--- instrument_id: psd-3 chunk_id: psd-3_t02_ch0I_p2 chunk_title: Licensing and supervision (Part 2) path: "Title 2 > Chapter I" source_class: operative_text document_type: proposal normative_weight: non_binding legal_status: council_compromise_text jurisdiction: EU effective_period: from: null to: null articles_contained: - 18 - 19 - 21 - 22 - 23 - 24 - 25 - 26 - 27 - 28 - 29 - 30 - 31 - 32 - 33 topics: - payments - payment_services - authorisation - licensing - supervision - competent_authorities - fit_and_proper - internal_control - outsourcing - liability - conflicts_of_interest - enforcement - sanctions - own_funds - aml - passporting --- # Chapter I - Licensing and supervision (Part 2) ## Article 18 - EBA register 1. The EBA shall operate and maintain an electronic central register of payment institutions, including entities registered in accordance with Articles 34, 36 and 38, and their agents and branches where applicable. That electronic central register shall contain the information as notified by the competent authorities in accordance with paragraph 3. The EBA shall be responsible for the accurate presentation of that information. 2. The EBA shall make the electronic central register publicly available on its website, and shall allow for easy access to and easy search for the information listed, free of charge. 3. Competent authorities shall provide the EBA with the information entered in their national public registers in accordance with Article 17 at the latest within one business day after they entered that information in the national public registers. 4. Competent authorities shall be responsible for the accuracy of the information contained in their national registers and provided to the EBA, and for keeping that information up to date. Companies listed in the Register shall be given means to correct any inaccuracies concerning themselves. 5. The EBA shall develop draft regulatory technical standards on the operation and maintenance of the electronic central register referred to in paragraph 1 and on access to the information contained therein to ensure that only the competent authority concerned or the EBA may modify the information contained in the register. The EBA shall submit those draft regulatory technical standards to the Commission by [ OP please insert the date= 18 months after the date of entry into force of this Directive]. Power is delegated to the Commission to adopt the regulatory technical standards in accordance with Article 10 to 14 of Regulation (EU) No 1093/2010. 6. The EBA shall develop draft implementing technical standards on the details and structure of the information to be notified pursuant to paragraph 1, including the data standards and formats for the information, as set out in Commission Implementing Regulation (EU) 2019/41024. The EBA shall submit those draft implementing technical standards to the Commission by [ OP please insert the date= 18 months after the date of entry into force of this Directive]. Power is delegated to the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulation (EU) No 1093/2010. 24 Commission Implementing Regulation (EU) 2019/410 of 29 November 2018 laying down implementing technical standards with regard to the details and structure of the information to be notified, in the field of payment services, by competent authorities to the European Banking Authority pursuant to Directive (EU) 2015/2366 of the European Parliament and of the Council (OJ L 73, 15.3.2019, p. 20). 7. The EBA shall develop, operate and maintain a central, machine-readable list of the payment service providers offering the payment services listed in Annex I, points 6 and 7, based on the most recent information contained in the EBA register referred to in paragraph 1 and on the EBA Credit Institution Register created pursuant to Article 8(2), point (j) of Regulation (EU) No 1093/2010. That list shall contain the name and identifier of those payment services providers and their authorisation status. ## Article 19 - Use of agents 1. Payment institutions that intend to provide payment services through agents shall communicate to the competent authorities in their home Member State all of the following information: (a) the name, and where applicable, the legal name, the address of the agent and the address(es) from which the agent offers payment services; (b) an up-to-date description of the internal control mechanisms that the agent will use to comply with Directive (EU) 2015/849; (c) the identity of directors and the other persons responsible for the management of the agent and, where the agent is not a payment service provider, evidence that those persons are fit and proper for their tasks; (d) the payment services provided by the payment institution for which the agent is mandated; (e) where applicable, the unique identification code or number of the agent; (ea) a clear description of the proposed business model of the agent; (eb) the address of the website of the agent where the agent offers payment services through a website; (ec) for legal persons, proof of incorporation of the legal entity; (ed) an overview of the flow of funds and operational processing of the intended payment transactions. 2. Member States shall ensure that the competent authorities of the home Member State communicate to the payment institution within six weeks of receipt of the information referred to in paragraph 1 whether the agent has been entered in the register referred to in Article 17. Upon entry in the register, the agent may commence providing payment services. 3. Before listing the agent in the register referred to in Article 17, the competent authorities shall, where they consider that the information referred to in paragraph 1 is incorrect, take further action to verify the information. 4. Where, after having verified the information referred to in paragraph 1, the competent authorities are not satisfied that that information is correct, they shall refuse to list the agent in the register referred to in Article 17 and shall inform the payment institution thereof without undue delay. 5. Member States shall ensure that payment institutions that wish to provide payment services in another Member State by engaging an agent, or that intend to provide payment services in a Member State other than its home Member State via an agent located in a third Member State, follow the procedures set out in Article 30. 6. Member States shall ensure that payment institutions inform their payment service users of the fact that an agent is acting on their behalf. 7. Member States shall ensure that payment institutions communicate to the competent authorities of their home Member State any change regarding the use of agents, including about additional agents, without undue delay and in accordance with the procedure provided for in paragraphs 2, 3 and 4. 7a. Where the payment institution wishes to distribute or redeem electronic money in another Member State through a natural or legal person, Articles 29 to 33, with the exception of Article 30(1), point (e), and Article 31(4)-(7) of this Directive, shall apply mutatis mutandis to such payment institution. For the purposes of complying with Article 30(1), point (d), payment institutions shall not be required to provide the information referred to in paragraph 1, points (c), (ec) and (ed) of this Article, regarding such a natural or legal person. 7b. Payment institutions shall not issue electronic money through agents. ## Article 21 - Branches 1. Member States shall ensure that payment institutions that intend to provide payment services in another Member State by establishing a branch, or that intend to provide payment services in a Member State other than their home Member State via a branch located in a third Member State, follow the procedures set out in Article 30. 2. Member States shall ensure that payment institutions require the branches that act on their behalf to inform payment service users of this fact. ## Article 22 - Entities to which activities are outsourced 1. Member States shall ensure that payment institutions that intend to outsource operational functions of payment services inform the competent authorities of their home Member State thereof. Without prejudice to Regulation 2022/2554, Member States shall ensure that payment institutions do not outsource important operational functions in such a way that the quality of the payment institution’s internal control and the ability of the competent authorities to monitor and retrace the payment institution’s compliance with all of the obligations laid down in this Directive is materially impaired. An operational function shall be important where a defect or failure in its performance would materially impair the continuing compliance of a payment institution with the requirements of its authorisation, its other obligations under this Directive, its financial performance, or the soundness or the continuity of its payment services. Member States shall ensure that when payment institutions outsource important operational functions, they shall meet all of the following conditions: (a) the outsourcing does not result in the delegation by senior management of its responsibility; (b) the relationship and obligations of the payment institution towards its payment service users under this Directive is not altered; (c) the conditions with which the payment institution is to comply to be authorised and remain so is not undermined; (d) none of the other conditions subject to which the payment institution’s authorisation was granted is removed or modified. 2. Member States shall ensure that payment institutions communicate without undue delay to the competent authorities of their home Member State any change regarding the use of entities to which activities are outsourced. ## Article 23 - Liability 1. Member States shall ensure that payment institutions that rely on third parties for the performance of operational functions take reasonable steps to ensure that the requirements of this Directive are complied with. 2. Member States shall require that payment institutions remain fully liable for any acts of their employees, or any agent, branch or entity to which activities are outsourced or that acts on behalf of the payment institution. ## Article 24 - Designation of competent authorities 1. Member States shall designate as the competent authorities responsible for the authorisation and prudential supervision of payment institutions which are to carry out the duties provided for under this Title either public authorities, or bodies recognised by national law or by public authorities expressly empowered for that purpose by national law, including national central banks. Member States shall not designate payment institutions, credit institutions, or post office giro institutions as competent authorities. The competent authorities shall be independent from economic bodies and avoid conflicts of interest. Member States shall provide the Commission with the name and the contact details of the competent authority designated in accordance with the first subparagraph. 2. Member States shall ensure that the competent authorities designated under paragraph 1 possess all powers necessary for the performance of their duties. Member States shall ensure that competent authorities have the necessary resources, notably in terms of dedicated staff, to exercise their tasks. 3. Member States that have appointed more than one competent authority for matters covered by this Title shall ensure that those authorities cooperate closely to discharge their respective duties effectively. 4. The tasks of the competent authorities designated under paragraph 1 shall be the responsibility of the competent authorities of the home Member State. 5. Paragraph 1 shall not imply that the competent authorities are required to supervise business activities of the payment institutions other than the provision of payment services and the activities referred to in Article 10(1), point (a). ## Article 25 - Supervision 1. Member States shall ensure that the controls exercised by the competent authorities for ensuring continued compliance with this Title are proportionate, adequate and responsive to the risks to which payment institutions are exposed. To ensure compliance with this Title, the competent authorities shall, in particular, be entitled to take the following steps: (a) require the payment institution to provide any information needed to monitor compliance specifying the purpose of the request, as appropriate, and the time limit by which the information is to be provided; (b) carry out on-site inspections at the business premises of the payment institution, of any agent or branch providing payment services under the responsibility of the payment institution, or at the business premises of any entity to which activities are outsourced or that acts on behalf of the payment institution; (c) issue recommendations, guidelines and, if applicable, binding administrative provisions; (d) suspend or withdraw an authorisation pursuant to Article 16; (e) require payment institutions to have own funds in excess of the requirements set out in Articles 7, 8 or 10(4)(d), or to adjust the own funds required in case of material changes in the business of those payment institutions; (f) require the reinforcement of the arrangements, processes, mechanisms and strategies implemented in accordance with point (c) of Article 13(1); (g) restrict or limit the business, operations or network of payment institutions or request the divestment of activities that pose excessive risks to the financial soundness of a payment institution; (h) require the reduction of the risk inherent in the activities, products and systems of payment institutions, including outsourced activities; (i) restrict or prohibit distributions or interest payments by a payment institution to shareholders, members or holders of own funds instruments; (j) require payment institutions to establish a separate entity for the provision of non- payment services activities, where the payment institutions are engaged in other business activities that may impair, or are likely to impair, either the financial soundness of the payment institution or the ability of the competent authorities to monitor the payment institution’s compliance with this Directive; (k) impose administrative sanctions and administrative measures in accordance with paragraph 2 and with national law; (l) require payment institutions to remove persons responsible for the management of the payment institution when they fail to comply with the requirements set out in Article 3(3), point (n) (ii). 2. Without prejudice to Article 16 and any national provisions of criminal law, Member States shall provide that their competent authorities may impose or initiate administrative or legal proceedings to impose penalties and measures aimed specifically at ending observed infringements, and removing the causes of such infringements, upon payment institutions or those who effectively control the business of payment institutions which breach the provisions transposing this Directive. 3. Notwithstanding the requirements of Article 5, Article 6(1) and (2), Article 7, and Article 8, Member States shall ensure that the competent authorities can take the steps referred to in paragraph 1 of this Article to ensure sufficient capital for payment institutions, in particular where activities other than payment services impair or are likely to impair the financial soundness of the latter. ## Article 26 - Professional secrecy 1. Without prejudice to cases covered by national criminal law, Member States shall ensure that all persons who work or who have worked for the competent authorities, and any experts acting on behalf of the competent authorities, are bound by the obligation of professional secrecy. 2. The information exchanged in accordance with Article 28 shall be subject to the obligation of professional secrecy by both the sharing and recipient authority to ensure the protection of individual and business rights. 3. Member States may apply this Article taking into account, mutatis mutandis, Articles 53 to 61 of Directive 2013/36/EU. ## Article 27 - Right to apply to the courts 1. Member States shall ensure that decisions taken by the competent authorities in respect of a payment institution pursuant to the laws, regulations and administrative provisions adopted in accordance with this Directive are subject to appeal. 2. Paragraph 1 shall apply also in respect of a failure to act where this Directive sets a fixed period for the competent authority to act. ## Article 28 - Cooperation and exchange of information 1. The competent authorities of the different Member States shall cooperate with each other and, where appropriate, with the ECB and the national central banks of the Member States, the EBA and other relevant competent authorities designated under Union or national law applicable to payment service providers. 2. Member States shall allow for the exchange of information between their competent authorities and: (a) the competent authorities of other Member States responsible for the authorisation of applicant payment institutions and the supervision of payment institutions; (b) the ECB and the national central banks of Member States, in their capacity as monetary and oversight authorities, and, where appropriate, other public authorities responsible for overseeing payment and settlement systems; (c) other relevant authorities designated under this Directive, and other Union law applicable to payment service providers, including Directive (EU) 2015/849; (d) the EBA, in its capacity of contributing to the effective and consistent functioning of supervising mechanisms as referred to in Article 1(5), point (a), of Regulation (EU) No 1093/2010. ## Article 29 - Settlement of disagreements between competent authorities of different Member States 1. A competent authority of a Member State that considers that, in a particular matter, cross- border cooperation with competent authorities of another Member State as referred to in Articles 28, 30, 31, 32 or 33 does not comply with the conditions set out in those provisions may refer the matter to the EBA and request its assistance in accordance with Article 19 of Regulation (EU) No 1093/2010. 2. Where the EBA has been requested to assist pursuant to paragraph 1, it shall take a decision under Article 19(3) of Regulation (EU) No 1093/2010 without undue delay. The EBA may also assist the competent authorities in reaching an agreement on its own initiative in accordance with Article 19(1), second subparagraph, of that Regulation. In either case, the competent authorities involved shall defer their decisions pending resolution under Article 19 of that Regulation. ## Article 30 - Application to exercise the right of establishment and freedom to provide services 1. Member States shall ensure that any payment institution wishing to start providing payment services in a Member State other than its home Member State, including via an establishment in a third Member State, in the exercise of the right of establishment or the freedom to provide services, communicates the following information to the competent authorities in its home Member State: (a) the name, the address and, where applicable, the authorisation number of the payment institution; (b) the Member State(s) in which the payment institution intends to operate and planned date of commencement of operations in this Member State; (c) the payment service(s) that the payment institution intends to provide; (d) where the payment institution intends to make use of an agent, the information referred to in Articles 19(1); (e) where the payment institution intends to make use of a branch: (i) the information referred to in Article 3(3), points (b) and (e), with regard to the payment service business in the host Member State; (ii) a description of the organisational structure of the branch; (iii) mutatis mutandis, the information referred to in Article 19(1), points (a) to (i); Member States shall ensure that payment institutions that intend to outsource operational functions of the payment services to other entities in the host Member State, without undue delay, inform the competent authorities of their home Member State thereof. 2. Within 10 business days of receipt of all of the information referred to in paragraph 1, the competent authorities of the home Member State shall send that information to the competent authorities of the host Member State. Where the services are provided via a third Member State, the Member State to be notified shall be the one where the services are provided to payment service users. Within 1 month of receipt of the information from the competent authorities of the home Member State, the competent authorities of the host Member State shall assess that information and provide the competent authorities of the home Member State with relevant information about the intended provision of payment services by the relevant payment institution in the exercise of the freedom of establishment or the freedom to provide services. The competent authorities of the host Member State shall inform the competent authorities of the home Member State of any grounds for concern in connection with the intended engagement of an agent or establishment of a branch with regard to money laundering or terrorist financing within the meaning of Directive (EU) 2015/849. Before doing so, the competent authority of the host Member State shall liaise with the relevant competent authorities as referred to in Article 7(2) of Directive (EU) 2015/849 to establish whether such grounds exist. Competent authorities of the home Member State that do not agree with the assessment of the competent authorities of the host Member State shall provide the competent authorities of the host Member State with the reasons for their disagreement. Where the assessment of the competent authorities of the home Member State, in light of the information received from the competent authorities of the host Member State is not favourable, the competent authority of the home Member State shall refuse to register the agent, branch, or shall withdraw the registration if already made. 3. Within 10 weeks of receipt of the information referred to in paragraph 1, the competent authorities of the home Member State shall communicate their decision to the competent authorities of the host Member State and to the payment institution. Upon entry in the register referred to in Article 17, the agent or branch may commence its activities in the relevant host Member State. Member States shall ensure that the payment institution notifies to the competent authorities of the home Member State the start date of the activities conducted on the payment institution’s behalf through the agent or branch in the host Member State concerned. The competent authorities of the home Member State shall inform the competent authorities of the host Member State thereof. 4. Member States shall ensure that the payment institution communicates to the competent authorities of the home Member State any relevant change regarding the information communicated in accordance with paragraph 1 without undue delay, including additional agents, branches or entities to which activities are outsourced in the host Member States in which the payment institution operates. The procedure provided for under paragraphs 2 and 3 shall apply. 5. The EBA shall develop draft regulatory technical standards specifying the framework for cooperation, and for the exchange of information, between competent authorities of the home and of the host Member State in accordance with this Article. Those draft regulatory technical standards shall specify the method, means and details of cooperation in the notification of payment institutions operating on a cross-border basis and, in particular, the scope and treatment of information to be submitted, including common terminology and standard notification templates to ensure a consistent and efficient notification process, including in the case where an agent or branch of a payment institution, located in a host Member State, offers payment services in a third Member State. The EBA shall submit those draft regulatory technical standards to the Commission by [ OP please insert the date= 18 months after the date of entry into force of this Directive]. Power is delegated to the Commission to adopt the regulatory technical standards in accordance with Article 10 to 14 of Regulation (EU) No 1093/2010. ## Article 31 - Supervision of payment institutions exercising the right of establishment and freedom to provide services 1. When carrying out the controls and taking the necessary steps provided for in this Title and Titles II and III of Regulation XXX (PSR) in respect of the agent or branch of a payment institution located in the territory of another Member State, the competent authorities of the home Member State shall cooperate with the competent authorities of the host Member State, including by informing the competent authorities of the host Member State of where they intend to carry out an on-site inspection in the territory of that host Member State. The competent authorities of the home Member State may delegate to the competent authorities of the host Member State the task of carrying out on-site inspections of the payment institution concerned. 2. The competent authorities of the host Member States may require that payment institutions having agents or branches within their territories report to them periodically about the activities carried out in their territories. Such reports shall be required for information or statistical purposes and, as far as the agents or branches provide payment services, to monitor compliance with Titles II and III of Regulation XXX [PSR]. Such agents or branches shall be subject to professional secrecy requirements that are at least equivalent to those referred to in Article 26. The competent authorities of the host Member State may request ad hoc information from payment institutions where those authorities have evidence of non-compliance with this Title or with Titles II and III of Regulation XXX [PSR]. 3. The competent authorities of the home and host Member States shall provide each other with all essential or relevant information, in particular in the case of infringements or suspected infringements by an agent or a branch, and where such infringements occurred in the context of the exercise of the freedom to provide services. Competent authorities shall communicate, upon request, all relevant information and, on their own initiative, all essential information, including on the compliance of the payment institution with the conditions laid down in Article 13(3). 4. Member States may require payment institutions operating on their territory through agents, the head office of which is situated in another Member State, to appoint a central contact point in their territory to ensure adequate communication and information reporting in compliance with Titles II and III of Regulation XXX [PSR], and to facilitate supervision by competent authorities of home Member State and host Member States, including by providing competent authorities with documents and information on request. Where a Member State decides to impose such a requirement, each payment institution shall appoint only one central contact point in that Member State. 5. For the purposes of paragraph 4, payment institutions shall be required to appoint a central contact point only where one or more of the following criteria is met: (a) the total number of agents through which a payment institution provides any of the payment services referred to in Annex I in a host Member State under the right of establishment is equal to or exceeds 10; (b) the total value of payment transactions, including payment transactions initiated when providing payment initiation services, carried out by a payment institution in the host Member State in the last financial year through agents located in the host Member State and operating under either the right of establishment or the freedom to provide services, exceeds EUR 3 million and the payment institution has engaged at least two of those agents under the right of establishment; (c) the total number of payment transactions carried out by a payment institution in the host Member State in the last financial year through agents located in the host Member State and operating under either the right of establishment or the freedom to provide services, including the number of payment transactions initiated when providing payment initiation services, exceeds 100 000 and the payment institution has engaged at least two of those agents under the right of establishment. A central contact point that is appointed pursuant to paragraph 4 shall carry out each of the following functions: (a) it shall serve as single provider and single point of collection for the purposes of the reporting obligations of the appointing payment institution towards the competent authorities of the host Member State pursuant to paragraph 2 in relation to services provided in the host Member State through agents under the right of establishment; (b) it shall serve as single point of contact of the appointing payment institution in communications with the competent authorities of the home and host Member States, in relation to the payment services provided in the host Member State through agents under the right of establishment, including by providing competent authorities with documents and information on request; (c) it shall facilitate the on-site inspections by competent authorities of the agents of the appointing payment institution operating in the host Member State under the right of establishment and the implementation of any supervisory measures adopted by the competent authorities of the home or host Member States pursuant to this directive. 7. Payment institutions shall ensure that a central contact point possesses the necessary resources and has access to all the data necessary for the performance of the functions set out in in paragraph 6. ## Article 32 - Measures in case of non-compliance, including precautionary measures 1. Where a competent authority of a host Member State considers that a payment institution having agents or branches in its territory does not comply with this Title or with Titles II and III of Regulation XXX [PSR], that competent authority shall inform the competent authority of the home Member State thereof without undue delay. The competent authority of the home Member State, after having evaluated the information received pursuant to the first subparagraph, shall, without undue delay, take all appropriate measures to ensure that the payment institution concerned puts an end to its failure of compliance. The competent authority of the home Member State shall communicate those measures to the competent authority of the host Member State and to the competent authorities of any other Member State concerned without delay. 2. In emergency situations, where immediate action is necessary to address a serious threat to the collective interests of the payment service users in the host Member State, the competent authorities of the host Member State may, in parallel to the cross-border cooperation between competent authorities and pending measures by the competent authorities of the home Member State as set out in Article 31, take precautionary measures. 3. Any precautionary measures as referred to in paragraph 2 shall be appropriate and proportionate to their purpose to protect against a serious threat to the collective interests of the payment service users in the host Member State. Those measures shall not result in a preference for payment service users of the payment institution in the host Member State over payment service users of the payment institution in other Member States. Precautionary measures shall be temporary and shall be terminated when the serious threats identified have been addressed, including with the assistance of or in cooperation with the home Member State’s competent authorities or with the EBA as provided for in Article 29(1). 4. Where compatible with the emergency situation, the competent authorities of the host Member State shall inform the competent authorities of the home Member State and those of any other Member State concerned, the Commission and the EBA of the precautionary measures taken under paragraph 2 and of their justification in advance and in any case without undue delay. ## Article 33 - Reasons and communication 1. Any measure taken by the competent authorities pursuant to Article 25, 30, 31 or 32 involving penalties or restrictions on the exercise of the freedom to provide services or the freedom of establishment shall be properly justified and communicated to the payment institution concerned. 2. Articles 30, 29 and 32 shall be without prejudice to the obligation of competent authorities under Directive (EU) 2015/849 and Regulation (EU) 2023/1113, in particular under Article 47(1) of Directive (EU) 2015/849 and Article 33(1) of Regulation (EU) 2023/1113, to supervise or monitor the compliance with the requirements laid down in those instruments.