--- instrument_id: psr chunk_id: psr_t03_ch08 chunk_title: "Enforcement procedures, competent authorities and penalties" path: "Title III RIGHTS AND OBLIGATIONS IN RELATION TO THE PROVISION AND USE OF PAYMENT SERVICES > Chapter 8" source_class: operative_text document_type: proposal normative_weight: non_binding legal_status: council_position jurisdiction: EU effective_period: from: null to: null articles_contained: - 98 - 99 - 100 - 101 - 102 - 103 - 104 - 105 - 106 - 107 - 108 - 109 - 110 - 111 - 112 - 113 topics: - payments - payment_services - enforcement - sanctions - authorisation - outsourcing - competent_authorities - payment_systems - conflicts_of_interest - governance - fraud_prevention - strong_customer_authentication - financial_statements - consolidation - data_protection - implementing_acts --- # Chapter 8 - Enforcement procedures, competent authorities and penalties ## Article 98 - Enforcement of provisions related to very large online platforms and very large online search engines The Commission shall have exclusive powers to supervise and enforce Article 61(4), third subparagraph, point (c), and Article 62, where the obligations in those provisions apply to providers of very large online platforms and of very large online search engines. Chapter IV of Regulation (EU) 2022/2065 shall apply for the purposes of that supervision and enforcement. Any references therein to compliance with the relevant provisions of Regulation (EU) 2022/2065 shall be deemed to include Article 61(4), third subparagraph, point (c), and Article 62 of this Regulation, where the obligations in those provisions apply to providers of very large online platforms and of very large online search engines. To the extent that powers are conferred upon the Commission under Chapter IV of Regulation (EU) 2022/2065, those powers shall also cover the application of Article 61(4), third subparagraph, point (c), and Article 62 of this Regulation, where those obligations apply to providers of very large online platforms and of very large online search engines. ## Article 99 - Prohibition of persons other than payment service providers from providing payment services Natural or legal persons that are neither payment service providers nor excluded from the scope of this Regulation as a result of application of Article 2(3) shall not provide payment services. ## Article 100 - Complaints 1. Member States shall establish procedures which allow payment service users and other interested parties including consumer associations, to submit complaints to the competent authorities referred to in Article 101 with regard to payment service providers’ alleged infringements of this Regulation. 2. Where appropriate and without prejudice to the right to bring proceedings before a court in accordance with national procedural law, the reply from the competent authorities to the complaints referred to in paragraph 1 of this Article shall inform the complainant of the existence of the ADR procedures set up in accordance with Article 105. 3. By … [21 months from the date of entry into force of this Regulation], EBA shall issue guidelines in accordance with Article 16 of Regulation (EU) No 1093/2010, on procedures referred to in paragraph 1, including the channels for submission of complaints, the information requested from complainants, and the disclosure of the aggregate analysis of complaints. ## Article 101 - Competent authorities and supervisory and investigatory powers 1. Member States shall designate the competent authorities responsible for carrying out the functions and duties provided for in this Regulation. Member States shall notify those competent authorities to EBA and the Commission. Competent authorities shall be either: (a) public authorities; or (b) bodies recognised by national law or by public authorities expressly empowered for that purpose by national law, including national central banks. Competent authorities shall be independent from economic bodies and avoid conflicts of interest. Without prejudice to the second subparagraph, point (b), payment institutions, credit institutions and post office giro institutions shall not be designated as competent authorities. 2. Where Member States designate more than one competent authority pursuant to paragraph 1, they shall determine their respective tasks and designate one competent authority as the single point of contact for cross-border administrative cooperation between competent authorities as well as with EBA. Member States may designate a different single point of contact for each type of administrative cooperation. 3. Competent authorities shall exercise their powers to investigate potential infringements of this Regulation and impose administrative penalties, periodic penalty payments and other administrative measures laid down in their national legal frameworks in accordance with this Regulation, in any of the following ways: (a) directly; (b) in collaboration with other authorities; (c) by delegating powers to other authorities or bodies, while retaining the responsibility for overseeing the delegated authority or body; (d) by applying to the competent judicial authorities. Where competent authorities delegate their powers to other authorities or bodies in accordance with the first subparagraph, point (c),that delegation of power shall specify the delegated tasks and the conditions under which they are to be carried out and under which the delegation of power may be revoked. The authorities or bodies to which the powers are delegated shall be organised in such a manner as to ensure that conflicts of interest are avoided. Competent authorities shall oversee the activity of the authorities or bodies to which their powers are delegated. 4. The competent authorities shall take all appropriate measures to ensure and monitor effective compliance with this Regulation. 5. The competent authorities shall have all supervisory and investigatory powers and adequate resources necessary for the exercise of their functions. Those powers shall include at least: (a) in the course of procedures to investigate potential infringements of this Regulation, the power to require all information necessary for the performance of the duties of the competent authorities from, among others, the following natural or legal persons: (i) payment service providers; (ii) technical service providers, operators of payment schemes and payment system operators that are not covered by Regulation (EU) 2025/1355, without prejudice to the oversight of the operations of those payment systems by the Eurosystem or central banks of Member States whose currency is not the euro; (iii) ATM deployers; (iv) providers of interpersonal communications services; (v) natural persons belonging to the entities referred to in points (i), (ii) and (iii); (vi) third parties to whom the entities referred to in points (i), (ii) and (iii) have outsourced operational functions or activities; (vii) agents and branches of the entities referred to in points (i), (ii) and (iii) that are established in the Member State of the competent authority; (viii) in so far as permitted by national law, any other person, in particular those involved in the initiation, processing or execution of payment services; (b) the power to conduct all necessary investigations of any person referred to in point (a) that is established or located in the Member State of the competent authority or providing services therein, where necessary to carry out the tasks of the competent authorities, including the power to: (i) require the submission of documents; (ii) examine the books and records of the persons referred to in points (a)(i) to (a)(vii) and take copies or extracts from such books and records; (iii) obtain written or oral explanations from any person referred to in points (a)(i) to (a)(vii) or their representatives or staff, where applicable; (iv) interview any other natural person who consents to be interviewed for the purpose of collecting information relating to the subject matter of an investigation; (c) the power to conduct all necessary inspections at the premises of the legal persons and at sites other than the private residence of the natural persons referred to in point (a), subject to the prior notification of the competent authorities concerned; (d) the power to enter the premises of natural and legal persons, in accordance with national law, in order to seize items, documents and data in any form where a reasonable suspicion exists that items, documents or data relating to the subject matter of the inspection or investigation might be necessary and relevant to prove an infringement of this Regulation; (e) the power to require, in so far as it is permitted by national law, existing data traffic records held by a telecommunications operator, where there is a reasonable suspicion of an infringement and where such records may be necessary for the investigation of an infringement of this Regulation; (f) the power to request the freezing or sequestration of assets, or both; (g) the power to refer matters for criminal investigation; (h) in the absence of other available means to bring about the cessation or the prevention of any infringement of this Regulation and in order to avoid the risk of serious harm to the interests of consumers, in so far as permitted by national law and in accordance where applicable with Article 9 of Regulation (EU) 2022/2065, the power to take any of the following measures, including by requesting a third party or other public authority to implement them: (i) to issue an order to remove content or to restrict access to an online interface or to display a warning that is explicitly displayed to customers when they access an online interface; (ii) to order a provider of hosting services to remove or disable access to an online interface; (iii) to order domain registries or registrars to delete a fully qualified domain name and to allow the competent authority concerned to register it; (i) the power to prohibit an offer of payment services where competent authorities find that this Regulation has been infringed or where there are reasonable grounds for suspecting that it will be infringed; (j) the power to suspend or prohibit marketing communications where there are reasonable grounds for suspecting that this Regulation has been infringed; (k) the power to prohibit the provision of payment services where competent authorities find that this Regulation has been infringed; (l) where there is a reason to assume that a person is providing payment services without the required authorisation or the required registration, the power to order the immediate cessation of the activity without prior warning or imposition of a deadline; (m) the power to issue public notices. For the purposes of the first subparagraph, point (m), if the information published by the competent authority proves to be false or the underlying circumstances prove to be incorrect, the competent authority shall inform the public of that circumstance in the same way as it previously published the information in question. 6. EBA shall publish on its website a list of the competent authorities designated pursuant to paragraphs 1 and 2. 7. Where the law of a Member State lays down criminal sanctions applicable to infringements of this Regulation in accordance with Article 106(1) and (2), that Member State shall have in place the necessary laws, regulations and administrative provisions to enable competent authorities: (a) to liaise with competent judicial authorities in order to receive specific information regarding criminal investigations of alleged infringements of this Regulation, criminal proceedings commenced in respect of such alleged infringements, and the outcome of such proceedings including the final judgement; (b) to provide such information to other competent authorities and EBA to fulfil their obligation of cooperating with each other and with EBA for the purposes of this Regulation. 8. The implementation and the exercise of powers set out in this Article shall be proportionate and shall comply with Union and national law, including with applicable procedural safeguards and with the principles of the Charter. The investigation and enforcement measures adopted in application of this Regulation shall be appropriate to the nature and the overall actual or potential harm of the infringement. ## Article 102 - Professional secrecy 1. Without prejudice to cases covered by national criminal law, all persons who work or who have worked for competent authorities, and any experts acting on behalf of the competent authorities, shall be bound by the obligation of professional secrecy regarding the information related to investigations conducted by the competent authorities. 2. The information exchanged in accordance with Article 103 shall be subject to the obligation of professional secrecy by both the sharing and recipient authority. 3. Articles 53 to 61 of Directive 2013/36/EU shall apply mutatis mutandis. 4. This Article shall not preclude the exchange of information between competent authorities and tax authorities in the same Member State, in accordance with national law. Where the information originates in another Member State, it shall only be so exchanged with the express agreement of the competent authorities which have disclosed it. ## Article 103 - Jurisdiction and cooperation of competent authorities 1. In the event of an infringement or suspected infringement of Titles II and III, the competent authorities shall be those of the home Member State of the payment service provider, except in the case of agents and branches conducting business under the right of establishment, where the competent authorities shall be those of the host Member State. 2. In the event of infringements or suspected infringements of Titles II and III by technical service providers, operators of payment schemes, payment system operators, processing entities, ATM deployers, providers of electronic communications services or by their agents or branches, the competent authorities shall be those of the Member State where the service concerned is provided. 3. In the exercise of their investigatory and sanctioning powers, including in cross-border cases, competent authorities shall cooperate with each other in accordance with Union and national law by exchanging information with each other and ensuring mutual assistance with other competent authorities whose assistance is necessary for the effective enforcement of administrative sanctions and administrative measures. 4. The authorities from other sectors concerned shall cooperate with competent authorities for the effective enforcement of administrative sanctions and administrative measures. ## Article 104 - Dispute resolution 1. Payment service providers shall put in place and apply adequate and effective complaint resolution procedures for the settlement of complaints of payment service users which concern the rights and obligations set out in Titles II and III. The competent authorities shall monitor the performance of those procedures. Those procedures shall be applied in every Member State where the payment service provider offers the payment services and shall be available in an official language of the relevant Member State or in another language if agreed between the payment service provider and the payment service user. 2. Payment service providers shall reply, on paper or, if agreed between the payment service provider and the payment service user, on another durable medium, to the payment service users’ complaints. Such a reply shall address all points raised, within an adequate timeframe and at the latest within 15 business days of receipt of the complaint. In exceptional situations, if the answer cannot be given within 15 business days for reasons beyond the control of the payment service provider, it shall send a holding reply, clearly indicating the reasons for a delay in answering the complaint and specifying the deadline by which the payment service user will receive the final reply. In any event, the deadline for receiving the final reply shall not exceed 35 business days. Member States may introduce or maintain rules on dispute resolution procedures that are more advantageous to the payment service user than those referred to in the first subparagraph. Where Member States do so, those rules shall apply. 3. The payment service provider shall inform the payment service user about at least one ADR entity which is competent to deal with disputes concerning the rights and obligations set out in Titles II and III. 4. The information referred to in paragraph 3 shall be set out in a clear, comprehensive and easily accessible way on the website of the payment service provider and on the respective mobile application, where they exist, at the branch, and in the general terms and conditions of the contract between the payment service provider and the payment service user. The payment service provider shall specify how further information on the ADR entity concerned and on the conditions for using it can be accessed. ## Article 105 - ADR procedures 1. Member States shall establish adequate, independent, impartial, transparent and effective ADR procedures for the settlement of disputes between payment service users and payment service providers which concern the rights and obligations set out in Titles II and III. Such procedures shall be established in accordance with relevant Union and national law and the quality requirements laid down in Directive 2013/11/EU, using existing bodies where appropriate. ADR procedures shall be applicable to payment service providers. 2. The participation of payment service providers in ADR procedures for consumers shall be mandatory, unless the Member State demonstrates to the Commission that other mechanisms are equally effective. 3. Paragraphs 1 and 2 are without prejudice to the right of payment service users to initiate proceedings to contest the disputed payment transaction by the payment service providers before a court in accordance with the applicable national law. 4. The bodies referred to in paragraph 1 shall cooperate effectively for the resolution of cross-border disputes which concern the rights and obligations set out in Titles II and III. 5. Member States shall designate a competent authority in line with Article 18 of Directive 2013/11/EU which shall carry out the functions set out in Articles 19 and 20 of that Directive as regards ADR entities on their territory responsible for the resolution of disputes which concern the rights and obligations set out in Titles II and III of this Regulation. 6. Competent authorities as referred to in paragraph 5 shall notify to the Commission the ADR entity or entities in their territories responsible for the resolution of disputes concerning the rights and obligations set out in Titles II and III of this Regulation, in line with Article 20 of Directive 2013/11/EU. 7. The Commission shall make publicly available a list of the ADR entities notified to it in accordance with paragraph 6 and update that list whenever changes are communicated. Member States shall make publicly available a hyperlink to the website of the Commission containing the information referred to in the first subparagraph. ## Article 106 - Administrative sanctions and administrative measures 1. Without prejudice to the supervisory powers of competent authorities designated under Directive (EU) 2026/…, in accordance with Title II, Chapter 1, section 3 of that Directive, and the right of Member States to lay down criminal sanctions, Member States shall lay down rules on administrative sanctions and administrative measures applicable to infringements of this Regulation and shall ensure that they are implemented. Those administrative sanctions and administrative measures shall be effective, proportionate and dissuasive. 2. Member States may decide not to lay down rules on administrative sanctions and administrative measures applicable to infringements of this Regulation which are subject to sanctions under national criminal law. In such cases, those Member States shall notify the Commission of the relevant applicable criminal law provisions and any subsequent amendments thereto in accordance with Article 113. 3. Where the national rules referred to in paragraph 1 apply to payment service providers and other legal persons, in the event of an infringement and subject to the conditions laid down in national law, administrative sanctions and administrative measures shall be applicable to the members of the management body of such payment service providers and legal persons, as well as to other natural persons found to be responsible for an infringement of this Regulation. 4. Member States may lay down rules, in accordance with their national law, enabling their competent authorities to close an investigation into an alleged infringement of this Regulation, following a settlement agreement or an expedited enforcement procedure. The power of competent authorities to settle or open expedited enforcement procedures does not affect the obligations of Member States under paragraph 1. Paragraphs 1, 3 and 4 of this Article shall apply to the administrative sanctions and administrative measures referred to in Article 107. ## Article 107 - Administrative sanctions and administrative measures for specific infringements 1. Without prejudice to Article 106(2), national laws, regulations and administrative provisions shall lay down the administrative sanctions and administrative measures referred to in paragraph 2 of this Article for infringements of the following provisions: (a) the rules on access to accounts maintained with a credit institution laid down in Article 33; (b) the rules on account information services and payment initiation services laid down in Title III, Chapter 3; (c) the obligation to organise or perform fraud prevention mechanisms, including strong customer authentication as set out in Articles 91, 93 and 94; (d) the duty to comply with the requirements for transparency on fees by ATM operators or other cash distributors, in accordance with Article 20(3), first subparagraph, point (b); (e) failure of payment service providers to respect the period for compensation of payment service users as set out in Article 57(2), Article 58, first subparagraph, Article 60(3) and Article 66(2). 2. In the case of infringements referred to in paragraph 1, the applicable administrative sanctions and administrative measures shall include the following: (a) administrative fines: (i) in the case of a legal person, of a maximum of at least 10 % of its total annual turnover as defined under paragraph 3; (ii) in the case of a natural person, of a maximum of at least EUR 3 000 000, or in the Member States whose currency is not the euro, the corresponding value in the national currency on … [the date of entry into force of this Regulation]; (iii) of a maximum of at least twice the amount of the profits gained from or losses avoided because of the infringement, where those profits or losses can be determined, even if such fine exceeds the maximum amounts set out in point (i), as regards legal persons, or in point (ii) as regards natural persons; (b) a public statement indicating the legal or natural person responsible for the infringement and the nature of the infringement; (c) an order requiring the legal or natural person responsible for the infringement to cease the unlawful conduct and to desist from repeating it; (d) a temporary ban preventing any member of the management body of the legal person, or any other natural person who is held responsible for the infringement, from exercising managing functions. 3. The total annual turnover referred to in paragraph 2, point (a)(i), of this Article and in Article 108(1) of this Regulation shall be equal to the net turnover as defined in Article 2, point (5), of Directive 2013/34/EU according to the annual financial statements available for the latest balance sheet date, for which the members of the administrative, management and supervisory bodies of the legal person have responsibility. Where the legal person is a parent undertaking or a subsidiary of a parent undertaking which is required to prepare consolidated financial statements in accordance with Article 22 of Directive 2013/34/EU, the relevant total annual turnover shall be the net turnover or the revenue to be determined in accordance with the relevant accounting standards, according to the consolidated financial statements of the ultimate parent undertaking available for the latest balance sheet date, for which the members of the administrative, management and supervisory body of the ultimate undertaking have responsibility. 4. Member States may empower competent authorities, in accordance with national law, to impose other types of administrative sanctions and administrative measures and other types of sanctioning powers in addition to those referred to in paragraph 2. ## Article 108 - Periodic penalty payments 1. Competent authorities shall be entitled to impose periodic penalty payments on legal or natural persons for ongoing infringements of this Regulation or breaches of any decisions issued by a competent authority in accordance with this Regulation. Periodic penalty payments shall be effective and proportionate and shall consist of a daily amount to be paid until compliance is restored. They shall be imposed for a period not exceeding six months from the date indicated in the decision imposing the periodic penalty payments. Competent authorities shall be entitled to impose maximum periodic penalty payments of at least: (a) 3 % of the average daily turnover in the case of a legal person; (b) EUR 30 000 in the case of a natural person. The average daily turnover shall be the total annual turnover referred to in Article 107(3), divided by 365. Where a periodic penalty payment is imposed on a credit institution, the average daily turnover shall be the total annual turnover referred to in Article 66(3) and Article 67(3) of Directive 2013/36/EU, divided by 365. 2. Member States may provide for higher amounts of periodic penalty payments than those laid down in paragraph 1. ## Article 109 - Elements to be considered when determining administrative sanctions and administrative measures 1. Competent authorities shall take into account all relevant elements and circumstances in order to ensure that the type and level of administrative sanctions or administrative measures they apply for infringements of this Regulation are proportionate, including: (a) the seriousness and the duration of the infringement; (b) the degree of responsibility of the natural or legal person responsible for the infringement; (c) the financial strength of the natural or legal person responsible for the infringement, as indicated, among others, by the total annual turnover of the legal person, or the annual income of the natural person responsible for the infringement; (d) the magnitude of profits gained or losses avoided by the natural or legal person responsible for the infringement, in so far as they can be determined; (e) the losses for third parties resulted from the infringement, in so far as they can be determined; (f) criminal penalties previously imposed for the same infringement on the natural or legal person responsible for that infringement; (g) the impact of the infringement in the interests of consumers and other payment service users; (h) any actual or potential systemic negative consequences of the infringement; (i) the complicity or participation of more than one natural or legal person in the infringement; (j) previous infringements by the natural or legal person responsible for the infringement; (k) the level of cooperation of the natural or legal person responsible for the infringement with the competent authority; (l) any remedial action or measure undertaken by the natural or legal person responsible for the infringement to prevent its repetition. 2. Competent authorities that use settlement agreements or expedited enforcement procedures in accordance with Article 106(4) shall adapt the relevant administrative sanctions and administrative measures laid down in Articles 106 and 107 and periodic penalty payments laid down in Article 108 to the case concerned to ensure the proportionality thereof. ## Article 110 - Right of appeal 1. Decisions to impose administrative sanctions or administrative measures taken by the competent authorities pursuant to this Regulation shall be subject to appeal. 2. Where this Regulation sets a fixed period for a competent authority to act, a failure to act within such period shall be subject to appeal. ## Article 111 - Publication of administrative sanctions and administrative measures 1. Competent authorities shall publish on their websites all decisions imposing an administrative sanction or administrative measure on legal and natural persons for infringements of this Regulation, and, where applicable, all settlement agreements. Such publication shall include a short description of the infringement, the administrative sanction or administrative measure imposed, or, where applicable, a statement about the settlement agreement. Where a natural person is the subject of a decision imposing an administrative sanction or administrative measure or a party to a settlement agreement, the identity of that natural person shall not be published. Competent authorities shall publish a decision or settlement agreement referred to in the first subparagraph without undue delay after the legal or natural person subject to the decision or party to the settlement agreement has been notified of that decision or the settlement agreement has been signed. 2. By way of derogation from paragraph 1 of this Article, where the publication of the identity or other personal data of natural persons is deemed necessary by the national competent authority to protect the stability of the financial markets or to ensure the effective enforcement of this Regulation, including in the case of public statements referred to in Article 107(2), point (b), or temporary bans referred to in Article 107(2), point (d), the national competent authority may publish the identity of the persons or other personal data provided that it justifies such a decision and that the publication is limited to the personal data that is strictly necessary to protect the stability of the financial markets or to ensure the effective enforcement of this Regulation. 3. Where the decision imposing an administrative sanction or administrative measure is subject to appeal before the relevant judicial or other authority, competent authorities shall also publish on their official website, without delay, information on the appeal and any subsequent information on the outcome of such an appeal, in so far as it concerns legal persons. Where the appealed decision concerns a natural person and the derogation under paragraph 2 does not apply, competent authorities shall publish information on the appeal only in an anonymised version. 4. Competent authorities shall ensure that any publication made in accordance with this Article remains on their official websites for a period of at least five years. Personal data contained in the publication shall be kept on the official website of a competent authority only for the period which is necessary in accordance with the applicable data protection rules. ## Article 112 - Monitoring of proceedings, sanctions and measures 1. Competent authorities shall report to EBA, in an anonymised way and aggregated format on a regular basis: (a) initiated, suspended or closed formal administrative proceedings leading to the imposing of administrative sanctions or administrative measures for infringements of this Regulation; (b) periodic penalty payments imposed in accordance with Article 108 for ongoing infringements of this Regulation; (c) where applicable, settlement agreements and expedited enforcement procedures, and the outcome thereof, regardless of their publication, in accordance with Article 106(4); (d) criminal proceedings resulting in a conviction and related sanctions reported by judicial authorities in accordance with Article 101(7), point (a); (e) any appeal against decisions to impose criminal or administrative sanctions or administrative measures for infringements of this Regulation and the outcome of such an appeal. 2. When the competent authority discloses an administrative sanction or an administrative measure to the public in accordance with Article 111, it shall simultaneously report it to EBA. 3. By … [45 months from the date of entry into force of this Regulation], and every two years subsequently, EBA shall submit a report to the Commission on the application of sanctions by competent authorities to ensure compliance with this Regulation. ## Article 113 - Notification of implementing measures By … [21 months from the date of entry into force of this Regulation], Member States shall notify to the Commission the laws, regulations and administrative provisions adopted in accordance with this Chapter, including any relevant criminal law provisions. They shall notify the Commission without undue delay of any subsequent amendments thereto and of any laws, regulations and administrative provisions which they adopt in accordance with this Chapter at a later date.