The activities of systemically important payment transaction processors are regulated by the act of 24 March 2017 on the oversight of payment transaction processors (the "Act") , which entered into force on 24 April 2017. The Act applies to processors acting in payment transactions where both the payment initiator (the "payer") and the payment recipient (the "payee") operate in Belgium, whatever the country of establishment of the payment service provider.
Background
Following incidents that led to a blockage of the Belgian card payment system, including on 23 December 2013 – one of the peak shopping days of the year – the Belgian legislator decided to supplement the legal framework "in order to clearly identify which are the parties responsible for the processing of payment transactions in Belgium and to provide a better legal basis for the National Bank of Belgium [("NBB")] to exercise its oversight task".
Currently, the main regulatory tool consists of the 24 "Principles for financial market infrastructures (PFMIs)" adopted by the BRI and IOSCO in April 2012. Other ("soft law" or "hard law") regulations exist, such as ECB regulation 795/2014 of 3 July 2014 on oversight requirements for systemically important payment systems and directive (EU) 2015/2366 of 25 November 2015 on payment services in the internal market ("PSD II"), but they address different subjects: the ECB regulation applies to payment systems, while PSD II is not applicable to payment transaction processors since they provide their services only to payment services providers.
Systemically important payment transaction processors
A processor is "any natural or legal person offering services for the processing of payment transactions". However, the Act excludes some processors from its scope, mainly those which process paper-based payment instruments (e.g. cheques, bills of exchange, vouchers and postal money orders) and those which process payment transactions within the framework of securities transactions (which are potentially subject to Regulation (EU) 909/2014 on improving securities settlement in the European Union and on central securities depositories – see Eubelius Spotlights September 2014).
The processing of payment transactions is defined as "the technical processes that are necessary and specifically intended to settle payment transactions". According to the explanatory notes, financial messaging services (such as SWIFT) do not qualify as a "process" within the meaning of the Act.
A payment transaction is "an action, initiated by the payer or the payee, which involves a transfer of scriptural money, irrespective of any underlying obligation between the payer and the payee, and during the course of which (a) the payment transaction is executed between various payment service providers and (b) whereby both the payer's and payee's payment service provider operate in Belgium".
A processor is systemically important and is subject to the prudential rules prescribed by the Act if it processed more than 125 million payment transactions (as defined above) in the previous calendar year, using a specific payment scheme (e.g. Visa or Mastercard) and provided that it has been notified of its qualification as a systemically important processor by the NBB.
Requirements applicable to payment scheme operators
The Act requires payment scheme operators to verify with due diligence that systemically important processors they work with comply with the requirements of the Act.
Furthermore, they must file with the NBB, before 1 April each year, information necessary for the NBB to identify the processors acting in the payment transaction which carry out processing for their scheme in Belgium and assess whether or not these processors are systemically important.
Prudential rules
A systemically important processor is required to comply with prudential rules in carrying out its activities. It must:
- identify the possible sources of operational risk, both internal and external, for the processing of payment transactions;
- have in place a risk management policy and procedures and systems allowing it to manage risks that arise or risks that it bears;
- implement business continuity management and set up a business continuity plan; and
- implement appropriate strategies and procedures, and secure enough resources to ensure the confidentiality and integrity of the information as well as the permanent availability of the supply of its services.
These rules are based, amongst others, on principles 2, 3 and 17 of Appendix F of the PFMIs.
In case of unavailability of their services for the processing of payment transactions during a business day, systemically important processors must inform the NBB within 15 minutes of detection of the incident or, if the incident does not occur during a business day or occurs after 8:00 p.m. and before 8:00 a.m., as soon as possible after detection of the incident. Then they must exhaustively report the incident to the NBB. An interruption may not exceed 30 minutes or 60 minutes depending on when the incident occurs (before or after 8:00 p.m.). Within one quarter of a year, interruptions may not cumulatively exceed 30 minutes or 120 minutes respectively.
For the outsourcing of "significant operational tasks relating to the processing of payment transactions", the applicable rules are similar to those that apply to credit institutions. Such outsourcing is also subject to prior NBB authorisation, which constitutes an important new constraint.
A merger between systemically important processors or between such processors and other entities is subject to prior authorisation by the NBB.
NBB oversight
The NBB exercises oversight on payment schemes and their operators as well as on systemically important processors.
Within this framework, the NBB may require from operators and systemically important processors the transmission of "any information about their organisation, functioning, financial situation and payment transactions processed", and request "to be regularly provided with numerical data or other documents and explanations". The NBB may also conduct inspections of operators and processors.
Administrative injunctions; sanctions
The NBB "may, when it finds that a systemically important processor does not act in accordance with the provisions of the act or that the carrying out of its activities puts the stability and continuity of payments in Belgium in jeopardy, set a deadline within which the processor must comply with specific provisions of the act". If this deadline is not met, the NBB may impose a penalty on the processor "which cannot exceed EUR 50,000 per day or EUR 2,500,000 in total". The NBB may also make its findings public. These are administrative measures and not sanctions.
In case of breach of some of the provisions of the Act, the NBB may impose an administrative fine on a systemically important processor or payment scheme operator. These fines may not "be less than EUR 25,000 or exceed EUR 25,000,000 or 10% of the annual turnover in the previous accounting year, whichever is the higher". An appeal before the Brussels Court of Appeal is possible against the imposition of this sanction.
Finally, the NBB may prohibit a payment scheme operator from using the services of a processor that has been subject to an administrative fine.