of the Slovak Republic for an opinion on a draft law amending Law No 384/2011 Coll. on a special levy on selected financial institutions and on amendments to certain laws (hereinafter the ‘draft law’) . The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and the sixth indent of

text: Article 2(1) of Council Decision 98/415/EC

text: , as the draft law relates to rules applicable to financial institutions insofar as they materially influence the stability of financial institutions and markets. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

text: 1. Purpose of the draft law

text: 1.1 Law No 384/2011 Coll. on a special levy on selected financial institutions and on amendments of certain laws (hereinafter the ‘Law No 384/2011’) imposes an obligation on banks and branches of foreign banks operating in Slovakia (hereinafter collectively referred to as ‘banks’) to pay a special levy. The proceeds of this special levy are state financial assets with the designated purpose of covering costs related to the resolution of financial crises in the banking sector and protecting the financial stability of the Slovak banking sector, including the replenishment of the Deposit Guarantee Fund necessary for expenses due to the payment of compensation for unavailable deposits. In accordance with Law No 384/2011, the rate of the levy during the period from 2017 to 2020 is 0.2 % of each bank’s liabilities reported in its balance sheet and 0 % as of 2021. 1.2 The draft law increases the rate of levy to 0.4 % of each bank’s liabilities as reported in the balance sheet, and does not provide for temporal limitation for the applicability of the levy.

text: 2. Impact of the increased bank levy

text: 2.1 The ECB has in the past opined on draft legislation introducing bank levies in Slovakia . The ECB has stated in earlier opinions that taxes on financial institutions should be considered in relation to the dual objective of: (a) ensuring a more equitable distribution of the costs arising from their potential failure between taxpayers and the financial sector; and (b) addressing the risks that they pose. Using the proceeds of any ad hoc taxes imposed on banks for general budgetary purposes would be undesirable, to the extent that such taxes would place undue burdens on banks, hampering the provision of credit, with a knock-on effect on growth in the real economy . The proceeds from taxes on financial institutions should be ring-fenced to avoid their use for general fiscal consolidation purposes . The ECB has recommended that it is necessary to introduce a clearer separation between the extraordinary account created out of the levy proceeds and the general budgetary resources of the Slovak Government . 2.2 The ECB understands that the obligation of the banks to pay the bank levy is additional to their obligation to pay contributions to the resolution fund and the deposit guarantee fund. The ECB has in the past recommended making clear in which part of the resolution financing process the income from the bank levy is to be employed and how bank levy proceeds will interact with the resolution fund in order to avoid duplication of instruments . In this regard, the ECB understands that the bank levy proceeds would serve as a funding backstop that is not covered by the resolution fund and for refinancing the deposit guarantee fund . 2.3 While the draft law would maintain the designated primarily financial stability purpose of the proceeds of the bank levy, it could have unintended and material adverse consequences on financial stability. The levy proceeds already constitute a significant share of bank profits, in addition to the contributions to the Deposit Guarantee Fund and the Resolution Fund. The proposed increase in the levy could disproportionately impact the profitability of the banking system, with negative consequences for internal capital generation and lending. Moreover, removing the temporal limitation on the levy could have procyclical consequences as banks may be subject to the levy even in periods of adverse macroeconomic conditions. 2.4 Therefore, the ECB recommends the legislative proposal be accompanied by a robust impact assessment detailing the net benefits of the proposed changes. At a minimum, the draft law could

text: maintain a proportionate temporal limitation for the applicability of the levy, in line with the impact assessment, to reduce ambiguity regarding the overall effects of the levy going forward. This opinion will be published on the ECB’s website. Done at Frankfurt am Main, 26 November 2019. [signed]

text: The President of the ECB

text: Christine LAGARDE


text: Prop. 2019/20:23 om skyldighet för kreditinstitut att tillhandahålla kontanttjänster.

text: Rådets beslut

text: av den 29 juni 1998 om nationella myndigheters samråd med Europeiska centralbanken rörande förslag till rättsregler (EUT L 189, 3.7.1998, s. 42).

text: Lag (2010:751) om betaltjänster.

text: Europaparlamentets och rådets direktiv 2014/92/EU av den 23 juli 2014

text: om jämförbarhet för avgifter som avser betalkonto, byte av betalkonto och tillgång till betalkonto med grundläggande funktioner (EUT L 257, 28.8.2014, s. 214).

text: Lag (2010:751) om betaltjänster.

text: Europaparlamentets och rådets direktiv (EU) 2015/2366 av den 25 november 2015

text: om betaltjänster på den inre marknaden.

text: 15 kap. 17 § i lag (2004:297) om bank- och finansieringsrörelse. Om FI meddelar föreläggande eller förbud, får FI även förelägga vite, se 15 kap. 20 § i lag (2004:297) om bank- och finansieringsrörelse. 8 15 kap. 15 § i lag (2004:297) om bank- och finansieringsrörelse. 10 Riksbankens delbetänkande (2018-10-07) avseende SOU 2018:42 Tryggad tillgång till kontanter, s. 4. 11 Kontantuttagen från uttagsautomater minskade från 270 miljarder kronor 2006 till 130 miljarder kronor 2017. Kontantbetalningar via kassaterminaler minskade från 40 procent 2010 till 15 procent 2016.

text: Prop. 2019/20:23 om skyldighet för kreditinstitut att tillhandahålla kontanttjänster, s. 31. Se yttrande

text: , CON 2017/40 och

text: . Alla ECB:s yttranden finns på ECB:s webbplats www.ecb.europa.eu. 13 Se s. 24 i Riksbankens rapport Så betalar svenskarna av den 7 november 2019, finns på https://www.riksbank.se/sv/betalningar--kontanter/sa-betalar-svenskarna/sa-betalar-svenskarna-2019/, och Riksbankens statistik över sedlar och mynt, finns på https://www.riksbank.se/sv/sedlar-och-mynt/statistik/.

sprak: sv

title: Europeiska centralbankens yttrande av den 26 november 2019 om skyldigheten för vissa kreditinstitut och filialer att tillhandahålla kontanttjänster (CON/2019/41)

text: EUROPEISKA CENTRALBANKENS YTTRANDE av den 26 november 2019 om skyldigheten för vissa kreditinstitut och filialer att tillhandahålla kontanttjänster (

text: ) Inledning och rättslig grund

text: Den 26 september 2019 överlämnades en proposition från den svenska regeringen avseende skyldighet för vissa kreditinstitut och filialer att tillhandahålla kontanttjänster till den svenska riksdagen (nedan kallat lagförslaget). ECB har beslutat att avge ett yttrande på eget initiativ över lagförslaget eftersom ECB inte formellt har rådfrågats av de svenska myndigheterna. ECB:s behörighet att avge ett yttrande grundar sig på artikel 127.4 andra stycket jämförd med artikel 2.1 andra strecksatsen i

text: rådets beslut 98/415/EG

text: , eftersom lagförslaget avser rättsregler om betalningsmedel. I enlighet med

text: artikel 17.5

text: första meningen i arbetsordningen för Europeiska centralbanken har detta yttrande antagits av ECB-rådet.

text: 1. Syftet med lagförslaget

text: 1.1 Det övergripande syftet med lagförslaget, som utgör en ändring i lagen om betaltjänster , är att underlätta den fortsatta kontantanvändningen i Sverige samt säkerställa en lämplig nivå för tillgången till kontanttjänster i hela Sverige genom att förplikta vissa svenska kreditinstitut samt vissa svenska filialer till utländska kreditinstitut (nedan kallade filialer) att tillhandahålla kontanttjänster till konsumenter och företag. Lagförslaget är tillämpligt på kreditinstitut och filialer som har en inlåning från allmänheten över 70 miljarder kronor, vilket på lagförslagets datum omfattar totalt sex institut och filialer. Eftersom dessa institut och filialer kan fullgöra sina förpliktelser genom att anlita andra kontanttjänstaktörer och dessa redan är etablerade, beräknas detta leda till begränsade kostnader. 1.2 Europaparlamentets och rådet direktiv

text: har på vederbörligt sätt införlivats i svensk lagstiftning och genomförts. Lagförslaget är tillämpligt på betalkonton i den mening som avses i direktiv

text: och

text: . Kreditinstitut som tillhandahåller betalkonton i den mening som avses i direktiv

text: är redan skyldiga att

text: erbjuda kontantuttag till konsumenter. Lagförslaget syftar till att ytterligare uppnå att kontantuttagstjänster till konsumenter samt kassainsättningstjänster till icke-konsumenter tillhandahålls på lämpligt sätt. 1.3 Enligt lagförslaget ska kreditinstitut och filialer som tillhandahåller betalkonton med grundläggande funktioner till konsumenter i Sverige tillhandahålla lämpliga kontantuttagstjänster till samtliga konsumenter som har sådana konton i Sverige. På samma sätt gäller att kreditinstitut och filialer som tillhandahåller betalkonton till företag ska tillhandahålla lämpliga tjänster för dagskasseinsättningar till samtliga kunder som innehar sådana konton i Sverige. Enligt lagförslaget bör skyldigheten att ge lämplig tillgång till kontanttjänster omfatta både närhet och tillgänglighet. 1.4 I lagförslaget anges även att staten eller en myndighet som utsetts av staten får ställa mer detaljerade krav samt att Post- och telestyrelsen ska vara behörig tillsynsmyndighet. Om ett kreditinstitut inte uppfyller sina skyldigheter ska Post- och telestyrelsen, med vissa undantag, överlämna ärendet till Finansinspektionen (FI), som får besluta att förelägga det berörda kreditinstitutet rättelse. Om institutet inte följer föreläggandet får FI besluta att institutet ska förelägga kreditinstitutet en sanktionsavgift. Om skyldigheten inte fullgörs av en filial till ett utländskt kreditinstitut med hemvist utanför EES, får FI ingripa genom rättelse, förbud, anmärkning, varning eller återkallelse av tillstånd . Om skyldigheten däremot inte fullgörs av en filial till ett utländskt kreditinstitut inom EES, får FI endast underrätta behörig tillsynsmyndighet för det utländska kreditinstitutet om att filialen inte har fullgjort sina skyldigheter enligt lagförslaget . I det sistnämnda fallet är det alltså tillsynsmyndigheten i hemstaten som får ingripa mot svenska filialer till utländska kreditinstitut med hemvist inom EEA. Vad gäller detta har FI och Riksbank i sina yttranden om bland annat lagförslagets bestämmelser konstaterat att det är osäkert om en tillsynsmyndighet i hemstaten får ingripa mot en filial till ett utländskt kreditinstitut inom EES efter det att de föreslagna skyldigheterna inte har fullgjorts . Riksbanken har även begärt ett klargörande vad gäller vilka ingripande- och sanktionsmöjligheter som tillsynsmyndigheter i andra EES-stater skulle ha om en filial till ett utländskt EES-kreditinstitut inte fullgör sina skyldigheter enligt lagförslaget . 1.5 Enligt det bakgrundsmaterial som åtföljer lagförslaget är möjligheten att göra kontantbetalningar fortfarande viktig för vissa grupper i samhället som inte kan använda andra betalningsmedel. Till dessa grupper hör äldre, nyanlända, personer med funktionsvariationer, socialt utsatta personer och andra med begränsad tillgång till digitala tjänster. Sådana grupper kan ha begränsad tillgång till den teknik som krävs för att utföra digitala betalningar och för dem kan kontanter vara det enda betalningsmedel som står till buds. Om tillgången till kontanter fortsätter att minska i nuvarande takt kan kontanternas ställning som betalningsmedel komma att äventyras. En sådan utveckling skulle kunna få en exkluderande effekt för vissa delar av befolkningen samt inverka negativt på betalningsmarknadens säkerhet, beredskap och effektivitet vid en större störning i

text: betalningssystemet. Lagförslaget kan därför bidra till att stärka beredskapen för sådana extraordinära händelser genom att säkerställa att kontanter är ett fungerande alternativ till elektroniska betalningar. Enligt det bakgrundsmaterial som åtföljer lagförslaget är det även viktigt i ett samhällsekonomiskt perspektiv att betalningssystemet är effektivt, tillgängligt och robust mot störningar.

text: 2. Allmänna kommentarer

text: 2.1 ECB förstår att elektroniska betalningsinstrument allt oftare är den betalningsmetod som föredras i Sverige, medan kontantanvändningen minskar. Kontanter är dock ett väletablerat betalningsmedel som ger omedelbar skuldreglering och direkt kontroll över betalarens utgifter. Möjligheten att betala kontant är dessutom särskilt viktig för vissa grupper i samhället som av olika legitima skäl föredrar kontanter framför andra betalningsmedel eller som inte kan använda digital teknik. Kontantbetalningar bidrar dessutom till att hela befolkningen inkluderas i ekonomin eftersom alla typer av finansiella transaktioner kan avvecklas på det här sättet . Antalet svenska sedlar i cirkulation i Sverige har dessutom ökat sedan 2017 och även om andelen identitetsstölder och kortbedrägerier fortsätter att öka är den fortfarande bland Europas lägsta . ECB noterar att kontanter kan spela en viktig roll vid en eventuell störning i betalningssystemen, men att även uttagsautomater och andra servicepunkter kan komma att påverkas eftersom de är beroende av sin samverkan med de kontoförande instituten. 2.2 ECB ser visserligen positivt på den fortsatta innovationen och utvecklingen i fråga om elektroniska betalningsinstrument, men välkomnar samtidigt huvudmålen med lagförslaget, dvs. att främja den fortsatta kontantanvändningen i det svenska samhället genom att säkerställa en lämplig nivå i fråga om tillgången till kontanttjänster i hela Sverige. 2.3 ECB anser att det är viktigt att samtliga medlemsstater, även medlemsstaterna utanför euroområdet, vidtar lämpliga åtgärder för att säkerställa att kreditinstitut och filialer som är verksamma inom deras territorier ger lämplig tillgång till kontanttjänster i syfte att främja den fortsatta kontantanvändningen. 2.4 ECB skulle slutligen välkomna ett klargörande vad gäller de ingripande- och sanktionsmöjligheter som tillsynsmyndigheten i hemstaten skulle ha om en filial till ett utländskt EES-kreditinstitut inte fullgör sina skyldigheter enligt lagförslaget.

text: Detta yttrande kommer att offentliggöras på ECB:s webbplats. Utfärdat i Frankfurt am Main den 26 november 2019. [Namnteckning] Christine LAGARDE

text: ECB:s ordförande