Sittings · Document

DRAFT REPORT (COM(2023)0367 – C90217/2023 – 2023/0210(COD)) 2023-11-13

On the proposal for a regulation of the European Parliament and of the Council on payment services in the internal market and amending Regulation (EU) No 1093/2010

Committee on Economic and Monetary Affairs · Rapporteur: Marek Belka

Official HTML ↗ PDF DOCX

PR_COD_1amCom

Symbols for procedures

* Consultation procedure

*** Consent procedure

***I Ordinary legislative procedure (first reading)

***II Ordinary legislative procedure (second reading)

***III Ordinary legislative procedure (third reading)

(The type of procedure depends on the legal basis proposed by the draft act.)

Amendments to a draft act

Amendments by Parliament set out in two columns

Deletions are indicated in bold italics in the left-hand column. Replacements are indicated in bold italics in both columns. New text is indicated in bold italics in the right-hand column.

The first and second lines of the header of each amendment identify the relevant part of the draft act under consideration. If an amendment pertains to an existing act that the draft act is seeking to amend, the amendment heading includes a third line identifying the existing act and a fourth line identifying the provision in that act that Parliament wishes to amend.

Amendments by Parliament in the form of a consolidated text

New text is highlighted in bold italics. Deletions are indicated using either the ▌symbol or strikeout. Replacements are indicated by highlighting the new text in bold italics and by deleting or striking out the text that has been replaced.

By way of exception, purely technical changes made by the drafting departments in preparing the final text are not highlighted.

DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

on the proposal for a regulation of the European Parliament and of the Council on payment services in the internal market and amending Regulation (EU) No 1093/2010

(COM(2023)0367 – C90217/2023 – 2023/0210(COD))

(Ordinary legislative procedure: first reading)

– having regard to the Commission proposal to Parliament and the Council (COM(2023)0367),

– having regard to Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90217/2023),

– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

– having regard to Rule 59 of its Rules of Procedure,

– having regard to the report of the Committee on Economic and Monetary Affairs (A90000/2023),

1. Adopts its position at first reading hereinafter set out;

2. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

3. Instructs its President to forward its position to the Council, the Commission and the national parliaments.

Amendment 1

Proposal for a regulation

Recital 13

Text proposed by the Commission

Amendment

(13) To assess whether a limited network should be excluded from scope, the geographical location of the points of acceptance of such network as well as the number of the points of acceptance should be considered. Specific-purpose instruments should allow the holder to acquire goods or services only in the physical premises of the issuer, whereas usage in an online store environment should not be covered by the notion of premises of the issuer. Specific-purpose instruments should include, depending on the respective contractual regime, cards that can only be used in a particular chain of stores or a particular shopping centre, fuel cards, membership cards, public transport cards, parking ticketing, meal vouchers or vouchers for specific services, which may be subject to a specific tax or labour legal framework designed to promote the use of such instruments to meet the objectives laid down in social legislation, such as childcare vouchers or ecological vouchers. Specific-purpose instruments should also include electronic money-based instruments once they meet the requirements of this exclusion. Payment instruments which can be used for purchases in stores of listed merchants should not be excluded, as such instruments are typically designed for a network of service providers which is continuously growing.

(13) To assess whether a limited network should be excluded from scope, the geographical location of the points of acceptance of such network as well as the number of the points of acceptance should be considered. Specific-purpose instruments should allow the holder to acquire goods or services only in the physical premises of the issuer, whereas usage in an online store environment should not be covered by the notion of premises of the issuer. Specific-purpose instruments should include, depending on the respective contractual regime, cards that can only be used in a particular chain of stores or a particular shopping centre, fuel cards, membership cards, public transport cards, parking ticketing or vouchers for specific services, which may be subject to a specific tax or labour legal framework designed to promote the use of such instruments to meet the objectives laid down in social legislation, such as childcare vouchers or ecological vouchers. Specific-purpose instruments should also include electronic money-based instruments once they meet the requirements of this exclusion. Payment instruments which can be used for purchases in stores of listed merchants should not be excluded, as such instruments are typically designed for a network of service providers which is continuously growing.

Or. en

Amendment 2

Proposal for a regulation

Recital 18

Text proposed by the Commission

Amendment

(18) Taking into account the rapid evolution of the retail payments market and the emergence of new payment services and payment solutions, it is appropriate to adapt some of the definitions under Directive (EU) 2015/2366 to the realities of the market in order to ensure that Union legislation remains fit for purpose and technology neutral. At the same time, the EBA should further develop certain definitions in draft regulatory technical standards in order to take into account the constantly changing market realities and objectively adapt them to the new reality constraints.

Or. en

Amendment 3

Proposal for a regulation

Recital 36

Text proposed by the Commission

Amendment

(36) Credit institutions should therefore provide a payment account to payment institutions, and to applicants for a license as a payment institution, as well as to their agents and distributors, except in exceptional cases where there are serious grounds to refuse access. It is necessary to include applicants for a license as a payment institution in that provision, given the fact that a bank account where clients’ funds can be safeguarded is a prerequisite to obtain a payment institution license. The grounds for refusal should include serious grounds for suspicion of illegal activities being pursued by or via the payment institution, or a business model or risk profile which causes serious risks or excessive compliance costs for the credit institution. For instance, business models where payment institutions use a vast network of agents may generate significant anti-money laundering and combating the financing of terrorism (AML/CFT) compliance costs. A payment institution should have the right of appeal against a refusal by a credit institution to a competent authority designated by a Member State. In order to facilitate the exercise of that appeal right, credit institutions should motivate in writing and in detail any refusal to provide an account, or a subsequent closure of an account. That motivation should refer to specific elements relating to the payment institution in question, not to general or generic considerations. To facilitate treatment by competent authorities of appeals against account refusal or withdrawal and motivation thereof, the EBA should develop implementing technical standards harmonising the presentation of such motivations.

(36) Credit institutions should therefore provide a payment account to payment institutions, and to applicants for a license as a payment institution, as well as to their agents and distributors, except in exceptional cases where there are serious grounds to refuse access. It is necessary to include applicants for a license as a payment institution in that provision, given the fact that a bank account where clients’ funds can be safeguarded is a prerequisite to obtain a payment institution license. The grounds for refusal should include serious, non-discriminatory and proportionate grounds for suspicion of illegal activities being pursued by or via the payment institution, or a business model or risk profile which causes serious risks or excessive compliance costs for the credit institution. For instance, business models where payment institutions use a vast network of agents may generate significant anti-money laundering and combating the financing of terrorism (AML/CFT) compliance costs. A payment institution should have the right of appeal against a refusal by a credit institution to a competent authority designated by a Member State. In order to facilitate the exercise of that appeal right, credit institutions should motivate in writing and in detail any refusal to provide an account, or a subsequent closure of an account. That motivation should refer to specific elements relating to the payment institution in question, not to general or generic considerations. To facilitate treatment by competent authorities of appeals against account refusal or withdrawal and motivation thereof, the EBA should develop implementing technical standards harmonising the presentation of such motivations.

Or. en

Amendment 4

Proposal for a regulation

Recital 45

Text proposed by the Commission

Amendment

(45) To be able to make an informed choice payment service users should be able to compare Automatic Teller Machine (ATM) charges with those of other providers. To increase the transparency of ATM charges for the payment service user payment service providers should provide payment service users with information on all applicable charges for domestic ATM withdrawals in different situations, depending on the ATM from which the payment service users withdraw cash.

(45) To be able to make an informed choice payment service users should be able to compare Automatic Teller Machine (ATM) charges with those of other providers. To increase the transparency of ATM charges for the payment service user payment service providers should provide payment service users with information on all applicable charges for ATM withdrawals in different situations, depending on the ATM from which the payment service users withdraw cash. More transparency also means better information from the payment service provider as regards the currency exchange.

Or. en

Amendment 5

Proposal for a regulation

Recital 50

Text proposed by the Commission

Amendment

(50) To achieve comparability, the estimated currency conversion charges for credit transfers and remittances carried out within the Union and from the Union to a third country should be expressed in the same way, namely as a percentage mark-up over the latest available euro foreign exchange reference rates issued by the European Central Bank (ECB). When reference is made to ‘charges’ in this Regulation, it should also cover, where applicable, ‘currency conversion’ charges.

(50) To achieve comparability, the estimated currency conversion charges for credit transfers and remittances carried out within the Union and from the Union to a third country should be expressed in the same way, namely as a charge in the currency in which the transaction is initiated. That charge should be disclosed transparently in a monetary value as a mark-up over the latest available applicable foreign exchange reference rates issued by the relevant central bank. When reference is made to ‘charges’ in this Regulation, it should also cover, where applicable, ‘currency conversion’ charges.

Or. en

Amendment 6

Proposal for a regulation

Recital 57

Text proposed by the Commission

Amendment

(57) To guarantee a high level of security in data access and exchange, access to payment accounts and the data therein should, barring specific circumstances, be provided to account information and payment initiation service providers via an interface designed and dedicated for ‘open banking’ purposes, such as an API. To that end, the account servicing payment service provider should set up a secure communication with account information and payment initiation service providers. To avoid any uncertainty as to who is accessing the payment service user’s data, the dedicated interface should enable account information and payment initiation service providers to identify themselves to the account servicing payment service provider, and to rely on all the authentication procedures provided by the account servicing payment service provider to the payment service user. Account information and payment initiation service providers should as a general rule use the interface dedicated for their access and therefore should not use the customer interface of an account servicing payment service provider for the purpose of data access, except in cases of failure or unavailability of the dedicated interface in the conditions laid down in this Regulation. In such circumstances their business continuity would be endangered by their incapacity to access the data for which they have been granted a permission. It is indispensable that account information and payment initiation service providers be at all times able to access the data indispensable for them to service their clients.

(57) To guarantee a high level of security in data access and exchange, access to payment accounts and the data therein should, barring specific circumstances, be provided to account information and payment initiation service providers via an interface designed and dedicated for ‘open banking’ purposes, such as an API. To that end, the account servicing payment service provider should set up a secure communication with account information and payment initiation service providers. To avoid any uncertainty as to who is accessing the payment service user’s data, the dedicated interface should enable account information and payment initiation service providers to identify themselves to the account servicing payment service provider, and to rely on all the authentication procedures provided by the account servicing payment service provider to the payment service user. Account information service providers and payment initiation service providers should as a general rule use the interface dedicated for their access and therefore should not use the customer interface of an account servicing payment service provider for the purpose of data access, except in cases of failure or unavailability of the dedicated interface in the conditions laid down in this Regulation. In such circumstances their business continuity would be endangered by their incapacity to access the data for which they have been granted a permission. It is indispensable that account information and payment initiation service providers be at all times able to access the data indispensable for them to service their clients.

Or. en

Amendment 7

Proposal for a regulation

Recital 60

Text proposed by the Commission

Amendment

(60) Given the dramatic impact that a prolonged unavailability of a dedicated interface would have on account information and payment initiation service providers’ business continuity, account servicing payment service providers should remedy such unavailability without delay. Account servicing payment service providers should inform account information and payment initiation service providers of any such unavailability of their dedicated interface and of the measures taken to remedy them without delay. In case of unavailability of a dedicated interface, and where no effective alternative solution is offered by the account servicing payment service provider, account information and payment initiation service providers should be able to preserve their business continuity. They should be allowed to request their national competent authority to make use of the interface provided to its users by the account servicing payment service provider until the dedicated interface is again available. The competent authority should, upon receiving the request, take its decision without delay. Pending the decision from the authority the requesting account information and payment initiation service providers should be allowed to temporarily use the interface provided to its users by the account servicing payment service provider. The relevant competent authority should set a deadline to the account servicing payment service provider to restore the full functioning of the dedicated interface, with the possibility of sanctions in case of failure to do so by the deadline. All account information and payment initiation service providers, not just those which introduced the request, should be allowed to access the data they need to ensure their business continuity.

(60) Given the dramatic impact that a prolonged unavailability of a dedicated interface would have on account information and payment initiation service providers’ business continuity, account servicing payment service providers should remedy such unavailability without delay. Account servicing payment service providers should inform account information and payment initiation service providers of any such unavailability of their dedicated interface and of the measures taken to remedy them without delay. In case of unavailability of a dedicated interface, and where no effective alternative solution is offered by the account servicing payment service provider, account information and payment initiation service providers should be able to preserve their business continuity. They should be allowed to request their national competent authority to make use of the interface provided to its users by the account servicing payment service provider until the dedicated interface is again available. The competent authority should, upon receiving the request, take its decision without delay. Pending the decision from the authority the requesting account information and payment initiation service providers should be allowed to temporarily use the interface provided to its users by the account servicing payment service provider. Where account information service providers or payment initiation service providers decide to access a payment account other than through the dedicated interface, they should afterwards inform the relevant competent authority and justify their decision. The relevant competent authority should set a deadline to the account servicing payment service provider to restore the full functioning of the dedicated interface, with the possibility of sanctions in case of failure to do so by the deadline. All account information and payment initiation service providers, not just those which introduced the request, should be allowed to access the data they need to ensure their business continuity.

Or. en

Amendment 8

Proposal for a regulation

Recital 64

Text proposed by the Commission

Amendment

(64) For the provision of payment initiation services, the account servicing payment service provider should provide the payment initiation service provider with all information accessible to it regarding the execution of the payment transaction immediately after the payment order has been received. Sometimes more information becomes available to the account servicing payment service provider after it has received the payment order, but before it has executed the payment transaction. Where relevant for the payment order and the execution of the payment transaction, the account servicing payment service provider should provide that information to the payment initiation service provider. The payment initiation service provider should benefit from the information necessary to assess the risks of non-execution of the initiated transaction. That information is indispensable to enable the payment initiation service provider to offer to a payee on behalf of whom it initiates the transaction a service whose quality can compete with other means of electronic payments available to the payee, including payment cards.

(64) For the provision of payment initiation services, the account servicing payment service provider should provide the payment initiation service provider with all information accessible to it regarding the execution of the payment transaction immediately after the payment order has been received. Sometimes more information becomes available to the account servicing payment service provider after it has received the payment order, but before it has executed the payment transaction. Where relevant for the payment order and the execution of the payment transaction, the account servicing payment service provider should provide that information to the payment initiation service provider. The payment initiation service provider should benefit only from the information necessary to assess the risks of non-execution of the initiated transaction. That information is indispensable to enable the payment initiation service provider to offer to a payee on behalf of whom it initiates the transaction a service whose quality can compete with other means of electronic payments available to the payee, including payment cards.

Or. en

Amendment 9

Proposal for a regulation

Recital 65

Text proposed by the Commission

Amendment

(65) To increase trust in open banking, it is essential that payment service users who use account information and payment initiation services be in full control of their data and have access to clear information on the data access permissions that those payment service users have granted to payment service providers, including the purpose of permission and the categories of payment account data concerned, including identity data of the account, transaction and account balance. Account servicing payment service providers should therefore make available to payment service users who use such services a ‘dashboard’, for monitoring and withdrawing or re-establishing data access granted to ‘open banking’ services providers. Permissions for initiation of one-off payments should not feature on that dashboard. A dashboard may not allow a payment service user to establish new data access permissions with an account information or payment initiation service provider to which no previous data access has been given. Account servicing payment service providers should inform account information and payment initiation service providers promptly of any withdrawal of data access. Account information and payment initiation service providers should inform account servicing payment service providers promptly of new and re-established data access permissions granted by payment service users, including the duration of validity of the permission and its purpose (in particular whether the consolidation of data is for the benefit of the user or for transmission to a third party). An account servicing payment service provider should not encourage, in any manner, a payment service user to withdraw the permissions given to account information and payment initiation service providers. The dashboard should warn the payment service user in a standard way of the risk of possible contractual consequences of withdrawal of data access to an open banking service provider, since the dashboard does not manage the contractual relationship between the user and an ‘open banking’ provider, but it is for the payment service user to verify that risk. A permissions dashboard should empower customers to manage their permissions in an informed and impartial manner and give customers a strong measure of control over how their personal and non-personal data is used. A permissions dashboard should take into account, where appropriate, the accessibility requirements under Directive (EU) 2019/882 of the European Parliament and of the Council.

(65) To increase trust in open banking, it is essential that payment service users who use account information and payment initiation services be in full control of their data and have access to clear information on the data access permissions that those payment service users have granted to payment service providers, including the purpose of permission and the categories of payment account data concerned, including identity data of the account, transaction and account balance. Account servicing payment service providers should therefore make available to payment service users who use such services a ‘dashboard’, for monitoring and withdrawing data access granted to ‘open banking’ services providers. Permissions for initiation of one-off payments should not feature on that dashboard. A dashboard may not allow a payment service user to establish new data access permissions with an account information or payment initiation service provider to which no previous data access has been given. Account servicing payment service providers should inform account information and payment initiation service providers promptly of any withdrawal of data access. Account information and payment initiation service providers should inform account servicing payment service providers promptly of new data access permissions granted by payment service users, including the duration of validity of the permission and its purpose (in particular whether the consolidation of data is for the benefit of the user or for transmission to a third party). An account servicing payment service provider should not encourage, in any manner, a payment service user to withdraw the permissions given to account information and payment initiation service providers. The dashboard should warn the payment service user in a standard way of the risk of possible contractual consequences of withdrawal of data access to an open banking service provider, since the dashboard does not manage the contractual relationship between the user and an ‘open banking’ provider, but it is for the payment service user to verify that risk. A permissions dashboard should empower customers to manage their permissions in an informed and impartial manner and give customers a strong measure of control over how their personal and non-personal data is used. A permissions dashboard should take into account, where appropriate, the accessibility requirements under Directive (EU) 2019/882 of the European Parliament and of the Council.

Or. en

Amendment 10

Proposal for a regulation

Recital 65 a (new)

Text proposed by the Commission

Amendment

(65a) The EBA should develop draft regulatory technical standards setting out a standardised list of data categories of information to be disclosed on the dashboard.

Or. en

Amendment 11

Proposal for a regulation

Recital 78

Text proposed by the Commission

Amendment

(78) Liability provisions in the case of authorised credit transfers where there was an incorrect application or malfunctioning of the service detecting discrepancies between the name and unique identifier of a payee would create the right incentives for payment service providers to provide a fully functioning service, with the aim of reducing the risk of ill-informed payment authorisations. If the payer decided to make use of such a service, the payment service provider of the payer should be held liable for the full amount of the credit transfer in cases where that payment service provider failed, whereas it should have done so if properly functioning, to notify the payer of a discrepancy between the unique identifier and the name of the payee provided by the payer and such failure caused a financial damage to the payer. Where the liability of the payment service provider of the payer is attributable to the payment service provider of the payee, the payment service provider of the payee should compensate the payment service provider of the payer for the financial damage incurred.

(78) Liability provisions in the case of authorised credit transfers where there was an incorrect application or malfunctioning of the service detecting discrepancies between the name and unique identifier of a payee as referred to in Regulation (EU) 202X/... of the European Parliament and of the Council of ... amending Regulations (EU) No 260/2012 and (EU) 2021/12301a would create the right incentives for payment service providers to provide a fully functioning service, with the aim of reducing the risk of ill-informed payment authorisations. If the payer decided to make use of such a service, the payment service provider of the payer should be held liable for the full amount of the credit transfer in cases where that payment service provider failed, whereas it should have done so if properly functioning, to notify the payer of a discrepancy between the unique identifier or any other proxy defined by the EBA and the name of the payee provided by the payer and such failure caused a financial damage to the payer. Where the liability of the payment service provider of the payer is attributable to the payment service provider of the payee, the payment service provider of the payee should compensate the payment service provider of the payer for the financial damage incurred.

_______________

1a COM(2022)546 final.

Or. en

Amendment 12

Proposal for a regulation

Recital 78 a (new)

Text proposed by the Commission

Amendment

(78a) The payment service provider should cooperate at all times with the payment service user in cases where any discrepancies in the payments are to be proven.

Or. en

Amendment 13

Proposal for a regulation

Recital 80

Text proposed by the Commission

Amendment

(80) Payment service providers could be also considered as victims of ‘spoofing’ cases, as their details were usurped. However, payment service providers have more means than consumers to put an end to these fraud cases, through adequate prevention and robust technical safeguards developed with electronic communications services providers such as mobile network operators, internet platforms etc. Cases of bank employee impersonation fraud affect the good repute of the bank, of the banking sector as a whole and may cause significant financial damages to Union consumers, affecting their trust in electronic payments and in the banking system. A good-faith consumer who has been the victim of such ‘spoofing’ fraud where fraudsters pretend to be employees of a customer's payment service provider and misuse the payment service provider's name, mail address or telephone number should therefore be entitled to a refund of the full amount of the fraudulent payment transaction from the payment service provider, unless the payer has acted fraudulently or with ‘gross negligence’. As soon as the consumer becomes aware that he or she has been a victim of that type of spoofing fraud, the consumer should without undue delay report the incident to the police, preferably via online complaint procedures, where made available by the police, and to his or her payment service provider, providing every necessary supporting evidence. No refund should be granted where those procedural conditions are not fulfilled.

(80) Payment service providers could be also considered as victims of ‘spoofing’ cases, as their details were usurped. However, payment service providers have more means than consumers to put an end to these fraud cases, through adequate prevention and robust technical safeguards developed with electronic communications services providers such as mobile network operators, internet platforms etc. Those electronic communications services should be obliged to cooperate with payment service providers in the fight against fraud. If they fail to do so, they should be held jointly responsible in the event of fraud. Cases of bank employee impersonation fraud affect the good repute of the bank, of the banking sector as a whole and may cause significant financial damages to Union consumers, affecting their trust in electronic payments and in the banking system. A good-faith consumer who has been the victim of such ‘spoofing’ fraud where fraudsters pretend to be employees of a customer's payment service provider and misuse the payment service provider's name, mail address or telephone number should therefore be entitled to a refund of the full amount of the fraudulent payment transaction from the payment service provider, unless the payer has acted fraudulently or with ‘gross negligence’. As soon as the consumer becomes aware that he or she has been a victim of that type of spoofing fraud, the consumer should without undue delay report the incident to the police, preferably via online complaint procedures, where made available by the police, and to his or her payment service provider, providing every necessary supporting evidence. No refund should be granted where those procedural conditions are not fulfilled.

Or. en

Amendment 14

Proposal for a regulation

Recital 82

Text proposed by the Commission

Amendment

(82) To assess possible negligence or gross negligence on the part of the payment service user, account should be taken of all circumstances. The evidence and degree of alleged negligence should generally be evaluated according to national law. However, while the concept of negligence implies a breach of a duty of care, ‘gross negligence’ should mean more than mere negligence, involving conduct exhibiting a significant degree of carelessness; for example, keeping the credentials used to authorise a payment transaction beside the payment instrument in a format that is open and easily detectable by third parties. The fact that a consumer has already received a refund from a payment service provider after having fallen victim of bank employee impersonation fraud and is introducing another refund claim to the same payment service provider after having been again victim of the same type of fraud could be considered as ‘gross negligence’ as that might indicate a high level of carelessness from the user who should have been more vigilant after having already be victim of the same fraudulent modus operandi.

(82) To assess possible negligence or gross negligence on the part of the payment service user, account should be taken of all circumstances. The evidence and degree of alleged negligence should generally be evaluated according to national law. However, while the concept of negligence implies a breach of a duty of care, ‘gross negligence’ should mean more than mere negligence, involving conduct exhibiting a significant degree of carelessness; for example, keeping the credentials used to authorise a payment transaction beside the payment instrument in a format that is open and easily detectable by third parties or giving an unblocked smartphone to a third party. The fact that a consumer has already received a refund from a payment service provider after having fallen victim of bank employee impersonation fraud and is introducing another refund claim to the same payment service provider after having been again victim of the same type of fraud could be considered as ‘gross negligence’ as that might indicate a high level of carelessness from the user who should have been more vigilant after having already be victim of the same fraudulent modus operandi.

Or. en

Amendment 15

Proposal for a regulation

Recital 82 a (new)

Text proposed by the Commission

Amendment

(82a) Taking into account that the term 'gross negligence' is interpreted in very different ways across the Union, the EBA should issue guidelines on how that concept is to be interpreted for the purpose of this Regulation.

Or. en

Amendment 16

Proposal for a regulation

Recital 90

Text proposed by the Commission

Amendment

(90) To improve the efficiency of payments throughout the Union, all payment orders initiated by the payer and denominated in euro or the currency of a Member State whose currency is not the euro, including non-instant credit transfers and money remittances, should be subject to a maximum 1-day execution time. For all other payments, such as payments initiated by or through a payee, including direct debits and card payments, in the absence of an explicit agreement between the payment service provider and the payer setting a longer execution time, the same 1-day execution time should apply. It should be possible to extend those periods by 1 additional business day, if a payment order is given on paper, to allow the continued provision of payment services to consumers who are used only to paper documents. When a direct debit scheme is used the payee’s payment service provider should transmit the collection order within the time limits agreed between the payee and the payment service provider, enabling settlement on the agreed due date. It should be possible to maintain or establish rules specifying an execution time shorter than 1 business day.

(90) To improve the efficiency of payments throughout the Union, all payment orders initiated by the payer and denominated in euro or the currency of a Member State whose currency is not the euro, including non-instant credit transfers and money remittances, should be subject to a maximum 1-day execution time. For all other payments, such as payments initiated by or through a payee, including direct debits and card payments, in the absence of an explicit agreement between the payment service provider and the payer setting a longer execution time, the same 1-day execution time should apply. It should be possible to extend those periods by 1 additional business day, if a payment order is given on paper, to allow the continued provision of payment services to consumers who are used only to paper documents. When a direct debit scheme is used the payee’s payment service provider should transmit the collection order within the time limits agreed between the payee and the payment service provider, enabling settlement on the agreed due date. The spending limits should be specified in the contract between the payment service provider and the payer. It should be possible to maintain or establish rules specifying an execution time shorter than 1 business day.

Or. en

Amendment 17

Proposal for a regulation

Recital 97

Text proposed by the Commission

Amendment

(97) Provision of payment services by the payment services providers may entail the processing of personal data. The provision of account information services may entail the processing of personal data concerning a data subject who is not the user of a specific payment service provider, but whose personal data processing by that specific payment service provider is necessary for the performance of a contract between the provider and the payment service user. Where personal data are processed, the processing should comply with Regulation (EU) 2016/679 and with Regulation (EU) 2018/1725 of the European Parliament and of the Council,50 including the principles of purpose limitation, data minimisation and storage limitation. Data protection by design and data protection by default should be embedded in all data processing systems developed and used within the framework of this Regulation. Therefore, the supervisory authorities under Regulation (EU) 2016/679 and Regulation (EU) 2018/1725 should be responsible for the supervision of processing of personal data carried out in the context of this Regulation.

(97) Provision of payment services by the payment services providers may entail the processing of personal data. It should be possible to carry out such processing only with the express consent of the payment service user. The provision of account information services may entail the processing of personal data concerning a data subject who is not the user of a specific payment service provider, but whose personal data processing by that specific payment service provider is necessary for the performance of a contract between the provider and the payment service user. Where personal data are processed, the processing should comply with Regulation (EU) 2016/679 and with Regulation (EU) 2018/1725 of the European Parliament and of the Council,50 including the principles of purpose limitation, data minimisation and storage limitation. Data protection by design and data protection by default should be embedded in all data processing systems developed and used within the framework of this Regulation. Therefore, the supervisory authorities under Regulation (EU) 2016/679 and Regulation (EU) 2018/1725 should be responsible for the supervision of processing of personal data carried out in the context of this Regulation.

__________________

50 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

Or. en

Amendment 18

Proposal for a regulation

Recital 100

Text proposed by the Commission

Amendment

(100) Fraudsters often target the most vulnerable individuals of our society. The timely detection of fraudulent payment transactions is essential, and transaction monitoring plays an import role in that detection. It is therefore appropriate to require payment service providers to have in place transaction monitoring mechanisms, reflecting the crucial contribution of those mechanisms to fraud prevention, going beyond the protection offered by strong customer authentication, in respect of payment transactions, including transactions involving payment initiation services.

Or. en

Amendment 19

Proposal for a regulation

Recital 100 a (new)

Text proposed by the Commission

Amendment

(100a) Member States should cooperate with payment service providers and communication services providers in order to finance education campaigns targeted at citizens on how to detect payment fraud and how to avoid becoming a victim of payment-related fraudsters. Payment service providers and communication services providers should cooperate free of charge on that issue with Member States.

Or. en

Amendment 20

Proposal for a regulation

Recital 103

Text proposed by the Commission

Amendment

(103) Fraud in credit transfers is inherently adaptive and comprises an open-ended diversity of practices and techniques, including the stealing of authentication credentials, invoice tampering, and social manipulation. Therefore, to be able to prevent ever new types of fraud, transaction monitoring should be constantly improved, making full use of technology such as artificial intelligence. Often one payment service provider does not have the full picture about all elements that could lead to timely fraud detection. However, it can be made more effective with a greater amount of information on potentially fraudulent activity stemming from other payment service providers. Therefore, sharing of all relevant information between payment service providers should be possible. To better detect fraudulent payment transactions and protect their customers, payment services providers should, for the purpose of transaction monitoring, make use of payment fraud data shared by other payment services providers on a multilateral basis such as dedicated IT platforms based on information sharing arrangements. To improve the protection of payers against fraud in credit transfers, payment service providers should be able to rely on information as comprehensive and up to date as possible, namely by collectively using information concerning unique identifiers, manipulation techniques and other circumstances associated with fraudulent credit transfers identified individually by each payment services provider. Before concluding an information sharing arrangement, payment service providers should carry out a data protection impact assessment, in accordance with Article 35 of Regulation (EU) 2016/679. Where the data protection impact assessment indicates that the processing would, in the absence of safeguards, security measures and mechanisms to mitigate the risk, result in a high risk to the rights and freedoms of natural persons, payment service providers should consult the relevant data protection authority in accordance with Article 36 of that Regulation (EU) 2016/679. A new impact assessment should not be required when a payment service provider joins an existing information sharing arrangement for which a data protection impact assessment has already been carried out. The information sharing arrangement should lay down technical and organisational measures to protect personal data. It should lay down roles and responsibilities under data protection laws, including in case of joint controllers, of all payment service providers.

(103) Fraud in credit transfers is inherently adaptive and comprises an open-ended diversity of practices and techniques, including the stealing of authentication credentials, invoice tampering, and social manipulation. Therefore, to be able to prevent ever new types of fraud, transaction monitoring should be constantly improved, making full use of technology such as artificial intelligence. Often one payment service provider does not have the full picture about all elements that could lead to timely fraud detection. However, it can be made more effective with a greater amount of information on potentially fraudulent activity stemming from other payment service providers. Therefore, sharing of all relevant information between payment service providers should be obligatory. To better detect fraudulent payment transactions and protect their customers, payment services providers should, for the purpose of transaction monitoring, make use of payment fraud data shared by other payment services providers on a multilateral basis such as dedicated IT platforms based on information sharing arrangements. To improve the protection of payers against fraud in credit transfers, payment service providers should be able to rely on information as comprehensive and up to date as possible, namely by collectively using information concerning unique identifiers, manipulation techniques and other circumstances associated with fraudulent credit transfers identified individually by each payment services provider. Before concluding an information sharing arrangement, payment service providers should carry out a data protection impact assessment, in accordance with Article 35 of Regulation (EU) 2016/679. Where the data protection impact assessment indicates that the processing would, in the absence of safeguards, security measures and mechanisms to mitigate the risk, result in a high risk to the rights and freedoms of natural persons, payment service providers should consult the relevant data protection authority in accordance with Article 36 of that Regulation (EU) 2016/679. A new impact assessment should not be required when a payment service provider joins an existing information sharing arrangement for which a data protection impact assessment has already been carried out. The information sharing arrangement should lay down technical and organisational measures to protect personal data. It should lay down roles and responsibilities under data protection laws, including in case of joint controllers, of all payment service providers.

Or. en

Amendment 21

Proposal for a regulation

Recital 103 a (new)

Text proposed by the Commission

Amendment

(103a) The EBA should set up a dedicated IT platform to exchange information on fraudulent accounts.

Or. en

Amendment 22

Proposal for a regulation

Recital 103 b (new)

Text proposed by the Commission

Amendment

(103b) Where a payment service provider was informed beforehand of fraudulent behaviour by an account and does not block that account, it should cover the financial losses incurred by a payment service user that is a victim of such fraud.

Or. en

Amendment 23

Proposal for a regulation

Recital 104

Text proposed by the Commission

Amendment

(104) For the purpose of exchanging personal data with other payment service providers who are subject to information sharing arrangements, ‘unique identifier’ should be understood as referring to a service that ensures verification of the identity of the payee as defined in Regulation (EU) 260/2012. Pursuant to this Regulation, the unique identifier should be verified for all credit transfers, and not only credit transfers in euro.

Or. en

Amendment 24

Proposal for a regulation

Recital 108

Text proposed by the Commission

Amendment

(108) SCA should not be circumvented notably by any unjustified reliance on SCA exemptions. Clear definitions of Merchant Initiated Transactions (MITs) and of Mail Orders or Telephone Orders (MOTOs) should be introduced since these notions, which may be relied upon to justify non-application of SCA, are diversely understood and applied and are subject to abusive reliance. Regarding MITs, strong customer authentication should be applied at the set-up of the initial mandate, without the need to apply SCA for subsequent merchant-initiated payment transactions. Regarding MOTOs, only the initiation of payment transactions - not their execution - should be non-digital for a transaction to be considered as a MOTO and, therefore, not be covered by the obligation to apply SCA. However, payment transactions based on paper-based payment orders, mail orders or telephone orders placed by the payer should still entail security requirements and checks by the payment service provider of the payer allowing authentication of the payment transaction. SCA should also not be circumvented by practices including resorting to an acquirer established outside of the Union to escape the SCA requirements.

Or. en

Amendment 25

Proposal for a regulation

Recital 110

Text proposed by the Commission

Amendment

(110) To improve financial inclusion, and in line with Directive (EU) 2019/882 of the European Parliament and of the Council51 on accessibility requirements for products and services, all payment service users, including persons with disabilities, older persons, persons with low digital skills and those who do not have access to digital devices such as smartphones, should benefit from the protection against fraud which is provided by SCA, in particular when it comes to the use of remote digital payment transactions and online access to payment accounts as fundamental financial services. With the introduction of SCA, certain consumers in the Union found it impossible to carry out online transactions because of their material incapability of performing SCA. Therefore, payment service providers should ensure that their customers can benefit from various methods to perform SCA which are adapted to their needs and situations. These methods should not depend on one single technology, device or mechanism, or on the possession of a smartphone.

__________________

51 Directive (EU) 2019/882 of the European Parliament and of the Council of 17 April 2019 on the accessibility requirements for products and services (OJ L 151, 7.6.2019, p. 70).

Or. en

Amendment 26

Proposal for a regulation

Recital 122

Text proposed by the Commission

Amendment

(122) Without prejudice to the right of customers to bring action in courts, Member States should ensure the existence of easily accessible, adequate, independent, impartial, transparent and effective ADR procedures between payment service providers and payment service users. Regulation (EC) No 593/2008 of the European Parliament and of the Council53 provides that the protection afforded to consumers by the mandatory rules of the law of the country in which they have their habitual residence is not to be undermined by any contractual terms concerning the law applicable to the contract. With a view to establishing an efficient and effective dispute resolution procedure, Member States should ensure that payment service providers subscribe to an ADR procedure in compliance with the quality requirements laid down in Directive 2013/11/EU of the European Parliament and of the Council54 , to resolve disputes before resorting to a court. Designated competent authorities should notify the Commission of a competent quality ADR entity or entities on their territory to resolve national and cross-border disputes and to cooperate with regard to disputes concerning rights and obligations pursuant to this Regulation.

__________________

53 OJ L 177, 4.7.2008, p. 6–16.

54 Directive 2013/11/EU of the European Parliament and of the Council of 21 May 2013 on alternative dispute resolution for consumer disputes and amending Regulation (EC) No 2006/2004 and Directive 2009/22/EC (OJ L 165, 18.6.2013, p. 63–79).

Or. en

Amendment 27

Proposal for a regulation

Article 2 – paragraph 2 – point j – point iii

Text proposed by the Commission

Amendment

(iii) instruments valid only in a single Member State, which are provided at the request of an undertaking or a public sector entity and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers having a commercial agreement with the issuer;

deleted

Or. en

Justification

This Regulation should cover instruments such as grocery or meal vouchers, which currently often face a high cap from merchants and, hence, discourage merchants from accepting such vouchers.

Amendment 28

Proposal for a regulation

Article 2 – paragraph 7

Text proposed by the Commission

Amendment

7. By [ OP please insert the date= one year after the date of entry into force of this Regulation], the EBA shall issue Guidelines in accordance with Article 16 of Regulation (EU) No 1093/2010, addressed to the competent authorities designated under this Regulation, on the exclusion for payment transactions from the payer to the payee through a commercial agent referred to in paragraph 2, point (b) of this Article.

7. By [ OP please insert the date= one year after the date of entry into force of this Regulation], the EBA shall develop draft regulatory technical standards specifying the criteria for the exclusion for payment transactions from the payer to the payee through a commercial agent referred to in paragraph 2, point (b) of this Article.

The EBA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by ... [one year from the date of entry into force of this Regulation].

Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

Or. en

Amendment 29

Proposal for a regulation

Article 3 – paragraph 1 – point 36 a (new)

Text proposed by the Commission

Amendment

(36a) 'e-wallet provider' means a provider that offers consumers an interface to manage one or more payment instruments, such as payment cards, in one application without possessing at any point in time the funds to be transferred;

Or. en

Amendment 30

Proposal for a regulation

Article 3 – paragraph 1 – point 39

Text proposed by the Commission

Amendment

(39) ‘unique identifier’ means a combination of letters, numbers or symbols specified by the payment service provider to the payment service user and to be provided by the payment service user to identify unambiguously another payment service user or the payment account of that other payment service user for a payment transaction;

Or. en

Amendment 31

Proposal for a regulation

Article 3 – paragraph 1 – point 53

Text proposed by the Commission

Amendment

(53) ‘commercial trade name’ means the name which is commonly used by the payee to identify itself to the payer;

(53) ‘commercial trade name’ means the name which is commonly used by the payee in the trade and marketing of its business to identify itself to the payer;

Or. en

Amendment 32

Proposal for a regulation

Article 3 – paragraph 1 – point 55 a (new)

Text proposed by the Commission

Amendment

(55a) 'electronic communications service provider' means any provider of electronic communications services as defined in Article 2(4) of Directive 2018/19721a of the European Parliament and of the Council (European electronic communications code) or a core platform service as defined in Article 2(2) of Regulation (EU) 2022/19251b of the European Parliament an of the Council (Digital Markets Act);

__________________

1a Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (OJ L 321, 17.12.2018, p. 36).

1b Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (OJ L 265, 12.10.2022, p. 1).

Or. en

Amendment 33

Proposal for a regulation

Article 3 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

For the purpose of paragraph 1, point (39), the EBA, taking into account relevant market practices, shall develop draft regulatory technical standards setting out an exhaustive list of the methods that can be used as a unique identifier.

The EBA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by ... [12 months from the date of entry into force of this Regulation].

Or. en

Amendment 34

Proposal for a regulation

Article 5 – paragraph 2

Text proposed by the Commission

Amendment

2. Where a currency conversion service is offered prior to the initiation of the payment transaction and where that currency conversion service is offered at an ATM, at the point of sale or by the payee, the party offering the currency conversion service to the payer shall disclose to the payer all charges and the exchange rate to be used for converting the payment transaction. Those charges shall include any mark-up over the latest available applicable foreign exchange rate issued by the relevant central bank. The information on charges and the exchange rate shall be visible in a prominent and transparent manner.

Or. en

Amendment 35

Proposal for a regulation

Article 7 – paragraph 1

Text proposed by the Commission

Amendment

Natural or legal persons providing cash withdrawal services as referred to in Article 38 of Directive (EU) [PSD3] shall provide or make available to their customers information on any charges before the customer carries out the withdrawal as well as upon receipt of the cash when the transaction is completed.

Natural or legal persons providing cash withdrawal services as referred to in Article 38 of Directive (EU) [PSD3] shall provide in a transparent, distinguishable and understandable way to their customers information on any charges, including the exchange rate and any mark-up over the latest available applicable foreign exchange rate issued by the relevant central bank, directly before the customer carries out the withdrawal as well as upon receipt of the cash when the transaction is completed.

Or. en

Amendment 36

Proposal for a regulation

Article 13 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

1. Payment service providers shall provide or make available to payment service users the following information and conditions:

1. Payment service providers shall provide in a transparent, distinguishable and understandable way to payment service users the following information and conditions:

Or. en

Amendment 37

Proposal for a regulation

Article 13 – paragraph 1 – point f

Text proposed by the Commission

Amendment

(f) where applicable, the estimated charges for currency conversion in relation to credit transfers and money remittance transactions, expressed as a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank;

(f) where applicable, the estimated charges for currency conversion in relation to credit transfers and money remittance transactions, expressed as a percentage mark-up or a mark-up in monetary value in the payer's currency over the latest available applicable foreign exchange reference rate issued by the relevant central bank;

Or. en

Amendment 38

Proposal for a regulation

Article 20 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

The payment service provider shall provide the following information and conditions to the payment service user:

The payment service provider shall provide in a transparent, distinguishable and understandable way the following information and conditions to the payment service user:

Or. en

Amendment 39

Proposal for a regulation

Article 20 – paragraph 1 – point c – point v

Text proposed by the Commission

Amendment

(v) where applicable, the estimated charges for currency conversion services in relation to a credit transfer expressed as a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank;

(v) where applicable, the estimated charges for currency conversion services in relation to a credit transfer expressed as a percentage mark-up or a mark-up in monetary value in the currency of the payer's account over the latest available applicable foreign exchange reference rate issued by the relevant central bank;

Or. en

Amendment 40

Proposal for a regulation

Article 32 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

1. A credit institution shall only refuse to open or shall only close a payment account for a payment institution for its agents or distributors or for an applicant for a license as a payment institution in the following cases:

1. A credit institution may refuse to open or may close a payment account for a payment institution for its agents or distributors or for an applicant for a license as a payment institution in cases where it is justified on objective, non-discriminatory and proportionate grounds, in particular in the following cases:

Or. en

Amendment 41

Proposal for a regulation

Article 32 – paragraph 1 – point e a (new)

Text proposed by the Commission

Amendment

(ea) the competent authority has refused to grant or has withdrawn an authorisation as a payment institution.

Or. en

Amendment 42

Proposal for a regulation

Article 32 – paragraph 4

Text proposed by the Commission

Amendment

4. A payment institution or its agents or distributors, or an applicant for a license as a payment institution which is the subject of a negative decision by a credit institution on access or of a decision on closure from payment accounts services may appeal to a competent authority.

4. A payment institution or its agents or distributors, or an applicant for a license as a payment institution which is the subject of a negative decision by a credit institution on the opening of a payment account or of a decision on closure of the payment accounts may appeal to a competent authority.

Or. en

Amendment 43

Proposal for a regulation

Article 32 – paragraph 5 – subparagraph 1

Text proposed by the Commission

Amendment

The EBA shall develop draft regulatory technical standards specifying the harmonised format and information to be contained in the notification and motivation referred to in paragraph 3 of this Article and specifying the situations in which a credit institution is able to refuse to open or is able to close a payment account for a payment institution, its agents or distributors or for an applicant for a licence as a payment institution.

Or. en

Amendment 44

Proposal for a regulation

Article 36 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) the dedicated interface shall ensure the integrity and confidentiality of the personalised security credentials and of authentication codes transmitted by or through the payment initiation service provider or the account information service provider;

(b) the dedicated interface shall apply re-direction to ensure the integrity and confidentiality of the personalised security credentials and of authentication codes transmitted by or through the payment initiation service provider or the account information service provider;

Or. en

Amendment 45

Proposal for a regulation

Article 37 – title

Text proposed by the Commission

Amendment

Data access parity between dedicated access interface and customer interface

Data access for third parties

Or. en

Amendment 46

Proposal for a regulation

Article 37 – paragraph 2

Text proposed by the Commission

Amendment

2. Account servicing payment service providers shall provide account information services providers with at least the same information from designated payment accounts and associated payment transactions made available to the payment service user when directly requesting access to the account information, provided that this information does not include sensitive payment data.

2. Account servicing payment service providers shall provide account information services providers with the information from designated payment accounts and associated payment transactions that is needed to fulfil the contract with their payment service users, provided that this information does not include sensitive payment data.

Or. en

Amendment 47

Proposal for a regulation

Article 37 – paragraph 3

Text proposed by the Commission

Amendment

3. Account servicing payment service providers shall provide payment initiation service providers with at least the same information on the initiation and execution of the payment transaction provided or made available to the payment service user when the transaction is initiated directly by the payment service user. That information shall be provided immediately after receipt of the payment order and on an ongoing basis until the payment is final.

3. Account servicing payment service providers shall provide payment initiation service providers with precisely the same information needed on the initiation and execution of the payment transaction provided or made available to the payment service user as when the transaction is initiated directly by the payment service user. That information shall be provided immediately after receipt of the payment order and on an ongoing basis until the payment is final.

Or. en

Amendment 48

Proposal for a regulation

Article 37 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

3a. This Article shall be applied in accordance with Regulation (EU) 2016/679.

The EBA, in close cooperation with the European Data Protection Board, shall develop guidelines on the implementation of this Article.

Or. en

Amendment 49

Proposal for a regulation

Article 43 – paragraph 2 – point a – introductory part

Text proposed by the Commission

Amendment

(a) provide the payment service user with an overview of each ongoing permission given for the purposes of account information services or payment initiation services, including:

(a) provide the payment service user, to the extent that the information is possessed by the account servicing payment service provider, with an overview of each ongoing permission given for the purposes of account information services or payment initiation services, including:

Or. en

Amendment 50

Proposal for a regulation

Article 43 – paragraph 2 – point a – point v a (new)

Text proposed by the Commission

Amendment

(va) the dates on which data was accessed and the type of data that was retrieved during that access.

Or. en

Amendment 51

Proposal for a regulation

Article 43 – paragraph 2 – point b

Text proposed by the Commission

Amendment

(b) allow the payment service user to withdraw data access for a given account information service or payment initiation service provider;

(b) allow the payment service user to withdraw data access for all account information services or payment initiation service providers or for a given account information service or payment initiation service provider;

Or. en

Amendment 52

Proposal for a regulation

Article 43 – paragraph 2 – point c

Text proposed by the Commission

Amendment

deleted

Or. en

Amendment 53

Proposal for a regulation

Article 43 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2a. The EBA shall develop draft regulatory technical standards to specify the categories of data referred to in paragraph 2, point (a)(v), so that the data are easily understandable for consumers.

The EBA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by ... [one year from the date of entry into force of this Regulation].

Or. en

Amendment 54

Proposal for a regulation

Article 43 – paragraph 2 b (new)

Text proposed by the Commission

Amendment

2b. Where, pursuant to paragraph 2, point (b), a payment services user decides to withdraw data access, the account information service provider or payment initiation service provider concerned shall:

(a) no longer use the data;

(b) withdraw the data; and

Or. en

Amendment 55

Proposal for a regulation

Article 44 – paragraph 1 – subparagraph 2 – point j

Text proposed by the Commission

Amendment

(j) imposing an account information or payment initiation journey, in a ‘redirection’ or ‘decoupled’ approach, where the authentication of the payment service user with the account servicing payment service provider adds additional steps or required actions in the user journey compared to the equivalent authentication procedure offered to payment service users when directly accessing their payment accounts or initiating a payment with the account servicing payment service provider;

deleted

Or. en

Amendment 56

Proposal for a regulation

Article 44 – paragraph 1 – subparagraph 2 – point k

Text proposed by the Commission

Amendment

(k) imposing that the user be automatically redirected, at the stage of authentication, to the account servicing payment service provider’s web page address when this is the sole method of carrying out the authentication of the payment services user that is supported by an account servicing payment service provider;

deleted

Or. en

Amendment 57

Proposal for a regulation

Article 46 – paragraph 1 – point d

Text proposed by the Commission

Amendment

(d) ensure that the personalised security credentials of the payment services user are not, with the exception of the payer and the issuer of the personalised security credentials, accessible to other parties and that they are transmitted by the payment initiation service provider through safe and efficient channels;

(d) ensure that the personalised security credentials of the payment services user are not, with the exception of the payer and the issuer of the personalised security credentials, accessible to other parties, including the payment initiation service provider itself, and that they are transmitted by the payment initiation service provider through safe and efficient channels;

Or. en

Amendment 58

Proposal for a regulation

Article 46 – paragraph 2 – point a

Text proposed by the Commission

Amendment

(a) store sensitive payment data of the payment service user;

(a) store, use and access sensitive payment data of the payment service user;

Or. en

Amendment 59

Proposal for a regulation

Article 47 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) ensure that the personalised security credentials of the payment service user are not accessible to other parties, with the exception of the user and the issuer of the personalised security credentials, and that when those credentials are transmitted by the account information service provider, transmission is done through safe and efficient channels;

(b) ensure that the personalised security credentials of the payment service user are not accessible to other parties, including the account information service provider itself, with the exception of the user and the issuer of the personalised security credentials, and that when those credentials are transmitted by the account information service provider, transmission is done through safe and efficient channels;

Or. en

Amendment 60

Proposal for a regulation

Article 49 – paragraph 4

Text proposed by the Commission

Amendment

4. Account servicing payment service providers shall not verify the permission given by the payment service user to the account information service provider or payment initiation service provider.

4. Account servicing payment service providers shall verify the permission given by the payment service user to the account information service provider or payment initiation service provider.

Or. en

Amendment 61

Proposal for a regulation

Article 49 – paragraph 5

Text proposed by the Commission

Amendment

5. The permission referred to in paragraphs 1 and 2 shall be expressed in the form agreed between the payer and the relevant payment service provider. Permission to execute a payment transaction may also be expressed via the payee or the payment initiation service provider. The registered use of a valid payment instrument by the payer and the use of the payer's personalised security credentials shall be considered to be the expression of the permission to execute a payment transaction. If the required authentication has been carried out with respect to a payment transaction, and the transaction was accurately recorded, entered in the accounts, and not affected by a technical breakdown or some other deficiency of the payment service provided by the payment service provider, the payer's permission to execute the payment transaction shall be presumed to have been expressed until evidence demonstrating the lack of expression is collected and properly evaluated. The payment service provider shall provide to the payment service user all relevant information in cases where the granting of the permission is being questioned by the payment service user and the payment service user is gathering information to prove the lack of expression of permission to execute the transaction.

Or. en

Amendment 62

Proposal for a regulation

Article 50 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. The EBA, taking into account the definition of a unique identifier as well as current practices on the market, shall develop draft regulatory technical standards setting out an exhaustive list of the methods that can be used as a unique identifier with reference to paragraph 1.

The EBA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by ... [12 months from the date of entry into force of this Regulation].

Under this Regulation, the 'unique identifier' check shall be carried out for euro and non-euro transfers in the Union.

Or. en

Amendment 63

Proposal for a regulation

Article 51 – paragraph 1

Text proposed by the Commission

Amendment

1. Where a specific payment instrument is used for the purposes of giving permission, the payer and the payer’s payment service provider may agree on spending limits for payment transactions executed through that payment instrument. Payment service providers shall not unilaterally increase the spending limits agreed with their payment service users.

1. Where a specific payment instrument is used for the purposes of giving permission, the payer’s payment service provider shall offer to the payment service user the possibility of setting spending limits for payment transactions executed through that payment instrument. Payment service providers shall not unilaterally increase the spending limits agreed with their payment service users. By default, the spending limit set shall be at a low level and shall be specified in the contract between the payment service provider and the payer.

Or. en

Amendment 64

Proposal for a regulation

Article 52 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) notify the payment service provider, or the entity specified by the payment service provider, without undue delay on becoming aware of the loss, theft, misappropriation or unauthorised use of the payment instrument.

Or. en

Amendment 65

Proposal for a regulation

Article 53 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) ensure that appropriate means are available at all times to enable the payment service user to make a notification pursuant to Article 52 point (b), or to request unblocking of the payment instrument pursuant to Article 51(4);

(c) ensure that appropriate means, including a free of charge telephone line allowing for personal human support in the language of the host Member State, are available at all times to enable the payment service user to:

(i) make a notification pursuant to Article 52 point (b), or to request unblocking of the payment instrument pursuant to Article 51(4);

(ii) notify a fraudulent transaction;

(iii) receive feedback when the payment service user suspects a fraud;

Or. en

Amendment 66

Proposal for a regulation

Article 53 – paragraph 1 – point e a (new)

Text proposed by the Commission

Amendment

(ea) use safe communication channels and refrain from sending links and documents via e-mail;

Or. en

Amendment 67

Proposal for a regulation

Article 53 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2a. Where the payer's payment service provider does not comply with the obligations set out in this Article, the payer shall not bear any resulting financial losses unless the payer acted fraudulently.

The burden of proof shall lie on the payment service provider to prove that it complied with this Article.

Or. en

Amendment 68

Proposal for a regulation

Article 55 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2a. This Article shall be without prejudice to Article 49.

Or. en

Amendment 69

Proposal for a regulation

Article 56 – paragraph 2 – point b

Text proposed by the Commission

Amendment

(b) provide a justification for refusing the refund and indicate the bodies to which the payer may refer the matter in accordance with Articles 90, 91, 93, 94 and 95 if the payer does not accept the reasons provided.

(b) provide a justification to the payer for refusing the refund, provide proof that the payer acted fraudulently and indicate the bodies to which the payer may refer the matter in accordance with Articles 90, 91, 93, 94 and 95 if the payer does not accept the reasons provided.

Or. en

Amendment 70

Proposal for a regulation

Article 57 – paragraph 2 – point b

Text proposed by the Commission

Amendment

(b) provide an accurate justification for refusing the refund, provide proof to the relevant competent authority that there was no infringement of Article 50(1) and indicate the bodies to which the payer may refer the matter in accordance with Articles 90, 91, 93, 94 and 95 if the payer does not accept the reasons provided.

Or. en

Amendment 71

Proposal for a regulation

Article 58 – paragraph 1

Text proposed by the Commission

Amendment

Technical service providers and operators of payment schemes that either provide services to the payee, or to the payment service provider of the payee or of the payer, shall be liable for any financial damage caused to the payee, to the payment service provider of the payee or of the payer for their failure, within the remit of their contractual relationship, to provide the services that are necessary to enable the application of strong customer authentication.

Technical service providers, e-wallet providers and operators of payment schemes that either provide services to the payee, or to the payment service provider of the payee or of the payer, shall be liable for any financial damage caused to the payee, to the payment service provider of the payee or of the payer for their failure, within the remit of their contractual relationship, to provide the services that are necessary to enable the application of strong customer authentication.

Or. en

Amendment 72

Proposal for a regulation

Article 59 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. In order to avoid fraud within their purview, electronic communications service providers and payment service providers shall ensure that all required technological safeguards, particularly those pertaining to the security of the communication between payment service providers and payment service users, are in place. Those technological safeguards shall be provided free of charge.

Electronic communications providers shall have in place at least the following technical safeguards in order to prevent fraudulent activities:

(a) verifying the legitimacy of all calls and messages that are routed through telecommunication networks;

(b) preventing the use of a specific telephone number in violation of its attribution, authorisation, or allocation;

(c) preventing the creation of fraudulent websites and preventing internet search engines from displaying those websites in their list of results;

(d) storing proof of IT and identity verification measures, in particular in the event of sim swap, to justify their due diligence.

If electronic communications service providers fail to establish the technical safeguards set out in the first subparagraph, they shall be financially liable towards the payer’s payment service provider for the amount that the payment service provider has refunded to the payment service user.

Or. en

Amendment 73

Proposal for a regulation

Article 59 – paragraph 5

Text proposed by the Commission

Amendment

5. Where informed by a payment service provider of the occurrence of the type of fraud as referred to in paragraph 1, electronic communications services providers shall cooperate closely with payment service providers and act swiftly to ensure that appropriate organizational and technical measures are in place to safeguard the security and confidentiality of communications in accordance with Directive 2002/58/EC, including with regard to calling line identification and electronic mail address.

5. Where informed by a payment service provider of the occurrence of any type of fraud , electronic communications services providers shall immediately cooperate closely with payment service providers and act swiftly to ensure that the essential organizational and technical measures referred to in paragraph 1a of this Article are in place to safeguard the security and confidentiality of communications in accordance with Directive 2002/58/EC, including with regard to calling line identification and electronic mail address.

Or. en

Amendment 74

Proposal for a regulation

Article 59 – paragraph 5 a (new)

Text proposed by the Commission

Amendment

5a. Electronic communications service providers shall have in place all necessary educational measures, including alerts to their customers via all appropriate means and media when new forms of online scams emerge, taking into account the needs of their most vulnerable groups of customers.

Electronic communications service providers shall give their customers clear indications as to how to identify fraudulent attempts and warn them as to the necessary actions and precautions to be taken to avoid falling victim to fraudulent actions targeting them. Electronic communications service providers shall inform their customers of the procedure for reporting fraudulent actions and how to rapidly obtain fraud-related information.

Or. en

Amendment 75

Proposal for a regulation

Article 60 – paragraph 1 – subparagraph 2 – point a

Text proposed by the Commission

Amendment

(a) the loss, theft or misappropriation of a payment instrument was not detectable to the payer prior to a payment, except where the payer has acted fraudulently; or

(a) the loss, theft or misappropriation of security credentials or a payment instrument was not detectable to the payer prior to a payment, except where the payer has acted fraudulently; or

Or. en

Amendment 76

Proposal for a regulation

Article 60 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. Where the payer’s payment service provider has reasonable grounds to suspect fraud or gross negligence by the consumer, within 10 business days after noting or being notified of the fraudulent authorised payment transaction, the payment service provider shall do one of the following:

(a) refund the consumer the amount of the fraudulent authorised payment transaction;

(b) provide proof that the consumer has acted fraudulently or with gross negligence to the relevant national authority and provide to the payer a substantiated justification for refusing the refund and indicate to the consumer the bodies to which the consumer can refer the matter in accordance with Articles 90, 91, 93, 94 and 95 if the consumer does not accept the reasons provided.

Or. en

Amendment 77

Proposal for a regulation

Article 63 a (new)

Text proposed by the Commission

Amendment

Article 63a

Education on fraud

Member States shall allocate substantial means to invest in education on payment-related fraud. Such education may take the form of a media campaign or lessons at schools. Payment service providers and electronic communications service providers shall cooperate free of charge with the Member States in those educational activities. Member States shall inform the Parliament, the Commission and the EBA about the planned campaigns.

Or. en

Amendment 78

Proposal for a regulation

Article 80 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

Payment systems and payment service providers shall be allowed to process special categories of personal data as referred to in Article 9(1) of Regulation (EU) 2016/679 and Article 10(1) of Regulation (EU) 2018/1725 to the extent necessary for the provision of payment services and for compliance with obligations under this Regulation, in the public interest of the well-functioning of the internal market for payment services, subject to appropriate safeguards for the fundamental rights and freedoms of natural persons, including the following:

Payment service providers shall only access, retain and process personal data necessary for the provision of their payment services, with the explicit consent of the payment service user.

Or. en

Amendment 79

Proposal for a regulation

Article 80 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) technical measures to ensure compliance with the principles of purpose limitation, data minimisation and storage limitation, as laid down in Regulation (EU) 2016/679, including technical limitations on the re-use of data and use of state-of-the-art security and privacy-preserving measures, including pseudonymisation, or encryption;

deleted

Or. en

Amendment 80

Proposal for a regulation

Article 80 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) organizational measures, including training on processing special categories of data, limiting access to special categories of data and recording such access.

deleted

Or. en

Amendment 81

Proposal for a regulation

Article 81 – paragraph 1 – subparagraph 1

Text proposed by the Commission

Amendment

Payment service providers shall establish a framework with appropriate mitigation measures and control mechanisms to manage operational and security risks relating to the payment services they provide. As part of that framework, payment service providers shall establish and maintain effective incident management procedures, including for the detection and classification of major operational and security incidents.

Payment service providers and e-wallet providers shall establish a framework with appropriate mitigation measures and control mechanisms to manage operational and security risks relating to the payment services they provide. As part of that framework, payment service providers shall establish and maintain effective incident management procedures, including for the detection and classification of major operational and security incidents.

Or. en

Amendment 82

Proposal for a regulation

Article 81 – paragraph 1 – subparagraph 2 – point a

Text proposed by the Commission

Amendment

(a) payment service providers referred to in Article 2(1), points (a), (b) and (d) of this Regulation;

(a) payment service providers and e-wallet providers referred to in Article 2(1), points (a), (b) and (d) of this Regulation;

Or. en

Amendment 83

Proposal for a regulation

Article 83 – paragraph 3

Text proposed by the Commission

Amendment

3. To the extent necessary to comply with paragraph 1, point (c), payment service providers may exchange the unique identifier of a payee with other payment service providers who are subject to information sharing arrangements as referred to in paragraph 5, when the payment service provider has sufficient evidence to assume that there was a fraudulent payment transaction. Sufficient evidence for sharing unique identifiers shall be assumed when at least two different payment services users who are customers of the same payment service provider have informed that a unique identifier of a payee was used to make a fraudulent credit transfer. Payment service providers shall not keep unique identifiers obtained following the information exchange referred to in this paragraph and paragraph 5 for longer than it is necessary for the purposes laid down in paragraph 1, point (c).

3. To comply with paragraph 1, point (c), payment service providers shall exchange the unique identifier of a payee with other payment service providers who are subject to information sharing arrangements as referred to in paragraph 5, when the payment service provider has sufficient evidence to assume that there was a fraudulent payment transaction. Sufficient evidence for sharing unique identifiers shall be assumed when at least two different payment services users who are customers of the same payment service provider have informed that a unique identifier of a payee was used to make a fraudulent credit transfer. Payment service providers shall not keep unique identifiers obtained following the information exchange referred to in this paragraph and paragraph 5 for longer than it is necessary for the purposes laid down in paragraph 1, point (c).

Or. en

Amendment 84

Proposal for a regulation

Article 83 – paragraph 4 a (new)

Text proposed by the Commission

Amendment

4a. The EBA shall set up a dedicated IT platform to allow payment service providers to exchange information on fraudulent unique identifiers with other payment service providers.

That platform shall be set up by ... [12 months from the date of entry into force of this Regulation].

Or. en

Amendment 85

Proposal for a regulation

Article 83 – paragraph 5 a (new)

Text proposed by the Commission

Amendment

5a. Where the payment service provider fails to block a unique identifier which was reported to that payment service provider as fraudulent or involved in fraudulent transactions, the payment service user shall not bear any resulting financial losses.

Or. en

Amendment 86

Proposal for a regulation

Article 85 – paragraph 12

Text proposed by the Commission

Amendment

12. The two or more elements referred to in Article 3, point (35), on which strong customer authentication shall be based do not necessarily need to belong to different categories, as long as their independence is fully preserved.

12. The two or more elements referred to in Article 3, point (35), on which strong customer authentication shall be based need to belong to different categories and their independence shall be fully preserved.

Or. en

Amendment 87

Proposal for a regulation

Article 88 – paragraph 2

Text proposed by the Commission

Amendment

2. Payment services providers shall not make the performance of strong customer authentication dependant on the exclusive use of a single means of authentication and shall not make the performance of strong customer authentication depend, explicitly or implicitly, on the possession of a smartphone. Payment services providers shall develop a diversity of means for application of strong customer authentication to cater for the specific situation of all their customers.

2. Payment services providers shall not make the performance of strong customer authentication dependant on the exclusive use of a single means of authentication and shall not make the performance of strong customer authentication depend, explicitly or implicitly, on the possession of a smartphone or other smart device. Payment services providers shall develop a diversity of means for application of strong customer authentication to cater for the specific situation of all their customers.

Or. en

Amendment 88

Proposal for a regulation

Article 88 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2a. The performance of strong customer authentication shall be free of charge for the payment service user.

Or. en

Amendment 89

Proposal for a regulation

Article 94 – paragraph 2 – subparagraph 1

Text proposed by the Commission

Amendment

Payment service providers shall make every possible effort to reply, on paper or, if agreed between the payment service provider and the payment service user, on another durable medium, to the payment service users’ complaints. Such a reply shall address all points raised, within an adequate timeframe and at the latest within 15 business days of receipt of the complaint. In exceptional situations, if the answer cannot be given within 15 business days for reasons beyond the control of the payment service provider, it shall send a holding reply, clearly indicating the reasons for a delay in answering to the complaint and specifying the deadline by which the payment service user will receive the final reply. In any event, the deadline for receiving the final reply shall not exceed 35 business days.

Payment service providers shall reply, on paper or, if agreed between the payment service provider and the payment service user, on another durable medium, to the payment service users’ complaints. Such a reply shall address all points raised, within an adequate timeframe and at the latest within 15 business days of receipt of the complaint. In exceptional situations, if the answer cannot be given within 15 business days for reasons beyond the control of the payment service provider, it shall send a holding reply, clearly indicating the reasons for a delay in answering to the complaint and specifying the deadline by which the payment service user will receive the final reply. In any event, the deadline for receiving the final reply shall not exceed 35 business days.

Or. en

Amendment 90

Proposal for a regulation

Article 95 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. The participation of payment service providers in ADR procedures for consumers shall be mandatory unless the Member State demonstrates to the Commission that other mechanisms are equally effective.

Or. en

EXPLANATORY STATEMENT

The Payment Services Regulation is a legislative act that, in the view of your rapporteur, aims to:

• Address the different levels of compliance of the Payment Services Directive (PSD2) and the fragmentation of the single market by proposing a more harmonised approach towards payment services in the EU;

• Bolster the protection of payment service users (PSUs) from fraud and - through an obligatory IBAN check - mitigate the error element;

• Ensure and strengthen a level playing field between the non-bank payment service providers and banks in the EU by addressing various barriers faced by the former;

• Facilitate access to transparent information on data protection and data access for PSUs.

Your rapporteur believes that there are some improvements to be made to the Commission proposal, which he addresses in his draft report.

First, on transparency measures, the rapporteur believes that better information should be provided - in ATMs or while conducting other types of payments - also on currency exchange and mark-ups on the exchange reference rates.

More transparency should be provided when AISPs and PISPs access the data of the PSU and if they access the data not through an application programming interface (API). While the dashboard on the TPPs access to the account remains crucial, this still requires improvement.

The rapporteur believes that the EBA should set out a list of the methods that can be used to identify unambiguously another PSU. The verification carried out by PSPs should not solely focus on the IBAN number but also factor other proxies.

Taking into account the very technical nature of the file and the constantly changing landscape of payments, the rapporteur finds that the role of the EBA should be strengthened through this proposal. This is particularly important when it comes to developing additional Regulatory Technical Standards or guidelines, for instance regarding the definition of ‘gross negligence’, in order to ensure a more consistent application and to bring higher levels confidence to consumers and PSPs.

Notwithstanding, the rapporteur considers that consumers ought to be better protected from fraud and that responsibility to offer this protection should not only be borne by PSPs but equally by electronic communications service. As for protection from fraud, the rapporteur trusts that PSPs should offer appropriate means to consumers, such as easy and quick access to a phone line, with personal human support to, for instance, notify about fraudulent transactions.

Additionally, Member States must also shoulder their fair share of responsibility in the protection from fraud through holistic and far-reaching educational campaigns.

Your rapporteur thinks that in order to protect consumers from fraud, exchange of information on fraudulent unique identifiers must not be just a possibility but rather an obligation. To do so, the EBA should facilitate the cooperation between PSPs by creating a platform to exchange such information.

The rapporteur is confident that the above mentioned and other proposals for changes brought forward in this draft report would further protect the PSUs from fraud and its consequences as well as create a safer and more competitive level-playing field for bank and non-bank PSPs that puts the citizen at the heart of the EU payments landscape.