--- instrument_id: psr chunk_id: psr_t03_ch08 chunk_title: "Enforcement procedures, competent authorities and penalties" path: "Title III RIGHTS AND OBLIGATIONS IN RELATION TO THE PROVISION AND USE OF PAYMENT SERVICES > Chapter 8" source_class: operative_text document_type: proposal normative_weight: non_binding legal_status: council_compromise_text jurisdiction: EU effective_period: from: null to: null articles_contained: - 89a - 89b - 90 - 91 - 92 - 93 - 94 - 95 - 96 - 97 - 98 - 99 - 100 - 101 - 102 - 103 topics: - payments - payment_services - enforcement - sanctions - authorisation - outsourcing - competent_authorities - payment_systems - conflicts_of_interest - governance - fraud_prevention - strong_customer_authentication - financial_statements - consolidation - data_protection - implementing_acts --- # Chapter 8 - Enforcement procedures, competent authorities and penalties ## Article 89a - Enforcement of provisions related to very large online platforms and very large online search engines The Commission shall have exclusive powers to supervise and enforce Article 59a(3), third sub- paragraph, point (iii), and Article 59b of this Regulation, where the obligations in those provisions apply to providers of very large online platforms and very large online search engines within the meaning of Article 33 of Regulation (EU) 2022/2065. Chapter IV of Regulation (EU) 2022/2065 shall apply for the purposes of that supervision and enforcement and any references therein to compliance with the relevant provisions of Regulation (EU) 2022/2065 shall be deemed to include Article 59a(3), third sub-paragraph, point (iii), and Article 59b of this Regulation, where the obligations in those provisions apply to providers of very large online platforms and very large online search engines. To the extent that powers are conferred upon the Commission under Chapter IV of Regulation (EU) 2022/2065, those powers shall also cover the application of Article 59a (3), third sub-paragraph, point (iii), and Article 59b of this Regulation, where those obligations apply to providers of very large online platforms and very large online search engines. ## Article 89b - Prohibition of persons other than payment service providers from providing payment services Natural or legal persons that are neither authorised payment service providers under [PSD3] nor exempted from such authorisation shall be prohibited from providing payment services. ## Article 90 - Complaints 1. Member States shall set up procedures which allow payment service users and other interested parties including consumer associations, to submit complaints to the competent authorities designated to ensure enforcement of this Regulation, with regard to payment service providers' alleged infringements of the provisions of this Regulation. 2. Where appropriate and without prejudice to the right to bring proceedings before a court in accordance with national procedural law, the reply from the competent authorities to the complaints referred to in paragraph 1 shall inform the complainant of the existence of the alternative dispute resolution (ADR) procedures set up in accordance with Article 95. ## Article 91 - Competent authorities and supervisory and investigatory powers -1. Member States shall designate the competent authorities responsible for carrying out the functions and duties provided for in this Regulation. Member States shall notify those competent authorities to the EBA and the Commission. -1a. Where Member States designate more than one competent authority pursuant to paragraph -1, they shall determine their respective tasks and designate one competent authority as the single point of contact for cross-border administrative cooperation between competent authorities as well as with the EBA. Member States may designate a different single point of contact for each of those types of administrative cooperation. 1. Competent authorities shall exercise their powers to investigate potential infringements of this Regulation, and impose administrative penalties, periodic penalty payments and other administrative measures laid down in their national legal frameworks in accordance with this Regulation, in any of the following ways: (a) directly; (b) in collaboration with other authorities; (c) by delegating powers to other authorities or bodies, while retaining the responsibility for overseeing the delegated authority or body; (d) by applying to the competent judicial authorities. Where competent authorities delegate the exercise of their powers to other authorities or bodies in accordance with point (c) the delegation of power shall specify the delegated tasks, the conditions under which they are to be carried out, and the conditions under which the delegation of power may be revoked. The authorities or bodies to which the powers are delegated shall be organised in such a manner as to ensure that conflicts of interest are avoided. Competent authorities shall oversee the activity of the authorities or bodies to which the powers are delegated. 2. The competent authorities designated under paragraph -1 of this Article shall take all appropriate measures to ensure and monitor effective compliance with this Regulation. The competent authorities shall be either: (a) public authorities; (b) bodies recognised by national law or by public authorities expressly empowered for that purpose by national law, including national central banks. The competent authorities shall be independent from economic bodies and avoid conflicts of interest. Without prejudice to paragraph 2, point (b), payment institutions, credit institutions, or post office giro institutions shall not be designated as competent authorities. 3. The competent authorities referred to in paragraph 1shall have all supervisory and investigatory powers and adequate resources necessary for the exercise of their functions. Those powers shall include at least: (a) in the course of procedures to investigate potential breaches of this Regulation, the power to require from, inter alia, the following natural or legal persons, all information necessary for the performance of the duties of the competent authorities: (i) payment services providers; (ii) technical service providers, payment scheme operators and payment system operators that are not covered by Regulation (EU) 2025/1355, without prejudice to the oversight of the operations of those payment systems by the Eurosystem or central banks of Member States whose currency is not the euro; (iii) ATM deployers which do not service payment accounts; (iv) providers of electronic communications services as defined in Article 2(4), point (b), of Directive (EU) 2018/1972; (v) natural persons belonging to the entities referred to in points (i), (ii) and (iii); (vi) third parties to whom the entities referred to in points (i), (ii) and (iii) have outsourced operational functions or activities; (vii) agents and branches of the entities referred to in points (i), (ii) and (iii) that are established in the Member State concerned; (viii) insofar as permitted by national law, any other person, in particular those involved in the initiation, processing or execution of payment services; (b) the power to conduct all necessary investigations of any person referred to in points (a) (i) to (viii) established or located in the Member State of the competent authority or providing services therein, where necessary to carry out the tasks of the competent authorities, including the power to: (i) require the submission of documents; (ii) examine the books and records of the persons referred to in points (a) (i) to (vii) and take copies or extracts from such books and records; (iii) obtain written or oral explanations from any person referred to in points (a) (i) to (vii) or their representatives or staff, where applicable; (iv) interview any other natural person who consents to be interviewed for the purpose of collecting information relating to the subject matter of an investigation; (c) the power to conduct all necessary inspections at the premises of the legal persons and at sites other than the private residence of the natural persons referred to in point (a), subject to the prior notification of the competent authorities concerned. (d) to enter the premises of natural and legal persons, in accordance with national law, in order to seize items, documents and data in any form where a reasonable suspicion exists that items, documents or data relating to the subject matter of the inspection or investigation might be necessary and relevant to prove a case of breach of provisions of this Regulation; (e) to require, insofar as permitted by national law, existing data traffic records held by a telecommunications operator, where there is a reasonable suspicion of a breach and where such records may be necessary for the investigation of a breach of this Regulation; (f) to request the freezing or sequestration of assets, or both; (g) to refer matters for criminal investigation; (h) in the absence of other available means to bring about the cessation or the prevention of any breach of this Regulation and in order to avoid the risk of serious harm to the interests of consumers, insofar as permitted by national law and in accordance where applicable with Article 9 of Regulation (EU) 2022/2065, to take any of the following measures, including by requesting a third party or other public authority to implement them: (i) to issue an order to remove content or to restrict access to an online interface or to display a warning that is explicitly displayed to customers when they access an online interface; (ii) to order a hosting service provider to remove or disable access to an online interface; (iii) to order domain registries or registrars to delete a fully qualified domain name and to allow the competent authority concerned to register it. (i) to prohibit an offer of payment services where competent authorities find that this Regulation has been infringed or where there are reasonable grounds for suspecting that it will be infringed; (j) to suspend or prohibit marketing communications where there are reasonable grounds for suspecting that this Regulation has been infringed; (k) to prohibit the provision of payment services where they find that this Regulation has been infringed; (l) where there is a reason to assume that a person is providing payment services without the required authorisation or the required registration, to order the immediate cessation of the activity without prior warning or imposition of a deadline; (m) issue public notices; For the purposes of point (m), if the information published by the competent authority proves to be false or the underlying circumstances incorrect, the competent authority shall inform the public of this in the same way as it previously published the information in question. 3a. The EBA shall publish on its website a list of the competent authorities designated in accordance with paragraphs 1 and 2. 4. Where the law of a Member State lays down criminal sanctions applicable to infringements of this Regulation in accordance with Article 96, paragraphs (1) and (2), that Member State shall have in place the necessary laws, regulations and administrative provisions to enable competent authorities: (a) to liaise with competent judicial authorities in order to receive specific information regarding criminal investigations of alleged infringements of this Regulation, criminal proceedings commenced in respect of such alleged infringements, and the outcome of such proceedings including the final judgement; (b) to provide such information to other competent authorities and the EBA to fulfil their obligation of cooperating with each other and with the EBA for the purposes of this Regulation. 5. The implementation and the exercise of powers set out in this Article shall be proportionate and shall comply with Union and national law, including with applicable procedural safeguards and with the principles of the Charter of Fundamental Rights of the European Union. The investigation and enforcement measures adopted in application of this Regulation shall be appropriate to the nature and the overall actual or potential harm of the infringement. 6. By [21 months from the date of entry into force of this Regulation], the EBA shall issue guidelines in accordance with Article 16 of Regulation (EU) No 1093/2010, on complaints procedures, including the channels for submission of complaints, the information requested from complainants, and the disclosure of the aggregate analysis of complaints referred to in Article 90(1). ## Article 92 - Professional secrecy 1. Without prejudice to cases covered by national criminal law, all persons who work or who have worked for competent authorities, and any experts acting on behalf of the competent authorities, shall be bound by the obligation of professional secrecy regarding the information related to investigations conducted by the competent authorities. 2. The information exchanged in accordance with Article 93 shall be subject to the obligation of professional secrecy by both the sharing and recipient authority. 2a. Articles 53 to 61 of Directive 2013/36/EU shall apply mutatis mutandis. 2b. This Article shall not preclude the exchange of information between competent authorities and tax authorities in the same Member State, in accordance with national law. Where the information originates in another Member State, it shall only be exchanged as referred to in the first sentence of this paragraph with the express agreement of the competent authorities which have disclosed it. ## Article 93 - Jurisdiction and cooperation of competent authorities 1. In the event of infringement or suspected infringement of Titles II and III, the competent authorities shall be those of the home Member State of the payment service provider, except for agents and branches conducting business under the right of establishment, where the competent authorities shall be those of the host Member State. 2. In the event of infringements or suspected infringements of Titles II and III by technical service providers, payment scheme operators, payment system operators, processing entities, ATM deployers which do not service payment accounts, electronic communications services providers or by their agents or branches, the competent authorities shall be those of the Member State where the service concerned is provided. 3. In the exercise of their investigatory and sanctioning powers, including in cross border cases, competent authorities shall cooperate with each other in accordance with Union and national law by exchanging information with each other and ensuring the mutual assistance to other competent authorities concerned as necessary for the effective enforcement of administrative sanctions and administrative measures. 4. The authorities from other sectors concerned, referred to in paragraph 3, shall cooperate with competent authorities for the effective enforcement of administrative sanctions and administrative measures. ## Article 94 - Dispute resolution 1. Payment service providers shall put in place and apply adequate and effective complaint resolution procedures for the settlement of complaints of payment service users concerning the rights and obligations under Titles II and III. The competent authorities shall monitor the performance of those procedures. Those procedures shall be applied in every Member State where the payment service provider offers the payment services and shall be available in an official language of the relevant Member State or in another language if agreed between the payment service provider and the payment service user. 2. Payment service providers shall reply, on paper or, if agreed between the payment service provider and the payment service user, on another durable medium, to the payment service users’ complaints. Such a reply shall address all points raised, within an adequate timeframe and at the latest within 15 business days of receipt of the complaint. In exceptional situations, if the answer cannot be given within 15 business days for reasons beyond the control of the payment service provider, it shall send a holding reply, clearly indicating the reasons for a delay in answering to the complaint and specifying the deadline by which the payment service user will receive the final reply. In any event, the deadline for receiving the final reply shall not exceed 35 business days. Member States may introduce or maintain rules on dispute resolution procedures that are more advantageous to the payment service user than that referred to in the first subparagraph. Where Member States do so, those rules shall apply. 3. The payment service provider shall inform the payment service user about at least one ADR entity which is competent to deal with disputes concerning the rights and obligations under Titles II and III. 4. The information referred to in paragraph 3 shall be mentioned in a clear, comprehensive and easily accessible way on the website of the payment service provider and on the respective mobile application, where they exist, at the branch, and in the general terms and conditions of the contract between the payment service provider and the payment service user. The payment service provider shall specify how further information on the ADR entity concerned and on the conditions for using it can be accessed. ## Article 95 - ADR procedures 1. Member States shall establish adequate, independent, impartial, transparent and effective ADR procedures for the settlement of disputes between payment service users and payment service providers concerning the rights and obligations under Titles II and III according to the relevant Union and national law in accordance with the quality requirements laid down in Directive 2013/11/EU of the European Parliament and the Council29, using existing competent bodies where appropriate. ADR procedures shall be applicable to payment service providers. The first subparagraph and paragraph 1a are without prejudice to the right of the payment service user concerned to initiate proceedings to contest the disputed payment transaction by the payment service providers before a court in accordance with the applicable law. 1a. The participation of payment service providers in ADR procedures for consumers shall be mandatory, unless the Member State demonstrates to the Commission that other mechanisms are equally effective. 2. The bodies referred to in paragraph 1 of this Article shall cooperate effectively for the resolution of cross-border disputes concerning the rights and obligations under Titles II and III. 29 Directive 2013/11/EU of the European Parliament and of the Council of 21 May 2013 on alternative dispute resolution for consumer disputes and amending Regulation (EC) No 2006/2004 and Directive 2009/22/EC (Directive on consumer ADR) (OJ L 165, 18.6.2013, p. 63). 3. Member States shall designate a competent authority in line with Article 18 of Directive 2013/11/EU which shall carry out the functions set out in Articles 19 and 20 of that Directive as regards ADR entity or entities on their territory to resolve disputes concerning rights and obligations under Titles II and III of this Regulation. 4. Competent authorities, referred to in paragraph 3 shall notify ADR entity or entities in their territories to resolve disputes concerning rights and obligations under Titles II and III to the Commission, in line with Article 20 of Directive 2013/11/EU. 5. The Commission shall make publicly available a list of the ADR entities notified to it in accordance with paragraph 4 and update that list whenever changes are communicated. Member States shall make publicly available a hyperlink to the website of the Commission containing the information referred to in the first subparagraph. ## Article 96 - Administrative sanctions and administrative measures 1. Without prejudice to the supervisory powers of competent authorities designated under Directive (EU) XXX (PSD3), in accordance with Title II, Chapter 1, section 3 of that Directive, and the right of Member States to lay down criminal sanctions, Member States shall lay down rules on administrative sanctions and administrative measures applicable to infringements of this Regulation and shall ensure that they are implemented. The administrative sanctions and administrative measures shall be effective, proportionate and dissuasive. 2. Member States may decide not to lay down rules on administrative sanctions and administrative measures applicable to breaches of this Regulation which are subject to sanctions under national criminal law. In such a case, Member States shall notify the Commission of the relevant criminal law provisions and any subsequent amendments thereto in accordance with Article 103. 3. Where the national rules referred to in paragraph 1 apply to payment service providers and other legal persons, in case of infringements and subject to the conditions laid down in national law, administrative sanctions and administrative measures shall be applicable to the members of the management body of such payment services providers and legal persons and to other natural persons found to be responsible for a breach of this Regulation. 4. Member States may lay down rules, in accordance with their national law, enabling their competent authorities to close an investigation concerning an alleged infringement of this Regulation, following a settlement agreement or an expedited enforcement procedure. The empowerment of competent authorities to settle or open expedite enforcement procedures does not affect the obligations upon Member States under paragraph 1. Paragraphs 1, 3 and 4 of this Article shall apply to the administrative sanctions and other administrative measures laid down in Article 97. ## Article 97 - Administrative sanctions and other administrative measures for specific infringements 1. Without prejudice to Article 96(2), national laws, regulations and administrative provisions shall lay down the administrative sanctions and other administrative measures referred to in paragraph 2 of this Article in respect of the breaching of the following provisions: (a) the rules on access to accounts maintained with a credit institution laid down in Article 32; (b) the rules on account information services and payment initiation services laid down in Title III, Chapter 3; (c) the obligation to organise or perform fraud prevention mechanisms, including strong customer authentication as set out in Articles 85, 86 and 87; (d) the duty to comply with the requirements for transparency on fees by ATM operators or other cash distributors, in accordance with Article 20(c) point (ii); (e) failure of payment service providers to respect the period for compensation of payment service users as set out in Article 56(2), Article 57(2), Article 59(2) and Article 63(2). 2. In the cases referred to in paragraph 1, the applicable administrative sanctions and administrative measures shall include the following: (a) administrative fines; (i) in the case of a legal person, a maximum administrative fine of at least 10% of its total annual turnover as defined under paragraph 3; (ii) in the case of a natural person, a maximum administrative fine of at least EUR 3 000 000, or in the Member States whose currency is not the euro, the corresponding value in the national currency on the date of entry into force of this Regulation; (iii) a maximum administrative fine of at least twice the amount of the profits gained from or losses avoided because of the breach, where those profits or losses can be determined, even if such fine exceeds the maximum amounts set out in this paragraph, point (i), as regards legal persons, or in point (ii) as regards natural persons. (b) a public statement indicating the legal or natural person responsible for the breach and the nature of the breach; (c) an order requiring the legal or natural person responsible for the breach to cease the unlawful conduct and to desist from repeating it; (d) a temporary ban preventing a member of the management body of the legal person, or any other natural person who is held responsible for the breach, from exercising managing functions. 3. The total annual turnover referred to in paragraph 2, point (a)(i) of this Article and in Article 98(1) of this Regulation shall be equal to the net turnover as defined in Article 2, point (5), of Directive 2013/34/EU according to the annual financial statements available for the latest balance sheet date, for which the members of the administrative, management and supervisory bodies of the legal person have responsibility. Where the legal person is a parent undertaking or a subsidiary of a parent undertaking which is required to prepare consolidated financial statements in accordance with Article 22 of Directive 2013/34/EU, the relevant total annual turnover shall be the net turnover or the revenue to be determined in accordance with the relevant accounting standards, according to the consolidated financial statements of the ultimate parent undertaking available for the latest balance sheet date, for which the members of the administrative, management and supervisory body of the ultimate undertaking have responsibility. 4. Member States may empower competent authorities, in accordance with national law, to impose other types of administrative measures and sanctions and other type of sanctioning powers in addition to those referred to in paragraph 2 of this Article. ## Article 98 - Periodic penalty payments 1. Competent authorities shall be entitled to impose periodic penalty payments on legal or natural persons for ongoing breaches of this Regulation or breaches of any decisions issued by a competent authority in accordance with this Regulation. Periodic penalty payment referred to in the first subparagraph shall be effective and proportionate and shall consist of a daily amount to be paid until compliance is restored. They shall be imposed for a period not exceeding 6 months from the date indicated in the decision imposing the periodic penalty payments. Competent authorities shall be entitled to impose maximum periodic penalty payments of at least: (a) 3% of the average daily turnover in the case of a legal person; (b) EUR 30.000 in the case of a natural person. The average daily turnover shall be the total annual turnover referred to in Article 97(3), divided by 365. Where a periodic penalty payment is imposed on a credit institution, the average daily turnover shall be the total annual turnover referred to in Articles 66(3) and 67(3) of Directive 2013/36/EU, divided by 365. 2. Member States may provide for higher amounts of pecuniary penalty payments than those laid down in paragraph 1. ## Article 99 - Elements to be considered when determining administrative sanctions and other administrative measures 1. Competent authorities, when determining the type and level of administrative sanctions or other administrative measures, shall take into account all relevant elements and circumstances to apply proportionate sanctions, including: (a) the seriousness and the duration of the infringement; (b) the degree of responsibility of the natural or legal person responsible for the infringement; (c) the financial strength of the natural or legal person responsible for the breach, as indicated, among others, by the total annual turnover of the legal person, or the annual income of the natural person responsible for the infringement; (d) the magnitude of profits gained or losses avoided by the natural or legal person responsible for the infringement, insofar as they can be determined; (e) the losses for third parties resulted from the infringement, insofar as they can be determined; (f) criminal penalties previously imposed for the same breach on the natural or legal person responsible for that breach; (g) the impact of the infringement in the interests of consumers and other payment services users; (h) any actual or potential systemic negative consequences of the infringement; (i) the complicity or participation of more than one natural or legal person in the infringement; (j) previous breaches by the natural or legal person responsible for the breach; (k) the level of cooperation of the natural or legal person responsible for the infringement with the competent authority; (l) any remedial action or measure undertaken by the legal or natural person responsible for the infringement to prevent its repetition. 2. Competent authorities that use settlement agreements or expedited enforcement procedures in accordance with Article 96(4) shall adapt the relevant administrative sanctions and administrative measures laid down in Articles 96 and 97 and periodic penalty payments laid down in Article 98 to the case concerned to ensure the proportionality thereof. ## Article 100 - Right of appeal 1. The decisions to impose administrative measure or administrative sanction taken by the competent authorities pursuant to this Regulation shall be subject to appeal. 2. Paragraph 1 shall apply also in respect of failure to act where this Regulation sets a fixed period for the competent authority to act. ## Article 101 - Publication of administrative sanctions and administrative measures 1. Competent authorities shall publish on their website all decisions imposing an administrative sanction or administrative measure on legal and natural persons, for breaches of this Regulation, and where applicable, all settlement agreements. The publication shall include a short description of the breach, the administrative sanction or other administrative measure imposed, or, where applicable, a statement about the settlement agreement. The identity of the natural person subject to the decision imposing an administrative sanction or administrative measure or to the settlement agreement to which that natural person is a party, shall not be published. Competent authorities shall publish the decision and the statement referred to in the first subparagraph without undue delay after the legal or natural person subject to the decision has been notified of that decision or the settlement agreement has been signed. 2. By derogation from paragraph 1, where the publication of the identity or other personal data of natural persons is deemed necessary by the national competent authority to protect the stability of the financial markets or to ensure the effective enforcement of this Regulation, including in the case of public statements referred to in Article 97(2)(b) or temporary bans referred to in Article 97(2)(d), the national competent authority may publish also the identity of the persons or personal data provided that it justifies such a decision and that the publication is limited to the personal data that is strictly necessary to protect the stability of the financial markets or to ensure the effective enforcement of this Regulation. 3. Where the decision imposing an administrative sanction or other administrative measure is subject to appeal before the relevant judicial or other authority, competent authorities shall also publish on their official website without delay, information on the appeal and any subsequent information on the outcome of such an appeal, insofar as it concerns legal persons. Where the appealed decision concerns a natural person and the derogation under paragraph 2 is not applied, competent authorities shall publish information on the appeal only in an anonymised version. 4. Competent authorities shall ensure that any publication made in accordance with this Article remains on their official website for a period of at least 5 years. Personal data contained in the publication shall be kept on the official website of the competent authority only for the period which is necessary in accordance with the applicable data protection rules. ## Article 102 - Monitoring of proceedings, sanctions and measures 1. Competent authorities shall report to the EBA, in an anonymised way and aggregated format on a regular basis: (a) initiated, suspended or closed formal administrative proceedings leading to imposing administrative sanctions or administrative measures for breaches of this Regulation; (b) periodic penalty payments imposed in accordance with Article 98 for ongoing breaches of this Regulation; (c) where applicable, settlement agreements and expedited enforcement procedures, and the outcome thereof, regardless of their publication; in accordance with Article 96(4); (d) criminal proceedings resulting in a conviction and related sanctions reported by judicial authorities in accordance with Article 91(4), point (a); (e) any appeal against decisions to impose criminal or administrative sanctions or administrative measures for breaches of this Regulation and the outcome of such an appeal. 2. When the competent authority discloses an administrative sanction or an administrative measure to the public, it shall simultaneously report them to the EBA. 3. Within 2 years after the date of application of this Regulation, and subsequently every 2 years, the EBA shall submit a report to the Commission on the application of sanctions by competent authorities to ensure compliance with this Regulation. ## Article 103 - Notification of implementing measures Member States shall notify the laws, regulations and administrative provisions adopted in accordance with this Chapter, including any relevant criminal law provisions, to the Commission by [ 21 months from the date of entry into force of this Regulation]. Member States shall notify the Commission without undue delay of any subsequent amendments thereto.