2023/0210(COD) | [ParlTrack]

Proposal for a regulation
Recital 31 a (new)

(31 a) To process digital payments online or offline, it is essential that front end payment service providers obtain access to near field communication technology (NFC) on mobile devices. These components include, in particular but not exclusively, NFC antennas and the so- called secure elements of mobile devices (e.g.: Universal Integrated Circuit Card (UICC), embedded SE (eSE), and microSD etc). It is therefore necessary to ensure that whenever needed to provide payment services, original equipment manufacturers of mobile devices or providers of electronic communication services would not refuse access to NFC antennas and secure elements. To ensure this also in the digital economy, providers of front-end payment services should be entitled to store software on relevant mobile devices’ hardware in order to make transactions technically possible both online and offline. For this purpose, original equipment manufacturers of mobile devices and providers of electronic communication services should be obliged to provide access on fair, reasonable and non-discriminatory terms to all hardware and software components when needed for online and offline transactions. In all instances, such operators should be obliged to provide adequate capacity on relevant hardware and software features in mobile devices to process online payment transactions and for storing funds on mobile devices for offline payment transactions. This obligation should be without prejudice to Article 6(7) of Regulation (EU) 2022/1925, which obliges gatekeepers to provide, free of charge, effective interoperability with, and access for the purposes of interoperability to, the operating system, hardware or software features of mobile devices, which is applicable to existing and new digital means of payments.

Amendment 101 #

Proposal for a regulation
Recital 39

(39) As consumers and undertakings are not in the same position of vulnerability, they do not need the same level of protection. While it is important to guarantee consumer rights by provisions from which it is not possible to derogate by contract, it is reasonable to let undertakings and organisations agree otherwise when they are not dealing with consumers. This may include the application of Strong Customer Authentication. Micro- enterprises, as defined in Commission Recommendation 2003/361/EC,44 may be treated in the same way as consumers. Certain rules should always apply, irrespective of the status of the user. __________________ 44 OJ L 124, 20.05.2003, p. 36-41.

Amendment 102 #

Proposal for a regulation
Recital 40

(40) To maintain a high level of consumer protection, consumers should have the right to receive information on services' conditions and prices free of charge before being bound by any payment service contract. To enable consumers to compare the services and conditions offered by payment service providers and, in the case of a dispute, to verify their contractual rights and obligations, consumers should be able to request that information and the framework contract on paper, free of charge and at any time during the contractual relationship.

Amendment 103 #

Proposal for a regulation
Recital 45

(45) To be able to make an informed choice payment service users should be able to compare Automatic Teller Machine (ATM) charges with those of other providers. TAs a general principle, domestic ATMs which are not considered as ATM deployers not servicing payment accounts should not charge any fees for withdrawals of cash to consumers. In addition, to increase the transparency of ATM charges for the payment service user payment service providers should provide payment service users with information on all applicable charges ~~for domestic~~at the initiation of a transaction for Union ATM withdrawals in different situations, depending on the ATM from which the payment service users withdraw cash.

Amendment 104 #

Proposal for a regulation
Recital 50

(50) To achieve comparability, the estimated currency conversion charges for credit transfers and remittances carried out within the Union and from the Union to a third country should be expressed in the same way, namely as a percentage mark-up over the latest available ~~euro~~applicable foreign exchange reference rates issued by the ~~European C~~relevant central Bbank ~~(ECB)~~, and the resultant currency conversion charge shown as a monetary amount in the currency used by the customer to initiate the currency conversion. When reference is made to ‘charges’ in this Regulation, it should also cover, where applicable, ‘currency conversion’ charges.

Amendment 105 #

Proposal for a regulation
Recital 50

(50) To achieve comparability, the estimated currency conversion charges for credit transfers and remittances carried out within the Union and from the Union to a third country should be expressed in the same way, namely as a ~~percentage mark- up over the latest available euro foreign exchange reference rates issued by the European Central Bank (ECB)~~charge in the currency in which the transaction is initiated. This currency conversion charge is made up of any mark-up over the mid- market exchange rate offered by neutral, independent and credible providers, expressed in a monetary value. When reference is made to ‘charges’ in this Regulation, it should also cover, where applicable, ‘currency conversion’ charges.

Amendment 106 #

Proposal for a regulation
Recital 52

(52) A surcharge is a charge by merchants to consumers that is added on top of the requested price for goods and services when a certain payment method is used by the consumer. One of the reasons for surcharging is to direct consumers to cheaper or more efficient payment instruments, hence fostering competition between alternative payment methods. Under the regime introduced by Directive (EU) 2015/2366, payees were prevented from requesting charges for the use of payment instruments for which interchange fees are regulated under Chapter II of Regulation (EU) 2015/751, i.e. for consumer debit and credit cards issued under four-party card schemes, and for those payment services to which Regulation (EU) No 260/2012 of the European Parliament and of the Council45 applies, i.e. credit transfer and direct debit transactions denominated in euro within the Union. Member States were allowed under Directive (EU) 2015/2366 to further prohibit or limit the right of the payee to request charges, taking into account the need to encourage competition and promote the use of efficient payment instruments. It is necessary to harmonise this approach to foster a level playing field in the Union, and therefore to enact a full ban on surcharging across the Union. __________________ 45 Regulation (EU) No 260/2012 of the European Parliament and of the Council of 14 March 2012 establishing technical and business requirements for credit transfers and direct debits in euro and amending Regulation (EC) No 924/2009 (OJ L 94, 30.3.2012, p. 22).

Amendment 107 #

Proposal for a regulation
Recital 53

(53) ~~Evidence gathered during the~~In its review of Directive (EU) 2015/2366 shows that the current rules on charges are appropriate and had a positive impact. There is no compelling need for further alignment of charging practices between Member States, as the existing surcharging ban already applies to a very large share of payments in the Union. It is estimated that 95% of card payments are subject to the existing surcharging ban. In addition, when a surcharge is applied, it is capped at the actual cost incurred by the merchant. However, in its review of Directive (EU) 2015/2366, the Commission identifie, the Commission identified a lack of harmonisation that allows surcharging for payment instruments and different interpretations concerning the payment instruments covered by the surcharging ban. It is therefore necessary to explicitly extend the surcharging ban to all credit transfers and direct debits and not just to those covered by Regulation (EU) No 260/2012, as was the case under Directive (EU) 2015/2366.

Amendment 108 #

Proposal for a regulation
Recital 53

(53) ~~Evidence gathered during the~~In its review of Directive (EU) 2015/2366 ~~shows that the current rules on charges are appropriate and had a positive impact. There is no compelling need for further alignment~~, the Commission identified a lack of char~~ging practices between Member States, as the existing surcharging ban already applies to a very large share of~~monisation on allowing surcharging for payments in the Union. It is estimated that 95% of card payments are subject to the existing surcharging ban. In addition, when a surcharge is applied, it is capped at the actual cost incurred by the merchant. However, in its review of Directive (EU) 2015/2366, the Commission identifiestruments not captured under Regulation (EU) 2015/751 and different interpretations concerning the payment instruments covered by the surcharging ban. It is therefore necessary to explicitly extend the surcharging ban to all ~~credit transfers and direct debits and not just to those covered by Regulation (EU) No 260/2012, as was the case under Directive (EU) 2015/2366~~payment instruments. This will contribute to consumer confidence in payment services and reduce the lack of harmonisation between Member States.

Amendment 109 #

Proposal for a regulation
Recital 53

(53) ~~Evidence gathered during the review of Directive (EU) 2015/2366 shows that the current rules on charges are appropriate and had a positive impact. There is no compelling~~There is a need for further alignment of charging practices between Member States, as the existing surcharging ban ~~already applies to a very large share of~~does not apply uniformly to all payments in the Union. It is estimated that 95% of card payments are subject to the existing surcharging ban. ~~In addition, w~~When a surcharge is applied, it is capped at the actual cost incurred by the merchant. ~~However, i~~In its review of Directive (EU) 2015/2366, the Commission identified different interpretations concerning the payment instruments covered by the surcharging ban. It is therefore necessary to explicitly extend the surcharging ban to all payment instruments, including credit transfers and direct debits, and not just to those covered by Regulation (EU) No 260/2012, as was the case under Directive (EU) 2015/2366.

Amendment 110 #

Proposal for a regulation
Recital 54

(54) Account information services and payment initiation services, often collectively known as ‘open banking services’, are payment services involving access to the data of a payment service user by payment service providers which do not hold the account holder’s funds nor service a payment account. Account information services allow the aggregation of a user’s data, at the request of the payment service user, with different account servicing payment service providers in one single place. Payment initiation services may allow the initiation of a payment from the user’s account, such as a credit transfer or a direct debit, in a convenient way for the user and the payee without the use of an instrument such as a payment card.

Amendment 111 #

Proposal for a regulation
Recital 57

(57) To guarantee a high level of security in data access and exchange, access to payment accounts and the data therein should, barring specific circumstances, be provided to account information and payment initiation service providers via an interface ~~designed and dedicated for ‘open banking’ purposes,~~ such as an API. To that end, the account servicing payment service provider should set up a secure communication with account information and payment initiation service providers. To avoid any uncertainty as to who is accessing the payment service user’s data, the ~~dedicated~~ interface should enable account information and payment initiation service providers to identify themselves to the account servicing payment service provider, and to rely on all the authentication procedures provided by the account servicing payment service provider to the payment service user. Account information and payment initiation service providers should as a general rule ~~use the interface dedicated for their access and therefore should~~ not use the customer interface of an account servicing payment service provider for the purpose of data access, except in cases of failure or unavailability of the ~~dedicated~~ interface in the conditions laid down in this Regulation. In such circumstances their business continuity would be endangered by their incapacity to access the data for which they have been granted a permission. It is indispensable that account information and payment initiation service providers be at all times able to access the data indispensable for them to service their clients.

Amendment 112 #

Proposal for a regulation
Recital 64

(64) For the provision of payment initiation services, the account servicing payment service provider should provide the payment initiation service provider with all information accessible to it regarding the execution of the payment transaction ~~immediately~~before and after the payment order has been ~~receiv~~initiated. Sometimes more information becomes available to the account servicing payment service provider after it has received the payment order, but before it has executed the payment transaction. Where relevant for the payment order and the execution of the payment transaction, the account servicing payment service provider should provide that information to the payment initiation service provider. The payment initiation service provider should benefit from the information necessary to assess the risks of non-execution of the initiated transaction. That information is indispensable to enable the payment initiation service provider to offer to a payee on behalf of whom it initiates the transaction a service whose quality can compete with other means of electronic payments available to the payee, including payment cards.

Amendment 113 #

Proposal for a regulation
Recital 66

(66) The review of Directive (EU) 2015/2366 has revealed that account information and payment initiation service providers are still exposed to many unjustified obstacles, despite the level of harmonisation achieved and of the prohibition on such obstacles imposed by Article 32(3) of Commission Delegated Regulation (EU) 2018/38947 . Those obstacles still significantly hamper the full potential of open banking in the Union. Those obstacles are regularly reported by account information and payment initiation service providers to supervisors, regulators and the Commission. They were analysed by the EBA in its June 2020 ~~Opinion on “Obstacles to the provision of third-party provider services under the Payment Services Directive~~entitled “Opinion of the European Banking Authority on obstacles under Article 32(3) of the RTS on SCA and CSC”. Despite clarifications efforts made there is still a lot of uncertainty, in the market and with supervisors, as to what constitutes a ‘prohibited obstacle’ to regulated open banking services. It is therefore indispensable to provide a clear and non- exhaustive list of such prohibited open banking obstacles, relying in particular on the work carried out by the EBA. __________________ 47 Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication (OJ L 69, 13.3.2018, p. 23).

Amendment 114 #

Proposal for a regulation
Recital 70

(70) Security of credit transfers is fundamental for increasing the confidence of payment service users in such services and ensuring their use. Payers intending to send a credit transfer to a given payee may, as a result of fraud or error, provide a unique identifier which does not correspond to an account held by that payee. To contribute to the reduction of fraud and errors, payment service users should benefit from a service which would verify whether there is any discrepancy between the unique identifier of the payee and the name, ofr other identifier such as a fiscal number, a European unique identifier as referred to in Article 16(1), second subparagraph, of Directive (EU) 2017/1132, or an LEI, that unambiguously identify the payee, provided by the payer and, should any such discrepancies be detected, notify the payer thereof. Such services, in the countries where they exist, have had a substantial positive impact on the level of fraud and errors. Given the importance of that service for the prevention of fraud and errors, such service should be available free of charge to consumers. To avoid undue frictions or delays in the processing of the transaction, the payment service provider of the payer should provide such notification within no more than a few seconds from the moment the payer has entered the payee information. To enable the payer to decide whether to proceed with the intended transaction, the payment service provider of the payer should provide such notification before the payer authorises the transaction. Certain credit transfer initiation solutions may be available to payers allowing them to place a payment order without inserting themselves the unique identifier. Instead, such data elements are provided by the provider of that initiation solution. In such cases, there is no need for a service verifying the match between the unique identifier and the name of the payee since the risk of fraud or errors is significantly reduced.

Amendment 115 #

Proposal for a regulation
Recital 71

(71) Regulation (EU) XXX amending Regulation (EU) No 260/2012 provides for a service verifying the match between the unique identifier and the name or other identifier of the payee to be offered to users of instant credit transfers in euro. To achieve a coherent framework for all credit transfers whilst avoiding any undue overlap, the verification service referred to in the present Regulation should only apply to credit transfers which are not covered by Regulation (EU) XXX amending Regulation (EU) No 260/2012.

Amendment 116 #

Proposal for a regulation
Recital 77

(77) In the case of an unauthorised payment transaction, the payment service provider should immediately refund the amount of that transaction to the payer. However, where there is a high suspicion of an unauthorised transaction resulting from fraudulent behaviour by the payer and where that suspicion is based on objective grounds which are communicated to the relevant national authority by the payment service provider, the payment service provider should be able to conduct an investigation before refunding the payer. The payment service provider should, within 120 business days after noting or being notified of the transaction, either refund the payer the amount of the unauthorised payment transaction or provide the payer the reasons and supporting evidence for refusing the refund and indicate the bodies to which the payer may refer the matter if the payer does not accept the reasons provided. To protect the payer from any disadvantages, the credit value date of the refund should not be later than the date when the amount was debited. To provide an incentive for the payment service user to notify, without undue delay, the payment service provider of any theft or loss of a payment instrument and thus to reduce the risk of unauthorised payment transactions, the user should be liable only for a very limited amount unless the payment service user has acted fraudulently or with gross negligence. In that context, an amount of EUR 50 seems to be adequate in order to ensure a harmonised and high-level user protection within the Union. There should be no liability where the payer is not able to become aware of the loss, theft or misappropriation of the payment instrument. Moreover, once a payment service user has notified a payment service provider that his or her payment instrument may have been compromised, the payment service user should not be required to cover any further losses stemming from unauthorised use of that instrument. Payment service providers should be responsible for the technical security of their own products.

Amendment 117 #

Proposal for a regulation
Recital 78

(78) Liability provisions in the case of authorised credit transfers where there was an incorrect application or malfunctioning of the service detecting discrepancies between the name or other identifier and unique identifier of a payee would create the right incentives for payment service providers to provide a fully functioning service, with the aim of reducing the risk of ill-informed payment authorisations. If the payer decided to make use of such a service, the payment service provider of the payer should be held liable for the full amount of the credit transfer in cases where that payment service provider failed, whereas it should have done so if properly functioning, to notify the payer of a discrepancy between the unique identifier and the name of the payee provided by the payer and such failure caused a financial damage to the payer. Where the liability of the payment service provider of the payer is attributable to the payment service provider of the payee, the payment service provider of the payee should compensate the payment service provider of the payer for the financial damage incurred.

Amendment 118 #

Proposal for a regulation
Recital 79

(79) ~~Consum~~Payment service users should be adequately protected in the context of ~~certa~~the so-called social engineering fraud~~ulent payment transactions that they have authorised without knowing these transactions wer~~, where the fraudster manipulates the payment service user in performing a certain action, such as initiating a payment transaction, or handing over their security credentials to the fraud~~ulent~~sters. The number of such type of ‘social engineering’ cases ~~where consumers are misled into authorising a payment transaction to a fraudster~~ has significantly increased in recent years. ‘Spoofing’ cases where fraudsters pretend to be a legitimate payee or an employees of a customer's payment service provider and misuse that person’s or the payment service provider's name, mail address or telephone number to gain the customers’ trust and trick them into carrying-out some actions, are unfortunately becoming more widespread in the Union. Those new types of ‘spoofing’ fraud are blurring the difference that existed in Directive (EU) 2015/2366 between authorised and unauthorised transactions. Means through which the consent may be assumed to be granted are also becoming more complex to identify, as fraudsters can take control of the whole consent and authentication process including of the strong customer authentication completion. The conditions under which the customer ~~authorised a transaction by giving~~gave his or her permission ~~to i~~for making a payment should be taken into due consideration, including by courts, to qualify a transaction as being authorised or unauthorised. ~~A transaction may indeed have been authorised in cir~~Therefore, where the cumstances where such authorisation was granted on manipulated premises affecting the integrity of the permission. It is therefore no longer possible, as was the case in Directive (EU) 2015/2366, to limit refunds to unauthorised transactions only. It would however be disproportionate and financially very costly to payment services providers to open every fraudulent transaction, authorised or unauthorised, to a systematic refund right. It might also cause moral hazard and a reduction in the customer’s vigilanceomer denies having authorised a payment, the use of the payer's personalised security credentials to authenticate a payment, including where relevant the application of strong customer authentication, should not in itself be sufficient to prove that the payment transaction was authorised by the payer.

Amendment 119 #

Proposal for a regulation
Recital 79

(79) Consumers should be adequately protected in the context of certain fraudulent payment transactions that they have authorised without knowing these transactions were fraudulent. The number of ‘social engineering’ cases where consumers are misled into authorising a payment transaction to a fraudster has significantly increased in recent years. ‘Spoofing’ cases where fraudsters pretend to be employees of a customer's payment service provider, or a relevant entity which could reasonably be linked to a trusted source of the customer, such as a central bank or government authority, and misuse the payment service provider's name, mail address or telephone number to gain the customers’ trust and trick them into carrying-out some actions, are unfortunately becoming more widespread in the Union. Those new types of ‘spoofing’ fraud are blurring the difference that existed in Directive (EU) 2015/2366 between authorised and unauthorised transactions. Means through which the consent may be assumed to be granted are also becoming more complex to identify, as fraudsters can take control of the whole consent and authentication process including of the strong customer authentication completion. The conditions under which the customer authorised a transaction by giving his or her permission to it should be taken into due consideration, including by courts, to qualify a transaction as being authorised or unauthorised. A transaction may indeed have been authorised in circumstances where such authorisation was granted on manipulated premises affecting the integrity of the permission. It is therefore no longer possible, as was the case in Directive (EU) 2015/2366, to limit refunds to unauthorised transactions only. It would however be disproportionate and financially very costly to payment services providers to open every fraudulent transaction, authorised or unauthorised, to a systematic refund right. It might also cause moral hazard and a reduction in the customer’s vigilance.

Amendment 120 #

Proposal for a regulation
Recital 79

(79) Consumers should be adequately protected in the context of certain fraudulent payment transactions that they have authorised without knowing these transactions were fraudulent. The number of ‘social engineering’ cases where consumers are misled into authorising a payment transaction to a fraudster has significantly increased in recent years. ‘Spoofing’ cases where fraudsters pretend to be employees of a customer's payment service provider and misuse the payment service provider's name, e-mail address or telephone number to gain the customers’ trust and trick them into carrying-out some actions, are unfortunately becoming more widespread in the Union. Those new types of ‘spoofing’ or 'impersonation' fraud are blurring the difference that existed in Directive (EU) 2015/2366 between authorised and unauthorised transactions. Means through which the ~~consent~~permission may be assumed to be granted are also becoming more complex to identify, as fraudsters can take control of the whole ~~consent~~permission and authentication process including of the strong customer authentication completion. The conditions under which the customer authorised a transaction by giving his or her permission to it should be taken into due consideration, including by courts, to qualify a transaction as being authorised or unauthorised. A transaction may indeed have been authorised in circumstances where such authorisation was granted on ~~manipulated premises~~the basis of manipulation, affecting the integrity of the permission. It is therefore no longer possible, as was the case in Directive (EU) 2015/2366, to limit refunds to unauthorised transactions only. It would however be disproportionate and financially very costly to payment services providers to open every fraudulent transaction, authorised or unauthorised, to a systematic refund right. It might also cause moral hazard and a reduction in the customer’s vigilance.

Amendment 121 #

Proposal for a regulation
Recital 80

(80) Payment service providers ~~could be also considered as victim~~have more means than consumers to put an end to cases of ‘“spoofing~~’ cases, as their details were usurped. However,~~”, where the fraudster impersonates an employee of the payment service provider and misuses the payment service provider’s ~~have more means than cons~~name, mail address or telephone numbers to ~~put an end to these fraud case~~trick customers into carrying out some actions, through adequate prevention and robust technical safeguards developed with electronic communications services providers such as mobile network operators, internet platforms etc. Those electronic communications services should be obliged to cooperate with payment service providers in the fight against fraud. If they fail to do so, they should be held jointly responsible in the event of fraud. Cases of bank employee impersonation fraud affect the good repute of the bank, of the banking sector as a whole and may cause significant financial damages to Union consumers, affecting their trust in electronic payments and in the banking system. A good-faith consumer who has been the victim of such ‘spoofing’ fraud where fraudsters pretend to be employees of a customer's payment service provider and misuse the payment service provider's name, mail address or telephone number should therefore be entitled to a refund of the full amount of the fraudulent payment transaction from the payment service provider, unless the payer has acted fraudulently or with ‘gross negligence’. As soon as the consumer becomes aware that he or she has been a victim of that type of spoofing fraud, the consumer should without undue delay report the incident to the police, preferably via online complaint procedures, where made available by the police, and to his or her payment service provider, providing every necessary supporting evidence. No refund should be granted where those procedural conditions are not fulfilled.

Amendment 122 #

Proposal for a regulation
Recital 81

(81) Given their obligations to safeguard the security of their services in accordance with Directive 2002/58/EC of the European Parliament and of the Council49 , electronic communications services providers have the capacity to contribute to the collective fight against ‘spoofing’ fraud. Therefore, and without prejudice to the obligations laid down in national law implementing that Directive, electronic communications services providers should also, where relevant, have the same level of liability as payment service providers, and cooperate with payment service providers with a view to preventing further occurrences of that type of fraud, including by acting promptly to ensure that appropriate organizational and technical measures are in place to safeguard the security and confidentiality of communications in accordance with Directive 2002/58/EC. Any claim ~~by a payment service provider~~for fraud against other providers, such as electronic communications services providers or online platforms, for financial damage caused in the context of this type of fraud should be made in accordance with ~~national law~~this Regulation. __________________ 49 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (OJ L 201, 31.7.2002, p.37).

Amendment 123 #

Proposal for a regulation
Recital 81

(81) Given their obligations to safeguard the security of their services in accordance with Directive 2002/58/EC of the European Parliament and of the Council49 , electronic communications services providers have the capacity to contribute to the collective fight against ‘spoofing’ fraud. Therefore, and without prejudice to the obligations laid down in national law implementing that Directive, electronic communications services providers should cooperate with payment service providers with a view to preventing further occurrences of that type of fraud, including by acting promptly to ensure that appropriate organizational and technical measures are in place to safeguard the security and confidentiality of communications in accordance with Directive 2002/58/EC. Any claim by a payment service provider against other providers, such as electronic communications services providers, for financial damage caused in the context of this type of fraud should be made in accordance with national law. Electronic communications services providers cannot be held liable for payment fraud committed by the third party. __________________ 49 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (OJ L 201, 31.7.2002, p.37).

Amendment 124 #

Proposal for a regulation
Recital 81 a (new)

(81 a) Online platforms can also contribute to increasing instances of fraud. Therefore, and without prejudice to their obligations under Regulation (EU) 2022/2065, they should be held liable where fraud has arisen as a direct result of fraudsters using their platform to defraud consumers.

Amendment 125 #

José Manuel GARCÍA-MARGALLO Y MARFIL

Proposal for a regulation
Recital 82

(82) To assess possible negligence or gross negligence on the part of the payment service user, account should be taken of all circumstances. ~~The evidence and degree of alleged negligence should generally be evaluated according to national law. However, w~~For example, where a payment service user falls victim of social engineering fraud, in order to assess whether the payment service user has acted with gross negligence, account should be taken of all relevant factors, including but not limited to the complexity of the fraud, the personal circumstances of the payment service user, whether the latter had reasonable grounds for believing that he/she was making a payment to a legitimate payee, and whether the payment service provider could have taken additional steps to help prevent the fraud from taking place. While the concept of negligence implies a breach of a duty of care, ‘gross negligence’ should mean more than mere negligence, involving conduct exhibiting a significant degree of carelessness; for example, making a payment to a fraudster without having any reasonable ground for believing the payee to whom the payment was intended is legitimate, or keeping the credentials used to authorise a payment transaction beside the payment instrument in a format that is open and easily detectable by third parties. The fact that a consumer has already received a refund from a payment service provider after having fallen victim of ~~bank employee~~ impersonation fraud and is introducing another refund claim ~~to the same payment service provider~~ after having been again victim of the same type of fraud could be considered as ‘gross negligence’ as that might indicate a high level of carelessness from the user who should have been more vigilant after having already be victim of the same fraudulent modus operandi.

Amendment 126 #

Proposal for a regulation
Recital 82

(82) To assess possible negligence or gross negligence on the part of the payment service user, account should be taken of all circumstances. The evidence and degree of alleged negligence should generally be evaluated according to national law. However, while the concept of negligence implies a breach of a duty of care, ‘gross negligence’ should mean more than mere negligence, involving conduct exhibiting a significant degree of carelessness; for example, keeping the credentials used to authorise a payment transaction beside the payment instrument in a format that is open and easily detectable by third parties. The fact that a consumer has already received a refund from a payment service provider after having fallen victim of bank employee impersonation fraud and is introducing another refund claim to the same payment service provider after having been again victim of the same type of fraud could be considered as ‘gross negligence’ as that might indicate a high level of carelessness from the user who should have been more vigilant after having already be victim of the same fraudulent modus operandi.

Amendment 127 #

Proposal for a regulation
Recital 82

(82) To assess possible negligence or gross negligence on the part of the payment service user, account should be taken of all circumstances. The evidence and degree of alleged negligence should generally be evaluated according to national law. However, while the concept of negligence implies a breach of a duty of care, ‘gross negligence’ should mean more than mere negligence, involving conduct exhibiting a significant degree of carelessness; for example, keeping the credentials used to authorise a payment transaction beside the payment instrument in a format that is open and easily detectable by third parties, unsafe manipulation with security codes, debit card or a device used to provide the access to banking, persuading the bank to lift the blockade placed after a fraud alert acting on guidance from an unfamiliar third party, transferring money to foreign accounts under suspicious circumstances or opening one or more crypto wallets acting on guidance from an unfamiliar third party. The fact that a consumer has already received a refund from a payment service provider after having fallen victim of bank employee impersonation fraud and is introducing another refund claim to the same payment service provider after having been again victim of the same type of fraud could be considered as ‘gross negligence’ as that might indicate a high level of carelessness from the user who should have been more vigilant after having already be victim of the same fraudulent modus operandi.

Amendment 128 #

Proposal for a regulation
Recital 82

(82) To assess possible negligence or gross negligence on the part of the payment service user, account should be taken of all circumstances. The evidence and degree of alleged negligence should generally be evaluated according to national law. However, while the concept of negligence implies a breach of a duty of care, ‘gross negligence’ should mean more than mere negligence, involving conduct exhibiting a significant degree of carelessness; for example, keeping the credentials used to authorise a payment transaction beside the payment instrument in a format that is open and easily detectable by third parties. The fact that a consumer has already received a refund from a payment service provider after having fallen victim of a trusted institution employee impersonation fraud, for example bank employee impersonation fraud, and is introducing another refund claim to the same payment service provider after having been again victim of the same type of fraud could be considered as ‘gross negligence’ as that might indicate a high level of carelessness from the user who should have been more vigilant after having already be victim of the same fraudulent modus operandi.

Amendment 129 #

Proposal for a regulation
Recital 82 a (new)

(82 a) Considering the difference in interpretation across the Union of the term 'gross negligence', the EBA should issue guidelines for Member States on how to define the term.

Amendment 130 #

Proposal for a regulation
Recital 98

(98) As acknowledged in the Communication from the Commission on a Retail Payments Strategy for the EU, the good functioning of EU payments markets is of substantial public interest. Therefore, when it is necessary in the context of this Regulation for the provision of payment services and for the compliance with this Regulation, payment service providers and payment system operators should be able to process special categories of personal data as defined in Article 9(1) of Regulation (EU) 2016/679 and Article 10(1) of Regulation (EU) 2018/1725. Where special categories of personal data are processed, payment service providers and payment system operators should implement appropriate technical and organisational measures to safeguard the fundamental rights and freedoms of natural persons. Those measures should include technical limitations on the re-use of data and the use of state-of-the-art security and privacy-preserving measures, including, but not limited to, pseudonymisation, or encryption to ensure compliance with the principles of purpose limitation, data minimisation and storage limitation, as laid down in Regulation (EU) 2016/679. The payment service providers and payment systems should also implement specific organisation measures, including training on processing such data, limiting access to special categories of data and recording such access.

Amendment 131 #

Proposal for a regulation
Recital 98

(98) As acknowledged in the Communication from the Commission on a Retail Payments Strategy for the EU, the good functioning of EU payments markets is of substantial public interest. Therefore, when it is necessary in the context of this Regulation for the provision of payment services and for the compliance with this Regulation, payment service providers and payment system operators should be able to process special categories of personal data as defined in Article 9(1) of Regulation (EU) 2016/679 and Article 10(1) of Regulation (EU) 2018/1725. Where special categories of personal data are processed, payment service providers and payment system operators should implement appropriate technical and organisational measures to safeguard the fundamental rights and freedoms of natural persons. Those measures should include technical limitations on the re-use of data and the use of state-of-the-art security and privacy-preserving measures, including pseudonymisation, or encryption to ensure compliance with the principles of purpose limitation, data minimisation and storage limitation, as laid down in Regulation (EU) 2016/679. The payment service providers and payment system operators should also implement specific organisation measures, including training on processing such data, limiting access to special categories of data and recording such access.

Amendment 132 #

Proposal for a regulation
Recital 100

(100) Fraudsters often target the most vulnerable individuals of our society. The timely detection of fraudulent payment transactions is essential, and transaction monitoring plays an import role in that detection. It is therefore appropriate to require payment service providers to have in place transaction monitoring mechanisms, reflecting the crucial contribution of those mechanisms to fraud prevention, going beyond the protection offered by strong customer authentication, in respect of payment transactions, including transactions involving payment initiation services. Where payment service providers fail to have in place the appropriate mechanisms to prevent fraud, they should be held responsible for covering the losses of payment service users resulting from fraud.

Amendment 133 #

Proposal for a regulation
Recital 100

(100) Fraudsters often target the most vulnerable individuals of our society. The timely detection of fraudulent payment transactions is essential, and transaction monitoring plays an important role in that detection. It is therefore appropriate to require payment service providers to have in place transaction monitoring mechanisms, reflecting the crucial contribution of those mechanisms to fraud prevention, going beyond the protection offered by strong customer authentication, in respect of payment transactions, including transactions involving payment initiation services.

Amendment 134 #

Proposal for a regulation
Recital 103

(103) Fraud in credit transfers is inherently adaptive and comprises an open- ended diversity of practices and techniques, including the stealing of authentication credentials, invoice tampering, and social manipulation. Therefore, to be able to prevent ever new types of fraud, transaction monitoring should be constantly improved, making full use of technology such as artificial intelligence. Often one payment service provider does not have the full picture about all elements that could lead to timely fraud detection. However, it can be made more effective with a greater amount of information on potentially fraudulent activity stemming from other payment service providers. Therefore, sharing of all relevant information between payment service providers should be ~~possible~~mandatory. To better detect fraudulent payment transactions and protect their customers, payment services providers should, for the purpose of transaction monitoring, make use of payment fraud data shared by other payment services providers on a multilateral basis such as dedicated IT platforms based on information sharing arrangements. To improve the protection of payers against fraud in credit transfers, payment service providers should be able to rely on information as comprehensive and up to date as possible, namely by collectively using information concerning unique identifiers, manipulation techniques and other circumstances associated with fraudulent credit transfers identified individually by each payment services provider. Before concluding an information sharing arrangement, payment service providers should carry out a data protection impact assessment, in accordance with Article 35 of Regulation (EU) 2016/679. Where the data protection impact assessment indicates that the processing would, in the absence of safeguards, security measures and mechanisms to mitigate the risk, result in a high risk to the rights and freedoms of natural persons, payment service providers should consult the relevant data protection authority in accordance with Article 36 of that Regulation (EU) 2016/679. A new impact assessment should not be required when a payment service provider joins an existing information sharing arrangement for which a data protection impact assessment has already been carried out. The information sharing arrangement should lay down technical and organisational measures to protect personal data. It should lay down roles and responsibilities under data protection laws, including in case of joint controllers, of all payment service providers.

Amendment 135 #

Proposal for a regulation
Recital 104

(104) For the purpose of exchanging personal data with other payment service providers who are subject to information sharing arrangements, ‘unique identifier’ should be understood as referring to ‘IBAN’ as defined in Article 2 point 15 of Regulation (EU) 260/2012.deleted

Amendment 136 #

Proposal for a regulation
Recital 104

Amendment 137 #

Proposal for a regulation
Recital 107 a (new)

(107 a)In order for consumers to benefit from continued strong SCA, and that it remains an effective tool in the fight against fraud in electronic payments, it is appropriate that the application of SCA be risk-based and outcome-focused. In turn, the rules on SCA should provide sufficient flexibility for innovation within the payments sector, including in the development of new SCA solutions.

Amendment 138 #

Proposal for a regulation
Recital 108

(108) SCA should not be circumvented notably by any unjustified reliance on SCA exemptions. Clear definitions of Merchant Initiated Transactions (MITs) and of Mail Orders or Telephone Orders (MOTOs) should be introduced by the EBA since these notions, which may be relied upon to justify non- application of SCA, are diversely understood and applied and are subject to abusive reliance. Regarding MITs, strong customer authentication should be applied at the set-up of the initial mandate, without the need to apply SCA for subsequent merchant-initiated payment transactions. Regarding MOTOs, only the initiation of payment transactions - not their execution - should be non-digital for a transaction to be considered as a MOTO and, therefore, not be covered by the obligation to apply SCA. However, payment transactions based on paper-based payment orders, mail orders or telephone orders placed by the payer should still entail security requirements and checks by the payment service provider of the payer allowing authentication of the payment transaction. SCA should also not be circumvented by practices including resorting to an acquirer established outside of the Union to escape the SCA requirements.

Amendment 139 #

Proposal for a regulation
Recital 109

(109) As the payment service provider that should apply strong customer authentication is the payment service provider that issues the personalised security credentials, payment transactions that are not initiated by the payer but by the payee only should not be subject to strong customer authentication to the extent that those transactions are initiated without any interaction or involvement of the payer. ~~The regulatory approach to MITs and direct debits, both being transactions initiated by the payee, should be aligned and benefit from the same consumer protection measures, including refunds.~~

Amendment 140 #

Proposal for a regulation
Recital 109 a (new)

(109 a)In the context of business to business (B2B) or business to government (B2G) payments, SCA should be appropriate to the risk level of such transactions, taking into account in particular the already existing controls and checks that exist among these operators. In order to reduce administrative burden, SCA should not be required for every transaction in these scenarios, and should be adapted to a risk-based approach.

Amendment 141 #

Proposal for a regulation
Recital 115

(115) Under the exemption from SCA under Article 18 of Delegated Regulation (EU) 2018/389, payment service providers were allowed not to apply SCA where the payer initiated a remote electronic payment transaction identified by the payment service provider as posing a low level of risk evaluated on the basis of transaction monitoring mechanisms. Feedback from the market showed however that, in order to have more payment service providers implementing transaction risk analysis, it is necessary to adopt appropriate rules on the scope of transaction risk analysis, introducing clear audit requirements, providing more detail and better definitions on risk monitoring requirements and data to share, and to assess the potential benefits of allowing payment service providers to report fraudulent transactions for which they are solely liable. The EBA should develop draft Regulatory Technical Standards laying down rules on transaction risk analysis. In order to increase the use of this exemption, the draft RTS should consider additional thresholds for the transaction risk analysis exemption. Furthermore, they should consider whether it is necessary to clarify whether payment service providers should count liability only towards the payer in their fraud rates.

Amendment 142 #

Proposal for a regulation
Recital 116

(116) Security measures should be compatible with the level of risk involved in payment services. To allow the development of user-friendly and accessible means of payment for low-risk payments, such as low value contactless payments at the point of sale or payments made in a corporate context by corporate payer, whether or not these payments are based on mobile phone, the exemptions to the application of security requirements should be specified in regulatory technical standards. Safe use of personalised security credentials is needed to limit the risks relating to spoofing, phishing and other fraudulent activities. The user should be able to rely on the adoption of measures that protect the confidentiality and integrity of personalised security credentials.

Amendment 143 #

Proposal for a regulation
Recital 119

(119) Operators of digital pass-through wallets that verify the elements of SCA when tokenised instruments stored in the digital wallets are used for payments should be required to enter into outsourcing agreements with the payers’ payment service providers to allow them to continue to perform such verifications, but also requiring them to comply with key security requirements. The payer’s payment service providers should, under such agreements, retain full liability for any failure by operators of digital pass- through wallets to apply SCA and have the right to audit and control the wallet operator’s security provisions. An outsourcing agreement is not needed if the payer’s payment service provider remains in control of strong customer authentication.

Amendment 144 #

Proposal for a regulation
Recital 120

(120) Where technical service providers or operators of payment schemes provide services to payees or to the payment service providers of payees or of payers, they should support the application of strong customer authentication within the remit of their role in the initiation or execution of payment transactions. Given the role that they play in ensuring that key security requirements concerning retail payments are properly implemented, including by providing appropriate IT solutions, technical service providers and operators of payment schemes should be held liable for the financial damages caused to payees or to the payment service providers of the payees or of the payers in case they fail to ~~support~~enable the application of strong customer authentication.

Amendment 145 #

Proposal for a regulation
Recital 120

(120) Where technical service providers or operators of payment schemes provide services to payees or to the payment service providers of payees or of payers, they should support the application of strong customer authentication within the remit of their role in the initiation or execution of payment transactions. Given the role that they play in ensuring that key security requirements concerning retail payments are properly implemented, including by providing appropriate IT solutions, technical service providers and operators of payment schemes should be held liable for the financial damages caused to ~~payees or to~~ the payment service providers of the payees or of the payers in case they fail to support the application of outsourced strong customer authentication.

Amendment 146 #

Proposal for a regulation
Recital 140

(140) The EBA should, in line with Article 9(5) of Regulation (EU) No 1093/2010, be granted product intervention powers to be able to temporarily prohibit or restrict in the Union certain type or a specific feature of a payment service or an electronic money service which is identified as potentially causing harm to consumers, threatening the orderly functioning and integrity of financial markets. Regulation (EU) No 1093/2010 should therefore be amended accordingly. Before exerting this power, the EBA should ensure that it has consulted with payment service providers or third-party providers.

Amendment 147 #

Proposal for a regulation
Recital 140 a (new)

(140 a)The EBA should be granted all the necessary resources, including human resources, to fulfill their mandate under this Regulation.

Amendment 148 #

Proposal for a regulation
Recital 141

(141) The Annex to Regulation (EU) 2017/2394 of the European Parliament and of the Council57 should be amended to include a reference to this Regulation to facilitate cross-border cooperation on the enforcement of this Regulation. __________________ 57 Regulation (EU) 2017/2394 of the European Parliament and of the Council of 12 December 2017 on cooperation between national authorities responsible for the enforcement of consumer protection laws and repealing Regulation (EC) No 2006/2004 (OJ L 345, 27.12.2017, p. 1– 26).

Amendment 149 #

Proposal for a regulation
Article 2 – paragraph 2 – point h a (new)

(h a) payment transactions using electronic money tokens as defined in Article 3 of Regulation (EU) 2023/1114, where the payment service provider has already been authorised as a crypto-asset service provider in a Member State of the European Union for those services under Title V of that Regulation.

Amendment 150 #

Proposal for a regulation
Article 2 – paragraph 2 – point i

(i) without prejudice to ~~Article 23(2), and~~ Articles 58 and 87, services provided by technical service providers;

Amendment 151 #

Proposal for a regulation
Article 2 – paragraph 2 – point j – point i

(i) instruments allowing the holder to acquire goods or services only in the physical or virtual premises of the issuer or within a single limited network of service providers under direct commercial agreement with a professional issuer;

Amendment 152 #

Proposal for a regulation
Article 2 – paragraph 2 – point j – point ii

(ii) instruments which can be used only to acquire a very limited range of goods or services, including but not limited to instruments restricted to use in business- to-business transactions;

Amendment 153 #

Proposal for a regulation
Article 2 – paragraph 2 – point j – point iii

(iii) instruments valid only in a single Member State, which are provided at the request of an undertaking or a public sector entity and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers having a commercial agreement with the issuer;deleted

Amendment 154 #

Frances FITZGERALD, Eleni STAVROU, José Manuel GARCÍA-MARGALLO Y MARFIL, Isabel BENJUMEA BENJUMEA, Lídia PEREIRA, Sirpa PIETIKÄINEN, Laurence SAILLIET

Proposal for a regulation
Article 2 – paragraph 2 – point j – point iii

Amendment 155 #

Emmanuel MAUREL

Proposal for a regulation
Article 2 – paragraph 2 – point j – point iii

Amendment 156 #

Sirpa PIETIKÄINEN

Proposal for a regulation
Article 2 – paragraph 2 – point j – point iii

Amendment 157 #

Proposal for a regulation
Article 2 – paragraph 2 – point j – point iii

Amendment 158 #

Denis NESCI

Proposal for a regulation
Article 2 – paragraph 2 – point j – point iii

(iii) instruments valid only in a single Member State or in a region, which are provided at the request of an undertaking or a public sector entity and regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers having a commercial agreement with the issuer;

Amendment 159 #

Proposal for a regulation
Article 2 – paragraph 2 – point k

(k) payment transactions by a provider of electronic communications networks as defined in Article 2, point (1), of Directive (EU) 2018/1972 of the European Parliament and of the Council62 , or services provided in addition to electronic communications services as defined in Article 2, point (4), of that Directive to a subscriber to the network or service: (i) voice-based services, regardless of the device used for the purchase or consumption of the digital content and charged to the related bill; or (ii) electronic device and charged to the related bill within the framework of a charitable activity or for the purchase of tickets; provided that the value of any single payment transaction does not exceed EUR 50 and: — transactions for an individual subscriber does not exceed EUR 300 per month, or — account with the provider of the electronic communications network or service, the cumulative value of payment transactions does not exceed EUR 300 per month; __________________ 62 Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (OJ L 321, 17.12.2018, p. 36).deleted to purchase digital content and performed from or via an the cumulative value of payment where a subscriber pre-funds its

Amendment 160 #

Proposal for a regulation
Article 2 – paragraph 2 – point k – paragraph 1

payment transactions by a provider of electronic communications networks as defined in Article 2, point (1), of Directive (EU) 2018/1972 of the European Parliament and of the Council62 , or services provided in addition to electronic communications services as defined in Article 2, point (4), of that Directive to a subscriber to the network or service: (i) to purchase digital content and voice-based services, regardless of the device used for the purchase or consumption of the digital content and charged to the related bill; or (ii) electronic device and charged to the related bill within the framework of a charitable activity or for the purchase of tickets; __________________ 62 Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (OJ L 321, 17.12.2018, p. 36).deleted performed from or via an

Amendment 161 #

Proposal for a regulation
Article 2 – paragraph 2 – point k – paragraph 1

payment transactions by a provider of electronic communications networks as defined in Article 2, point (1), of Directive (EU) 2018/1972 of the European Parliament and of the Council62 , or services provided in addition to electronic communications services as defined in Article 2, point (4), of that Directive to a subscriber to the network or service: (i) voice-based services, regardless of the device used for the purchase or consumption of the digital content and charged to the related bill; or (ii) electronic device and charged to the related bill within the framework of a charitable activity or for the purchase of tickets; __________________ 62 Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (OJ L 321, 17.12.2018, p. 36).deleted to purchase digital content and performed from or via an

Amendment 162 #

Proposal for a regulation
Article 2 – paragraph 2 – point k – paragraph 1 – point i

~~(i) to purchase digital content and voice-based services, regardless of the device used for the purchase or consumption of the digital content and charged to the related bill; or~~deleted

Amendment 163 #

Proposal for a regulation
Article 2 – paragraph 2 – point k – paragraph 1 – point ii

~~(ii) performed from or via an electronic device and charged to the related bill within the framework of a charitable activity or for the purchase of tickets;~~deleted

Amendment 164 #

Proposal for a regulation
Article 2 – paragraph 2 – point k – paragraph 2

provided that the value of any single payment transaction does not exceed EUR 50 and: — the cumulative value of payment transactions for an individual subscriber does not exceed EUR 300 per month, or — where a subscriber pre-funds its account with the provider of the electronic communications network or service, the cumulative value of payment transactions does not exceed EUR 300 per month;deleted

Amendment 165 #

Proposal for a regulation
Article 2 – paragraph 2 – point k – paragraph 2

provided that the value of any single payment transaction does not exceed EUR 50 and: — transactions for an individual subscriber does not exceed EUR 300 per month, or — account with the provider of the electronic communications network or service, the cumulative value of payment transactions does not exceed EUR 300 per month;deleted the cumulative value of payment where a subscriber pre-funds its

Amendment 166 #

Proposal for a regulation
Article 2 – paragraph 2 – point k – paragraph 2 – introductory part

provided that the value of any single payment transaction does not exceed EUR 5100 and:

Amendment 167 #

Proposal for a regulation
Article 2 – paragraph 2 – point k – paragraph 2 – introductory part

provided that the value of any single payment transaction does not exceed EUR 560 and:

Amendment 168 #

Proposal for a regulation
Article 2 – paragraph 2 – point k – paragraph 2 – indent 1

– the cumulative value of payment transactions for an individual subscriber does not exceed EUR 3500 per month, or

Amendment 169 #

Frances FITZGERALD, Lídia PEREIRA

Proposal for a regulation
Article 2 – paragraph 2 – point k – paragraph 2 – indent 2

– where a subscriber pre-funds its account with the provider of the electronic communications network or service, the cumulative value of payment transactions does not exceed EUR 3500 per month;

Amendment 170 #

Proposal for a regulation
Article 2 – paragraph 2 – point m

(m) payment transactions and related services between a parent undertaking and its subsidiary or between subsidiaries of the same parent undertaking, without any intermediary intervention by a payment service provider other than an undertaking belonging to the same group, and the collection of payment orders ~~on behalf of a group by~~from entities belonging to the same group in order to process payments on behalf of those entities through a paryment ~~undertaking or its subsidiary for onward transmission to~~s service provider, including payment orders made to external third parties, and for collecting funds from external third parties by a parent company or by a subsidiary on behalf of group entities through a payment service provider.

Amendment 171 #

Proposal for a regulation
Article 2 – paragraph 2 – point m

(m) payment transactions and related services between a parent undertaking and its subsidiary or between subsidiaries of the same parent undertaking, ~~without any intermediary intervention by a payment service provider other than an undertaking belonging to the same group, and~~including the collection of funds as well as the ~~coll~~execution of payment ~~order~~s on behalf of a group by a parent undertaking or its subsidiary ~~for onward transmission to a payment service provider~~.

Amendment 172 #

Proposal for a regulation
Article 2 – paragraph 2 – point m a (new)

(m a) instruments issued to fulfil the requirements of Article 70(2) and (3) of Regulation (EU) 2023/1114 (MICAR).

Amendment 173 #

Proposal for a regulation
Article 2 – paragraph 7

7. ~~By [ OP please insert the date= one year after the date of entry into force of this Regulation], the EBA shall issue Guidelines in accordance with Article 16 of Regulation (EU) No 1093/2010, address~~The EBA shall develop draft Regulatory Technical Standards to specify the conditions of the exclusion for payment transactions from the payer to the payee through a commercial agent referred to in paragraph 2, point (b) of this Article. The EBA shall submit the Regulatory Technical Standards referred to in the ~~competent authorities designated und~~first subparagraph to the Commission by [ OP please insert th~~is Regulation, on the exclusion for payment transactions from the payer to the payee through a commercial agent referred to in paragraph 2, point (b) of this Article.~~ e date= one year after the date of entry into force of this Regulation]. Power is delegated on the Commission to adopt the Regulatory Technical Standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

Amendment 174 #

Proposal for a regulation
Article 2 – paragraph 7

7. By [ OP please insert the date= one year after the date of entry into force of this Regulation], the EBA shall issue Guidelines in accordance with Article 16 of Regulation (EU) No 1093/2010, addressed to the competent authorities designated under this Regulation, on the exclusion for payment transactions from the payer to the payee through a commercial agent referred to in paragraph 2, point (b) of this Articlesubmit draft Regulatory Technical Standards to specify the conditions for the exclusion for payment transactions from the payer to the payee through a commercial agent referred to in paragraph 2, point (b) of this Article. Power is delegated to the Commission to adopt the Regulatory Technical Standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

Amendment 175 #

Proposal for a regulation
Article 2 – paragraph 9 a (new)

9 a. The provisions of Article 59 shall also apply to electronic communication service providers, as defined in Article 3, point (55a).

Amendment 176 #

Proposal for a regulation
Article 3 – paragraph 1 – point 11

(11) ‘payer’ means a natural or legal person who holds a payment account and places a payment order from that payment account, or, where there is no payment account, a natural or legal person who places a payment order;

Amendment 177 #

Proposal for a regulation
Article 3 – paragraph 1 – point 28

(28) ‘credit transfer’ means a payment service, including instant credit transfers, for crediting a payee’s payment account with a payment transaction or a series of payment transactions from a payer’s payment account by the payment service provider which holds the payer’s payment account or by the payment service provider which holds the payee payment account, based on an instruction given by the payer;

Amendment 178 #

Proposal for a regulation
Article 3 – paragraph 1 – point 30

(30) ‘funds’ means central bank money issued for retail use, scriptural money and electronic money tokens;

Amendment 179 #

Proposal for a regulation
Article 3 – paragraph 1 – point 30

(30) ‘funds’ means ~~central bank money issued for retail use~~bank notes and coins, scriptural money and electronic money;

Amendment 180 #

Proposal for a regulation
Article 3 – paragraph 1 – point 32

(32) ‘reference exchange rate’ means the exchange rate which is used asby the ~~basis to calculate any currency conversion cost and which is disclosed by the payment service provider or comes from a publicly available source~~payment service provider for a currency conversion service and is compared against the mid-market exchange rate to calculate the currency conversion cost;

Amendment 181 #

Proposal for a regulation
Article 3 – paragraph 1 – point 32 a (new)

(32 a) ‘mid-market exchange rate’ means the exchange rate which is used as the basis for comparison against the reference exchange rate to calculate any currency conversion cost and which is aggregated by neutral and credible providers;

Amendment 182 #

Proposal for a regulation
Article 3 – paragraph 1 – point 35

(35) ‘strong customer authentication’ means an authentication which is based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) ~~and~~, inherence (something the user is) and behaviour (the way user behaves) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data;

Amendment 183 #

Proposal for a regulation
Article 3 – paragraph 1 – point 36 a (new)

(36 a) ‘e-wallet provider’ means a provider which offers consumers an application to manage one or several payment services within one application without entering at any time into the possession of the funds to be transferred;

Amendment 184 #

Proposal for a regulation
Article 3 – paragraph 1 – point 36 a (new)

Amendment 185 #

Proposal for a regulation
Article 3 – paragraph 1 – point 39

(39) ‘unique identifier’ means a combination of letters, numbers or symbols specified by the payment service provider, or an uniquely linked proxy thereof, to the payment service user and to be provided by the payment service user to identify unambiguously another payment service user or the payment account of that other payment service user for a payment transaction;

Amendment 186 #

Proposal for a regulation
Article 3 – paragraph 1 – point 39

(39) ‘unique identifier’ means a combination of letters, numbers or symbols specified by the payment service provider, or a uniquely linked proxy thereof, to the payment service user and to be provided by the payment service user to identify unambiguously another payment service user or the payment account of that other payment service user for a payment transaction;

Amendment 187 #

Proposal for a regulation
Article 3 – paragraph 1 – point 46

(46) ‘group’ means a group of undertakings that are linked to each other by a relationship as referred to in Article 22(1), ~~points~~ (2) or (7) of Directive 2013/34/EU of the European Parliament and of the Council63 or undertakings as referred to in Articles 4, 5, 6 and 7 of Commission Delegated Regulation (EU) No 241/201464 , which are linked to each other by a relationship as referred to in Article 10(1) or Article 113(6), first subparagraph, or 113(7), first subparagraph of Regulation (EU) No 575/2013; __________________ 63 Directive 2013/34/EU of the European Parliament and of the Council of 26 June 2013 on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC (OJ L 182, 29.6.2013, p. 19). 64 Commission Delegated Regulation (EU) No 241/2014 of 7 January 2014 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to regulatory technical standards for Own Funds requirements for institutions (OJ L 74, 14.3.2014, p. 8).

Amendment 188 #

Proposal for a regulation
Article 3 – paragraph 1 – point 51

(51) ‘distributor’ means a natural or legal person that distributes or redeems electronic money on behalf of and engaged by a payment institution;

Amendment 189 #

Proposal for a regulation
Article 3 – paragraph 1 – point 52

(52) ‘electronic money services’ means the issuance of electronic money~~, the maintenance of payment accounts storing electronic money units, and the transfer of electronic money units~~;

Amendment 190 #

Proposal for a regulation
Article 3 – paragraph 1 – point 52

(52) ‘electronic money services’ means the issuance of electronic money~~, the maintenance of payment accounts storing electronic money units, and the transfer of electronic money units~~;

Amendment 191 #

Proposal for a regulation
Article 3 – paragraph 1 – point 52

(52) ‘electronic money services’ means the issuance of electronic money tokens, the maintenance of payment accounts storing electronic money units, and the transfer of electronic money units;

Amendment 192 #

Proposal for a regulation
Article 3 – paragraph 1 – point 53

(53) ‘commercial trade name’ means the name which is commonly used by the payee in the course of their trade and marketing to identify itself to the payer;

Amendment 193 #

Proposal for a regulation
Article 3 – paragraph 1 – point 53

(53) ‘commercial trade name’ means the name which is commonly used by the payee in the course of their trade and marketing to identify itself to the payer;

Amendment 194 #

Proposal for a regulation
Article 3 – paragraph 1 – point 54

(54) ‘ATM deployer’ means operators of automated teller machines who do not ~~service~~hold payment accounts.

Amendment 195 #

Billy KELLEHER, Gilles BOYER

Proposal for a regulation
Article 3 – paragraph 1 – point 55

(55) ‘payment institution providing electronic money services’ means a payment institution which provides the services of issuance of electronic money tokens, maintenance of payment accounts storing electronic money units, and transfer of electronic money units, whether or not it also provides any of the services referred to in Annex I.

Amendment 196 #

Proposal for a regulation
Article 3 – paragraph 1 – point 55 a (new)

(55 a) 'electronic communications service provider' means any provider falling under the scope of: (a) Directive (EU) 2018/1972 (European electronic communications code); or (b) Regulation (EU) 2022/1925 (Digital Markets Act).

Amendment 197 #

Proposal for a regulation
Article 3 – paragraph 1 – point 55 a (new)

(55 a) ‘electronic communications service provider’ means any provider falling under the scope of: (a) Directive 2018/1972 (European electronic communications code), and (b) Regulation (EU) 2022/1925 (Digital Markets Act).

Amendment 198 #

Proposal for a regulation
Article 3 – paragraph 1 – point 55 a (new)

(55 a) 'authorisation' means the consent granted by a payer to their payment services provider for executing a payment transaction via the agreed process and form.

Amendment 199 #

Proposal for a regulation
Article 4 – paragraph 2

2. Member States may apply this Title to small, medium-sized and microenterprises in the same way as to consumers.

Amendment 200 #

Proposal for a regulation
Article 5 – paragraph 2

2. Where a currency conversion service is offered prior to the initiation of the payment transaction and where that currency conversion service is offered at an ATM, at the point of sale or by the payee, the party offering the currency conversion service to the payer shall disclose to the payer all charges and the exchange rate to be used for converting the payment transaction including prominent and transparent disclosure of any mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank.

Amendment 201 #

Proposal for a regulation
Article 5 – paragraph 2

2. Where a currency conversion service is offered prior to the initiation of the payment transaction and where that currency conversion service is offered at an ATM, at the point of sale or by the payee, the party offering the currency conversion service to the payer shall disclose to the payer all charges and the exchange rate to be used for converting the payment transaction, including prominent and transparent disclosure of any mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank.

Amendment 202 #

Proposal for a regulation
Article 5 – paragraph 2

2. Where a currency conversion service is offered prior to the initiation of the payment transaction and where that currency conversion service is offered at an ATM, at the point of sale or by the payee, the party offering the currency conversion service to the payer shall disclose to the payer all charges, including any mark-ups over the aggregated mid-market exchange rate offered by neutral and credible providers, and the exchange rate to be used for converting the payment transaction.

Amendment 203 #

Proposal for a regulation
Article 5 – paragraph 2

2. Where a currency conversion service is offered prior to the initiation of the payment transaction and where that currency conversion service is offered at an ATM, at the point of sale or by the payee, the party offering the currency conversion service to the payer shall disclose to the payer all charges and the exchange rate to be used for converting the payment transaction prior to the authorisation of the payment transaction by the payer.

Amendment 204 #

Proposal for a regulation
Article 6 – paragraph 1

1. Where, for the use of a given payment instrument, the payee requests a charge or offers a reduction, the payee shall inform the payer thereof prior to the initiation of the payment transaction, in a clear, transparent and accessible format.

Amendment 205 #

Proposal for a regulation
Article 6 – paragraph 2

2. Where, for the use of a given payment instrument, the payment service provider or another party involved in the transaction requests a charge, it shall inform the payment service user thereof in a clear, transparent and accessible format, prior to the initiation of the payment transaction.

Amendment 206 #

Proposal for a regulation
Article 7 – paragraph 1

Natural or legal persons providing cash withdrawal services as referred to in Article 38 of Directive (EU) [PSD3] shall provide ~~or make available~~in a prominent and easily understandable manner to their customers information on any charges directly before the customer carries out the withdrawal as well as upon receipt of the cash when the transaction is completed.

Amendment 207 #

Proposal for a regulation
Article 7 – paragraph 1

Amendment 208 #

Proposal for a regulation
Article 7 – paragraph 1

Natural or legal persons providing cash withdrawal services as referred to in Article 38 of Directive (EU) [PSD3] shall provide or make available to their customers clear, transparent and accessible information on any charges before the customer carries out the withdrawal as well as upon receipt of the cash when the transaction is completed.

Amendment 209 #

Proposal for a regulation
Article 7 – paragraph 1

Natural or legal persons providing cash withdrawal services as referred to in Article 38 of Directive (EU) [PSD3] shall provide or make available to their customers information on any charges ~~before the customer carries out the~~at the moment of initiatiation of the provision of withdrawal services as well as upon receipt of the cash when the transaction is completed.

Amendment 210 #

Proposal for a regulation
Article 8 – paragraph 3

3. Charges for information referred to in paragraph 2 shall be reasonable and ~~in line with the payment service provider’s~~proportionate in relation to the actual costs.

Amendment 211 #

Proposal for a regulation
Article 10 – paragraph 1 – introductory part

In cases of payment instruments which, according to the relevant framework contract, concern only individual payment transactions that do not exceed EUR 5100 or that either have a spending limit of EUR 20250 or store funds that do not exceed EUR 2050 at any time:

Amendment 212 #

Proposal for a regulation
Article 13 – paragraph 1 – introductory part

1. Payment service providers shall provide in an easily understandable way or make available to payment service users the following information and conditions:

Amendment 213 #

Proposal for a regulation
Article 13 – paragraph 1 – introductory part

1. Payment service providers shall provide ~~or make available~~in a prominent and easily understandable manner to payment service users the following information and conditions:

Amendment 214 #

Proposal for a regulation
Article 13 – paragraph 1 – introductory part

1. Payment service providers shall provide ~~or make available~~in a prominent and easily understandable way to payment service users the following information and conditions:

Amendment 215 #

Proposal for a regulation
Article 13 – paragraph 1 – introductory part

1. Payment service providers shall provide or make available to payment service users at least the following information and conditions:

Amendment 216 #

Proposal for a regulation
Article 13 – paragraph 1 – point f

(f) where applicable, the estimated charges for currency conversion in relation to credit transfers and money remittance transactions, expressed as a percentage mark-up ~~over the latest available applicable foreign exchange reference rate issued by the relev~~in a monetary value in the payer's currency over the mid-market exchange rate offered by neutral antd c~~entral bank~~redible providers;

Amendment 217 #

Proposal for a regulation
Article 13 – paragraph 1 – point f

(f) where applicable, the estimated charges for currency conversion in relation to credit transfers and money remittance transactions, expressed as a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank. These charges shall be displayed no later than the moment the payer authorises the payment transaction;

Amendment 218 #

Proposal for a regulation
Article 13 – paragraph 1 – point f

(f) where applicable, the estimated charges for currency conversion in relation to credit transfers and money remittance transactions, expressed as a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank as well as in real monetary value in the payer’s currency;

Amendment 219 #

Proposal for a regulation
Article 13 – paragraph 1 – point f

(f) where applicable, the estimated charges for currency conversion in relation to credit transfers and money remittance transactions, expressed ~~as a percentage mark-up~~in monetary value in the payer's currency over the latest available applicable foreign exchange reference rate issued by the relevant central bank;

Amendment 220 #

Proposal for a regulation
Article 20 – paragraph 1 – introductory part

The payment service provider shall provide in a prominent and easily understandable way the following information and conditions to the payment service user:

Amendment 221 #

Proposal for a regulation
Article 20 – paragraph 1 – introductory part

The payment service provider shall provide in a prominent and easily understandable way the following information and conditions to the payment service user:

Amendment 222 #

Proposal for a regulation
Article 20 – paragraph 1 – introductory part

The payment service provider shall provide in an easily understandable way the following information and conditions to the payment service user:

Amendment 223 #

Proposal for a regulation
Article 20 – paragraph 1 – point c – point ii – introductory part

(ii) all charges, if any, for ~~domestic,~~Union automated teller machines (ATMs) withdrawals payable by payment service users to their payment service provider at an ATM of:

Amendment 224 #

Proposal for a regulation
Article 20 – paragraph 1 – point c – point ii – point 2

~~(2) a payment service provider belonging to the same network of ATMs as the user’s payment service provider;~~deleted

Amendment 225 #

Proposal for a regulation
Article 20 – paragraph 1 – point c – point v

(v) where applicable, the estimated charges for currency conversion services in relation to a credit transfer expressed as a total amount and a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank. These charges shall be clearly displayed before the final execution of the transaction by the payer and shall be displayed in the home currency of the payer in addition to the percentage mark-up;

Amendment 226 #

Proposal for a regulation
Article 20 – paragraph 1 – point c – point v

(v) where applicable, the estimated charges for currency conversion services in relation to a credit transfer expressed as a percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relevant central bank, as well as in real monetary value in the payer’s currency;

Amendment 227 #

Proposal for a regulation
Article 20 – paragraph 1 – point c – point v

(v) where applicable, the estimated charges for currency conversion ~~services~~ in relation to a credit transfers, expressed ~~as a percentage mark-up~~in monetary value in the payer's currency over the latest available applicable foreign exchange reference rate issued by the relevant central bank;.

Amendment 228 #

Proposal for a regulation
Article 20 – paragraph 1 – point c – point v

(v) where applicable, the estimated charges for currency conversion services in relation to a credit transfer expressed as a ~~percentage mark-up over the latest available applicable foreign exchange reference rate issued by the relev~~mark-up in a monetary value in the payer's currency over the mid-market exchange rate offered by neutral antd c~~entral bank~~redible providers;

Amendment 229 #

Proposal for a regulation
Article 22 – paragraph 1

1. The payment service provider shall propose any changes in the framework contract or in the information and conditions set out in Article 20 in the same way as provided for in Article 19(1) and no later than 23 months before their proposed date of application. The payment service user can either accept or reject the changes before the date of their proposed date of entry into force.

Amendment 230 #

Proposal for a regulation
Article 23 – paragraph 1

1. The payment service user may terminate the framework contract at any time, unless the parties have agreed on a ~~period of notice~~contract term. Such a pter~~iod~~m shall not exceed 1 month.

Amendment 231 #

Proposal for a regulation
Article 23 – paragraph 2

2. Termination of the framework contract shall be free of charge for the payment service user except where the contract has been in force for less than 6 months. Charges, if any, for termination of the framework contract shall be appropriate and in line with costs. Where, under the framework contract, payment services are offered jointly with technical services aimed at supporting the provision of payment services and provided by the payment service provider or by a third party the payment service provider has partnered with, such technical services shall be subject to the same framework contract requirements on termination feesthe contract term or 18 months, whichever is the lesser.

Amendment 232 #

Proposal for a regulation
Article 23 – paragraph 2

2. Termination of the framework contract shall be free of charge for the payment service user except where the contract has been in force for less than 63 months. Charges, if any, for termination of the framework contract shall be appropriate and in line with costs. Where, under the framework contract, payment services are offered jointly with technical services aimed at supporting the provision of payment services and provided by the payment service provider or by a third party the payment service provider has partnered with, such technical services shall be subject to the same framework contract requirements on termination fees.

Amendment 233 #

Proposal for a regulation
Article 23 – paragraph 3

3. If agreed in the framework contract, the payment service provider may terminate a framework contract concluded for an indefinite period by giving at least 23 months’ notice in the same way as provided for in Article 19(1).

Amendment 234 #

Proposal for a regulation
Article 23 – paragraph 6

6. Member States may provide for more favourable provisions on termination for payment service users. Those provisions must be fully aligned with this Regulation and its objectives and must be communicated to the Commission.

Amendment 235 #

Proposal for a regulation
Article 24 – paragraph 1 – point b

(b) the charges payable by the payer expressed in the currency of the payment and if applicable the percentage mark up on any applicable exchange rates as compared to the mid-market rate of the central bank of issue;

Amendment 236 #

Proposal for a regulation
Article 24 – paragraph 1 – point c

Amendment 237 #

Proposal for a regulation
Article 25 – paragraph 2

2. A framework contract shall include a condition that the payer may require the information referred to in paragraph 1 to be provided or made available periodically, at least once a month, free of charge and in an agreed manner which allows the payer to store and reproduce information unchanged.deleted

Amendment 238 #

Proposal for a regulation
Article 27 – paragraph 1

1. Where the payment service user is not a consumer, the payment service user and the payment service provider may agree that Article 28(1), Article 49(7), and Articles 55, 60, 62, 63, 66, 75, 76, and 7688 do not apply in whole or in part. The payment service user and the payment service provider may also agree on time limits that are different from those laid down in Article 54.

Amendment 239 #

Proposal for a regulation
Article 27 – paragraph 3

3. Member States may provide that provisions in this Title are applied to small, medium-sized and microenterprises in the same way as to consumers. Those provisions shall be fully aligned with this Regulation and its objectives and must be communicated to the Commission.

Amendment 240 #

Proposal for a regulation
Article 28 – paragraph 1

1. The payment service provider shall not charge the payment service user for fulfilment of its information obligations or corrective and preventive measures under this Title, unless otherwise specified in Article 65(1), Article 66(5) and Article 74(4). Those charges shall be agreed between the payment service user and the payment service provider and shall be reasonable and ~~in line with the payment service provider’s~~proportionate to actual costs.

Amendment 241 #

Proposal for a regulation
Article 28 – paragraph 3

3. The payee shall not request charges for the use of payment instruments ~~for which interchange fees are regulated under Chapter II of Regulation (EU) 2015/751 and for credit transfers, including instant credit transfers, and direct debit transactions within the Union~~.

Amendment 242 #

Proposal for a regulation
Article 28 – paragraph 3

Amendment 243 #

Proposal for a regulation
Article 28 – paragraph 3

3. The payee shall not request charges for the use of any payment instruments, including those for which interchange fees are regulated under Chapter II of Regulation (EU) 2015/751 ~~and for credit transfers, including instant credit transfers, and direct debit transactions within the Union~~.

Amendment 244 #

Proposal for a regulation
Article 28 – paragraph 4

4. Member States may extend the prohibition or limit the right of the payee to request charges for the use of payment instruments other than the ones referred to in paragraph 3, taking into account the need to encourage competition and promote the use of efficient payment instruments.deleted

Amendment 245 #

Proposal for a regulation
Article 28 – paragraph 4

Amendment 246 #

Proposal for a regulation
Article 28 – paragraph 4

Amendment 247 #

Proposal for a regulation
Article 28 – paragraph 4

4. Member States ~~may~~shall extend the prohibition or limit the right of the payee to request charges for the use of all payment instruments ~~other than the ones referred to in paragraph 3~~, taking into account the need to encourage competition and promote the use of efficient payment instruments.

Amendment 248 #

Proposal for a regulation
Article 28 – paragraph 5

5. Without prejudice to paragraphs 3 ~~and 4 and for instruments not covered in those paragraphs~~, the payment service provider shall not prevent the payee from ~~requesting from the payer a charge, offering him~~offering the payer a reduction or otherwise steering the payer towards the use of a given payment instrument. ~~Any charges applied shall not exceed the direct costs borne by the payee for the use of the specific payment instrument.~~

Amendment 249 #

Proposal for a regulation
Article 28 – paragraph 5

5. Without prejudice to paragraphs 3 and 4 ~~and for instruments not covered in those paragraphs~~, the payment service provider shall not prevent the payee from ~~requesting from the payer a charge, offering him~~offering the payer a reduction or otherwise steering the payer towards the use of a given payment instrument. ~~Any charges applied shall not exceed the direct costs borne by the payee for the use of the specific payment instrument.~~

Amendment 250 #

Proposal for a regulation
Article 28 – paragraph 5

5. Without prejudice to paragraphs 3 ~~and 4 and for instruments not covered in those paragraphs~~, the payment service provider shall not prevent the payee from requesting from the payer a charge, offering him a reduction or otherwise steering the payer towards the use of a given payment instrument. Any charges applied shall not exceed the direct costs borne by the payee for the use of the specific payment instrument.

Amendment 251 #

Proposal for a regulation
Article 28 – paragraph 6

6. Member States shall [ OP please insert the date = data of application of this Regulation] notify to the Commission the provisions of their law adopted pursuant to paragraph 4. They shall, without delay, notify any subsequent amendment to such provisions.deleted

Amendment 252 #

Proposal for a regulation
Article 29 – paragraph 1 – introductory part

1. In the case of payment instruments which, according to the framework contract, solely concern individual payment transactions not exceeding EUR 5100 or which either have a spending limit of EUR 2050, or store funds which do not exceed EUR 2050 at any time, payment service providers may agree with their payment service users that:

Amendment 253 #

Proposal for a regulation
Article 31 a (new)

Article 31a Without prejudice to Article 6(7) of Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828, original equipment manufacturers of mobile devices and providers of electronic communication services within the meaning of Article 2 (1) Directive (EU) 2018/1972 shall allow providers of front end payment services effective interoperability with, and access for the purposes of interoperability to, the hardware features and software features necessary for storing and transferring data to process online or offline transactions, on fair, reasonable and non- discriminatory terms.

Amendment 254 #

Proposal for a regulation
Article 32 – paragraph 1 – introductory part

1. A credit institution shall only refuse to open or shall only close a payment account for a payment institution for its agents or distributors or for an applicant for a license as a payment institution in cases where it is justified on objective, non- discriminatory and proportionate grounds, in particular in the following cases:

Amendment 255 #

Proposal for a regulation
Article 32 – paragraph 1 – point b

(b) there is or has been a material breach of contract committed by the applicant for an account;

Amendment 256 #

Proposal for a regulation
Article 32 – paragraph 1 – point b

(b) there is or has been a material breach of contract committed by the applicant for an account;

Amendment 257 #

Proposal for a regulation
Article 32 – paragraph 1 – point c

(c) insufficient information and documents pertaining to matters set out in this paragraph have been received from the applicant for an account;

Amendment 258 #

Proposal for a regulation
Article 32 – paragraph 1 – point d

~~(d) the applicant for an account or its business model presents an excessive risk profile;~~deleted

Amendment 259 #

Proposal for a regulation
Article 32 – paragraph 1 – point d

~~(d) the applicant for an account or its business model presents an excessive risk profile;~~deleted

Amendment 260 #

Proposal for a regulation
Article 32 – paragraph 1 – point e

~~(e) the applicant for an account would present a disproportionately high compliance cost for the credit institution.~~deleted

Amendment 261 #

Proposal for a regulation
Article 32 – paragraph 1 – point e

~~(e) the applicant for an account would present a disproportionately high compliance cost for the credit institution.~~deleted

Amendment 262 #

Proposal for a regulation
Article 32 – paragraph 1 – subparagraph 1 (new)

Where a credit institution makes a decision to close a payment account in accordance with this paragraph, the account closure shall take effect on expiry of a notice period which shall not be less than 6 months.

Amendment 263 #

Proposal for a regulation
Article 32 – paragraph 1 a (new)

1 a. Member States shall ensure that payment institutions have a right of access to payment accounts with one or more credit institutions. Such access shall be sufficiently extensive as to allow payment institutions to provide their payment services in an unhindered, efficient and uninterrupted manner, throughout the period of their authorisation. In the event that a payment institution is not able to open a payment account with a credit institution, or if such payment account is closed, the competent authority shall nominate one or more credit institutions to provide a payment account to that payment institution.

Amendment 264 #

Proposal for a regulation
Article 32 – paragraph 1 a (new)

Amendment 265 #

Proposal for a regulation
Article 32 – paragraph 1 b (new)

1 b. Where a credit institution makes a decision to close a payment account in accordance with this paragraph, the account closure shall take effect on expiry of a notice period which shall not be less than 6 months.

Amendment 266 #

Proposal for a regulation
Article 32 – paragraph 3

3. A credit institution shall notify to the payment institution or to its agents or distributors, or to the applicant for a license as a payment institution, any decision to refuse to open or to close a payment account to a payment institution or to its agents or distributors, or to an applicant for a license as a payment institution; it shall duly motivate any such decision. Such motivation must be specific to the risks posed by the activity or planned activity of that payment institution or of its agents or distributors, as assessed by the credit institution, and not be generic in nature. A credit institution shall also notify the competent authority of its decision to refuse to open or to close a payment account. The competent authorities shall publish aggregate data on payment account refusals and closures.

Amendment 267 #

Proposal for a regulation
Article 32 – paragraph 3 a (new)

3 a. A credit institution shall also notify the competent authority of its decision to close or to refuse to open a payment account. The competent authorities shall publish aggregate data on payment account refusals and closures.

Amendment 268 #

Proposal for a regulation
Article 32 – paragraph 3 a (new)

3 a. A credit institution shall also notify the national competent authority of its decision to refuse to open or to close a specific payment account.

Amendment 269 #

Proposal for a regulation
Article 32 – paragraph 5 – subparagraph 1

The EBA shall develop draft regulatory technical standards specifying the harmonised format and information to be contained in the notification and motivation referred to in paragraph 3 of this Article. These draft regulatory technical standards shall also develop the harmonised objectives, powers and procedure to be followed by the competent authorities in respect of appeals referred to them under paragraph 4 of this Article.

Amendment 270 #

Proposal for a regulation
Article 32 – paragraph 5 – subparagraph 1

Amendment 271 #

Proposal for a regulation
Article 33 – paragraph 1 a (new)

1 a. Payees must offer to payment service users at least one payment method without surcharges which does not rely on the use of a payment initiation service provider.

Amendment 272 #

Proposal for a regulation
Article 33 – paragraph 1 a (new)

1 a. Payees must offer to payment service users at least one payment method without surcharges which does not rely on the use of a payment initiation service provider.

Amendment 273 #

Proposal for a regulation
Article 33 – paragraph 2 a (new)

2 a. Traders such as creditors and insurance operators must offer to payment service users a way to share their data which does not rely on the use of account information service providers. Without prejudice to Regulation (EU) 2016/679, payment service providers shall inform consumers in a clear and comprehensible manner when they are presented with a personalised offer that is based on automated processing of personal data. Traders such as creditors and insurance operators shall ensure that the conditions to access their services do not discriminate against consumers legally resident in the Union on ground of their nationality or place of residence, the location of the payment account, the place of establishment of the payment service provider or the place of issue of the payment instrument within the Union or on any ground as referred to in Article 21 of the Charter of Fundamental Rights of the European Union. Any undertaking designated as a gatekeeper, pursuant to Article 3 of Regulation (EU) 2022/1925 on contestable and fair markets in the digital sector (Digital Markets Act), shall not receive access to payment systems as account information service provider. Account information service providers shall not be allowed to combine account information data obtained pursuant to this Regulation with other types of personal data where such combination of data may result in harmful practices such as social scoring. The European Banking Authority shall develop draft Regulatory Technical Standards limiting the combination of data obtained by account information service providers with other types of personal data. The EBA shall submit the Regulatory Technical Standards referred to in the first subparagraph to the Commission by [ OP please insert the date= one year after the date of entry into force of this Regulation]. When preparing the draft Regulatory Technical Standards referred to in subparagraph 6, the European Banking Authority shall closely cooperate with the European Data Protection Board established by Regulation (EU) 2016/679. Power is delegated on the Commission to adopt the Regulatory Technical Standards referred to in subparagraph 6 in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

Amendment 274 #

Proposal for a regulation
Article 33 – paragraph 2 a (new)

2 a. Traders such as creditors and insurance operators shall offer to payment service users a way to share their data which does not rely on the use of account information service providers.

Amendment 275 #

Proposal for a regulation
Article 33 – paragraph 2 b (new)

2 b. Without prejudice to Regulation (EU) 2016/679, payment service providers shall inform consumers in a clear and comprehensible manner when they are presented with a personalised offer that is based on automated processing of personal data.

Amendment 276 #

Proposal for a regulation
Article 33 – paragraph 2 c (new)

2 c. Traders such as creditors and insurance operators shall ensure that the conditions to access their services do not discriminate against consumers legally resident in the Union on grounds of their nationality or place of residence, the location of the payment account, the place of establishment of the payment service provider or the place of issue of the payment instrument within the Union or on any ground referred to in Article 21 of the Charter of Fundamental Rights of the European Union.

Amendment 277 #

Proposal for a regulation
Article 33 – paragraph 2 d (new)

2 d. Any undertaking designated as a gatekeeper, pursuant to Article 3 of Regulation (EU) 2022/1925 on contestable and fair markets in the digital sector, shall not receive access to payment systems as account information service provider.

Amendment 278 #

Proposal for a regulation
Article 33 – paragraph 2 e (new)

2 e. Account information service providers shall not be allowed to combine account information data obtained pursuant to this Regulation with other types of personal data where such combination of data may result in harmful practices such as social scoring. The European Banking Authority shall develop draft Regulatory Technical Standards limiting the combination of data obtained by account information service providers with other types of personal data. The EBA shall submit the Regulatory Technical Standards referred to in this first subparagraph to the Commission by [OP please insert the date= one year after the date of entry into force of this Regulation]. When preparing the draft Regulatory Technical Standards referred to in subparagraph 2, the European Banking Authority shall closely cooperate with the European Data Protection Board established by Regulation (EU) 2016/679. Power is delegated on the Commission to adopt the Regulatory Technical Standards referred to in subparagraph 2 in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

Amendment 279 #

Sirpa PIETIKÄINEN

Proposal for a regulation
Article 34 – paragraph 2 a (new)

2 a. Account servicing payment service providers are entitled to compensation, in line with Article 9(1) of Regulation XXX on harmonised rules on fair access to and use of data (Data Act, COM(2022) 68 final).

Amendment 280 #

Proposal for a regulation
Article 35 – title

Provision of ~~dedicated~~ access interfaces

Amendment 281 #

Proposal for a regulation
Article 35 – paragraph 1

1. Account servicing payment service providers that offer to a payer a payment account that is accessible online shall have in place at least one ~~dedicated~~machine to machine interface for the purpose of data exchange with account information and payment initiation service providers.

Amendment 282 #

Proposal for a regulation
Article 35 – paragraph 2

2. Without prejudice to Article~~s 38 and~~ 39, account servicing payment service providers that offer to a payer a payment account that is accessible online and have put in place a ~~dedicated~~n interface as referred to in paragraph 1 of this Article, shall not be obliged to also maintain permanently another interface as fall-back for the purpose of data exchange with account information and payment initiation service providers, but shall always permit access to interfaces which allow business continuity for those providers.

Amendment 283 #

Proposal for a regulation
Article 35 – paragraph 3

3. Account servicing payment service providers shall ensure that their ~~dedicated~~ interfaces referred to in paragraph 1 use standards of communication which are issued by European or international standardisation organisations including the European Committee for Standardization (CEN) or the International Organization for Standardization (ISO). Account servicing payment service providers shall also ensure that the technical specifications of any of the dedicated interfaces referred to in paragraph 1 are documented specifying a set of routines, protocols and tools needed by payment initiation service providers and account information service providers for allowing their software and applications to interoperate with the systems of the account servicing payment service provider. Account servicing payment service providers shall make the documentation on technical specifications of their dedicated interfaces referred to in paragraph 1 available, at no charge and without delay, upon request by authorised payment initiation service providers, account information service providers or by payment service providers that have applied to their competent authorities for the relevant authorisation and shall make a summary of that documentation publicly available on their website.

Amendment 284 #

Proposal for a regulation
Article 35 – paragraph 4

4. Account servicing payment service providers shall ensure that, except for emergency situations which prevent them from doing so, any change to the technical specifications of their dedicated interface referred to in paragraph 1 is made available to authorised payment initiation service providers, account information service providers, or payment service providers that have applied to their competent authorities for the relevant authorisation, in advance, as soon as possible and not less than ~~3 month~~six weeks before the change is implemented. Account servicing payment service providers shall document emergency situations where changes were implemented without such advance information and make the documentation available to competent authorities on request.

Amendment 285 #

Proposal for a regulation
Article 36 – title

Requirements regarding ~~dedicated~~ data access interfaces

Amendment 286 #

Proposal for a regulation
Article 36 – paragraph 1 – point b

(b) the dedicated interface shall apply a re-direction approach to ensure the integrity and confidentiality of the personalised security credentials and of authentication codes transmitted by or through the payment initiation service provider or the account information service provider;

Amendment 287 #

Proposal for a regulation
Article 36 – paragraph 1 – point b

Amendment 288 #

Proposal for a regulation
Article 36 – paragraph 1 – point c

(c) the response time of the ~~dedicated~~ interface to account information service providers’ and payment initiation service providers’ access requests shall not be longer than the response time of all of the interfaces that the account servicing payment service provider makes available to its payment service users for directly accessing their payment account online.

Amendment 289 #

Proposal for a regulation
Article 36 – paragraph 2 – introductory part

2. Account servicing payment service providers shall ensure that the ~~dedicated~~ interface referred to in Article 35(1) allows both account information service providers and payment initiation service providers to:

Amendment 290 #

Proposal for a regulation
Article 36 – paragraph 2 – point d

(d) see, prior to initiation of the payment ~~in the case of payment initiation service providers~~, at least, the unique identifier of the account, the associated names or other identifiers of the account holder and the currencies and the account balance as available to the payment service user.

Amendment 291 #

Proposal for a regulation
Article 36 – paragraph 3

3. Account servicing payment service providers shall allow account information service providers to communicate securely, via the ~~dedicated~~ interface, to request and receive information on one or more designated payment accounts and associated payment transactions.

Amendment 292 #

Proposal for a regulation
Article 36 – paragraph 4 – point h a (new)

(h a) in the case where the account servicing payment service provider offers multiple authentication options, have the choice to decide which authentication method should be presented to the payer, taking into account the least cumbersome choice for the payer.

Amendment 293 #

Proposal for a regulation
Article 36 – paragraph 4 – point h a (new)

(h a) refuse to initiate a payment transaction on justified grounds.

Amendment 294 #

Proposal for a regulation
Article 36 – paragraph 5 – subparagraph 1 – point b

(b) the confirmation from the account servicing payment service provider as soon as possible, and not longer than 20 seconds after the authorisation by the payer, that the payment has been or will be executed on the basis of the information available to the account servicing payment service provider, taking into account any pre-existing payment orders that might affect the full execution of the payment order being placed.

Amendment 295 #

Proposal for a regulation
Article 36 – paragraph 5 – subparagraph 2 a (new)

Where the account servicing payment service provider carries out any controls which may impact the execution of the payment, these controls shall take place prior to the confirmation of payment.

Amendment 296 #

Proposal for a regulation
Article 37 – title

Data access ~~parity between dedicated access interface and customer interface~~for third parties

Amendment 297 #

Proposal for a regulation
Article 37 – paragraph 2

2. AIn line with Regulation 2016/679/EU [GDPR], account servicing payment service providers shall provide account information services providers with ~~at least the sam~~the information from designated payment accounts and associated payment transactions ~~made available to the payment service user when directly requesting access to the account information~~necessary for the performance of a contract to which the data subject is party, provided that this information does not include sensitive payment data.

Amendment 298 #

Proposal for a regulation
Article 37 – paragraph 2

2. AIn line with Regulation 2016/679/EU [GDPR], account servicing payment service providers shall provide account information services providers with ~~at least the sam~~the information from designated payment accounts and associated payment transactions ~~made available to the payment service user when directly requesting access to the account information,~~necessary for the performance of a contract to which the data subject is party provided that this information does not include sensitive payment data.

Amendment 299 #

Proposal for a regulation
Article 37 – paragraph 3

3. AIn line with Regulation 2016/679/EU [GDPR], account servicing payment service providers shall provide payment initiation service providers with ~~at least the sam~~the information onecessary for the initiation and execution of the payment transaction provided or made available to the payment service user when the transaction is initiated directly by the payment service user. That information shall be provided immediately after receipt of the payment order and any update to the information, including but not limited to the payment status, shall be pushed to the payment initiation service provider via the dedicated interface in real-time on an ongoing basis until the payment is ~~final~~executed or rejected.

Amendment 300 #

Proposal for a regulation
Article 37 – paragraph 3

Amendment 301 #

Proposal for a regulation
Article 37 – paragraph 3

3. Account servicing payment service providers shall provide payment initiation service providers with at least the same information on the initiation and execution of the payment transaction provided or made available to the payment service user when the transaction is initiated directly by the payment service user. That information shall be provided immediately after receipt of the payment order and on an ongoing basis until the payment is ~~final~~executed or rejected.

Amendment 302 #

Proposal for a regulation
Article 37 – paragraph 3 a (new)

3 a. The processing of customer data shall be limited to what is necessary in relation to the purpose for which it was processed. In accordance with Article 16 of Regulation (EU) No 1093/2010, the European Banking Authority shall develop guidelines on the implementation of this paragraph for payment initiation services and account information services.

Amendment 303 #

Proposal for a regulation
Article 37 – paragraph 3 a (new)

3 a. The processing of customer data shall be limited to what is necessary in relation to the purpose for which it was processed. In accordance with Article 16 of Regulation (EU) No 1093/2010, the EBA shall develop guidelines on the implementation of this paragraph for payment initiation services and account information services.

Amendment 304 #

Proposal for a regulation
Article 37 – paragraph 3 b (new)

3 b. When preparing the guidelines referred to in paragraph 3a of this Article, the European Banking Authority shall closely cooperate with the European Data Protection Board established by Regulation (EU) 2016/679.

Amendment 305 #

Proposal for a regulation
Article 37 – paragraph 3 b (new)

3 b. When preparing the guidelines referred to in paragraph 3a of this Article, the EBA shall closely cooperate with the European Data Protection Board established by Regulation (EU) 2016/679.

Amendment 306 #

Proposal for a regulation
Article 38

~~[...]~~deleted

Amendment 307 #

Proposal for a regulation
Article 38 – paragraph 1

1. Account servicing payment service providers shall take all measures in their power to prevent unavailability and underperformance of the dedicated interface. Unavailability shall be presumed to have arisen when five consecutive requests for access to information for the provision of payment initiation services or account information services receive no response from the account servicing payment service provider’s dedicated interface within 30 seconds.

Amendment 308 #

Proposal for a regulation
Article 38 – paragraph 2

2. In case of unavailability of the dedicated interface, account servicing payment service providers shall inform payment service providers making use of the dedicated interface of measures taken to restore the interface and of the time estimated necessary for the problem to be resolved. During the period of unavailability, account servicing payment service providers shall offer to account information and payment initiation service providers without undue delay an effective alternative solution, such as the use of the interface that the account servicing payment service provider uses for authentication and communication with its users, to access payment account data.

Amendment 309 #

Proposal for a regulation
Article 39 – title

Derogation from having a ~~dedicated~~n interface for data access

Amendment 310 #

Proposal for a regulation
Article 39 – paragraph 2 – subparagraph 1

The EBA shall develop draft regulatory technical standards which shall specify the criteria on the basis of which, in accordance with paragraph 1, an account servicing payment service provider may be exempted from the obligation to have in place a dedicated interface and be allowed either to provide, as interface for secure data exchange with account information service providers and payment initiation service providers, the interface that it makes available to its payment user for accessing its payment accounts online or, where appropriate, not to have any interface at all for secure data exchange. The criteria shall be based on limited use or value of payment account products, which would automatically exempt account servicing payment service provider under this Article without having to seek exemptions individually from competent authorities.

Amendment 311 #

Proposal for a regulation
Article 39 – paragraph 2 – subparagraph 1

The EBA shall develop draft regulatory technical standards which shall specify the criteria on the basis of which, in accordance with paragraph 1, an account servicing payment service provider may be exempted from the obligation to have in place a ~~dedicated~~n interface and be allowed either to provide, as interface for secure data exchange with account information service providers and payment initiation service providers, the interface that it makes available to its payment user for accessing its payment accounts online or, where appropriate, not to have any interface at all for secure data exchange.

Amendment 312 #

Proposal for a regulation
Article 40 – paragraph 2

For the purposes of point (b), where some or all of the information referred to in that point is unavailable immediately after receipt of the payment order, the account servicing payment service provider shall ensure that any information, including but not limited to any payment status update, about the execution of the payment order is made available to the payment initiation service provider immediately after that information becomes available to the account servicing payment service provider.

Amendment 313 #

Proposal for a regulation
Article 40 – paragraph 2

For the purposes of point (b), where some or all of the information referred to in that point is unavailable immediately after receipt of the payment order, the account servicing payment service provider shall ensure that any information, including any payment status update, about the execution of the payment order is made available to the payment initiation service provider immediately after that information becomes available to the account servicing payment service provider.

Amendment 314 #

Proposal for a regulation
Article 43 – paragraph 2 – point a – point v a (new)

(v a) the dates on which data has been accessed and which categories of data have been retrieved when doing so.

Amendment 315 #

Proposal for a regulation
Article 43 – paragraph 2 – point c

~~(c) allow the payment service user to re-establish any data access withdrawn;~~deleted

Amendment 316 #

Proposal for a regulation
Article 43 – paragraph 2 – point c

~~(c) allow the payment service user to re-establish any data access withdrawn;~~deleted

Amendment 317 #

Proposal for a regulation
Article 43 – paragraph 2 – point c a (new)

(c a) allow payment services users to opt-out from data sharing with third parties in a general way for all present and future data access permission requests;

Amendment 318 #

Proposal for a regulation
Article 43 – paragraph 2 – point d a (new)

(d a) be consistent with the Financial Data Access Regulation’s dashboards and allow data holders to manage data permissions stemming from both FIDA and this Regulation through a single dashboard.

Amendment 319 #

Proposal for a regulation
Article 43 – paragraph 2 a (new)

2 a. The EBA shall develop draft Regulatory Technical Standards to develop a standardised list of data categories referred to in paragraph 2, point (a), so that the data is easily understandable for consumers. The EBA shall submit the Regulatory Technical Standards referred to in the first subparagraph to the Commission by [ OP please insert the date= one year after the date of entry into force of this Regulation]. Power is delegated on the Commission to adopt the Regulatory Technical Standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

Amendment 320 #

Proposal for a regulation
Article 43 – paragraph 2 b (new)

2 b. Where a payment services user, pursuant to paragraph 2, point b, decides to withdraw data access, the given account information service provider or payment initiation service provider shall no longer withdraw data and shall erase all data received based on the data access permission granted by the payment services user.

Amendment 321 #

Proposal for a regulation
Article 43 – paragraph 4 – introductory part

4. The account servicing payment service provider and the account information service or payment initiation service provider to which permission has been granted shall cooperate to make information available to the payment service user via the dashboard in real-time. For the purposes of paragraph 2 ~~points (a), (b), (c) and (e)~~:

Amendment 322 #

Proposal for a regulation
Article 43 – paragraph 4 – point b – point i

(i) the purpose of the permission granted by the payment service user, in a clear and comprehensible manner for the user;

Amendment 323 #

Proposal for a regulation
Article 44 – paragraph 1 – subparagraph 1

Account servicing payment service providers shall ensure that their dedicated interface does not create obstacles to the provision of payment initiation and account information services and enables a straightforward and seamless consumer experience.

Amendment 324 #

Proposal for a regulation
Article 44 – paragraph 1 – subparagraph 2 – introductory part

Prohibited obstacles shall include, but are not limited to, the following:

Amendment 325 #

Proposal for a regulation
Article 44 – paragraph 1 – subparagraph 2 – introductory part

Prohibited obstacles ~~shall~~ include, among others, the following:

Amendment 326 #

Proposal for a regulation
Article 44 – paragraph 1 – subparagraph 2 – point a

(a) preventing the use by payment initiation services providers or account information services providers of the personalised security credentials issued by account servicing payment service providers to their payment services users;

Amendment 327 #

Proposal for a regulation
Article 44 – paragraph 1 – subparagraph 2 – point j

(j) imposing an account information or payment initiation journey, in a ‘redirection’ or ‘decoupled’ approach, where the authentication of the payment service user with the account servicing payment service provider adds additional steps or required actions in the user journey compared to the equivalent authentication procedure offered to payment service users when directly accessing their payment accounts or initiating a payment with the account servicing payment service provider;deleted

Amendment 328 #

Proposal for a regulation
Article 44 – paragraph 1 – subparagraph 2 – point j

(j) imposing an account information or payment initiation journey, in a ‘redirection’ or ‘decoupled’ approach~~, where~~ for the authentication of the payment service user ~~with the account servicing payment service provider adds~~as well as imposing additional steps or required actions in the user journey compared to the equivalent authentication procedure offered to payment service users when directly accessing their payment accounts or initiating a payment with the account servicing payment service provider;

Amendment 329 #

Proposal for a regulation
Article 44 – paragraph 1 – subparagraph 2 – point k

(k) imposing that the user be automatically redirected, at the stage of authentication, to the account servicing payment service provider’s web page address when this is the sole method of carrying out the authentication of the payment services user that is supported by an account servicing payment service provider;deleted

Amendment 330 #

Proposal for a regulation
Article 44 – paragraph 1 – subparagraph 2 – point k

(k) imposing that the user be automatically redirected~~, at the stage of authentication,~~ to the account servicing payment service provider’s ~~web page address when this i~~authentication as the sole method of carrying out the authentication of the payment services user that is supported by an account servicing payment service provider;

Amendment 331 #

Proposal for a regulation
Article 44 – paragraph 1 – subparagraph 2 – point l a (new)

(l a) restricting a payment initiation service provider from initiating payments from unique identifiers that are proxies for payment accounts, such as mobile phone numbers, including when such identifiers are otherwise solely made available by account servicing payment service providers to payers in a dedicated channel or system such as a mobile phone application.

Amendment 332 #

Proposal for a regulation
Article 44 – paragraph 1 a (new)

1 a. Measures and instruments used by account servicing payment service providers in response to suspected fraud or to comply with Regulation (EU) 2016/679 [General Data Protection Regulation] do not constitute prohibited obstacles.

Amendment 333 #

Proposal for a regulation
Article 44 – paragraph 2

2. For the activities of payment initiation services and account information services the name and the account number or other identifier of the account owner shall not constitute sensitive payment data.

Amendment 334 #

Proposal for a regulation
Article 45 – paragraph 2 – subparagraph 1 – point d

(d) log the data that are accessed through the interface operated by the account servicing payment service provider for its payment service users, and provide, upon request and without undue delay, the log files to the competent authority. ~~Logs shall be deleted 3 years after their creation. Logs may be kept for longer than this retention period if they are required for monitoring procedures that are already underway.~~

Amendment 335 #

Proposal for a regulation
Article 45 – paragraph 2 – subparagraph 2

For the purpose of point (d) logs shall be deleted 3 years after their creation. Logs may be kept for longer than this retention period if they are required for monitoring procedures that are already underway.deleted

Amendment 336 #

Proposal for a regulation
Article 45 – paragraph 2 – subparagraph 2

Amendment 337 #

Proposal for a regulation
Article 46 – paragraph 1 – point d

(d) ensure that the personalised security credentials of the payment services user are not, with the exception of the payer and the issuer of the personalised security credentials, accessible to other parties including the payment initiation providers itself and that they are transmitted by the payment initiation service provider through safe and efficient channels;

Amendment 338 #

Proposal for a regulation
Article 46 – paragraph 2 – point a

(a) use, access or store sensitive payment data of the payment service user;

Amendment 339 #

Proposal for a regulation
Article 47 – paragraph 1 – point b

(b) ensure that the personalised security credentials of the payment service user are not accessible to other parties, including the account information service provider itself, with the exception of the user and the issuer of the personalised security credentials, and that when those credentials are transmitted by the account information service provider, transmission is done through safe and efficient channels;

Amendment 340 #

Proposal for a regulation
Article 48 – paragraph 1

1. Competent authorities shall ensure that account servicing payment service providers comply at all times with their obligations in relation to the dedicated interface referred to in Article 35(1) and that any identified prohibited obstacle listed in Article 44 is immediately removed by the relevant account servicing payment service provider. Where such non- compliance of the dedicated interfaces with this Regulation or obstacles are identified, including on the basis of information transmitted by payment initiation services and account information services providers, the competent authorities shall take without undue delay the necessary and adequate enforcement measures and impose any appropriate and proportionate sanction or, where appropriate and duly justified, grant access rights in accordance with Article 38(4).

Amendment 341 #

Proposal for a regulation
Article 49 – paragraph 1

1. A payment transaction or a series of payment transactions shall be authorised only if the payer has given its ~~permission~~consent for the execution of the payment transaction. A payment transaction may be authorised by the payer prior to or, if agreed between the payer and the account servicing payment service provider, after the execution of the payment transaction. (This amendment should apply throughout the text.)

Amendment 342 #

Proposal for a regulation
Article 49 – paragraph 1 a (new)

1 a. The term 'permission' in this Regulation shall not be understood as the term 'consent' under Regulation (EU) 2016/679 for which the requirements of that Regulation apply. Permission under this Regulation refers to the authorisation by the payment service user for the execution of a payment transaction or for access to account information data. This requirement is without prejudice to the application of Regulation (EU) 2016/679 and of Directive 2005/29/EC.

Amendment 343 #

Proposal for a regulation
Article 49 – paragraph 7

7. TAt any time the payment service user may withdraw permission to execute a payment transaction or to access a payment account for the purpose of payment initiation services or account information services ~~may be withdrawn by the payment service user at any time~~. The payment service user may also withdraw permission to execute a series of payment transactions, in which case any future payment transaction shall be considered to be unauthorised.

Amendment 344 #

Proposal for a regulation
Article 50 – title

Discrepancies between the name or other identifier and unique identifier of a payee in case of credit transfers

Amendment 345 #

Proposal for a regulation
Article 50 – paragraph 1

1. In case of credit transfers, the payment service provider of the payee shall, free of charge, at the request of the payment service provider of the payer, verify whether or not the unique identifier and the name o~~f the payee~~r other identifier that unambiguously identifies the payee, such as a fiscal number, a European unique identifier as referred to in Article 16(1), second subparagraph, of Directive (EU) 2017/1132, or an LEI as provided by the payer match, and shall communicate the outcome of this verification to the payment service provider of the payer. Where the unique identifier and the name ofr other identifier that unambiguously identifies the payee do not match, the payment service provider of the payer shall notify the payer of any such discrepancy detected and shall inform the payer of the degree of that discrepancy.

Amendment 346 #

Proposal for a regulation
Article 50 – paragraph 1 – subparagraph 1 (new)

When a credit transfer is intended for a legal entity payee, the payer's payment service provider should permit the utilization of data elements beyond the name. This may include utilizing the ISO 17442 Legal Entity Identifier, where available, to enhance security in the identification matching process.

Amendment 347 #

Proposal for a regulation
Article 50 – paragraph 2

2. The payment service providers shall provide the service referred to in paragraph 1 immediately after the payer provided to its payment service provider the unique identifier and the name or other identifier of the payee, and before the payer is offered the possibility to authorise the credit transfer.

Amendment 348 #

Proposal for a regulation
Article 50 – paragraph 4

4. Payment service providers shall ensure that payment service users have the right to opt out from being offered the service referred to in paragraph 1 and shall inform their payment service users of the means to express such opt-out right. Payment service providers shall ensure that payment service users that initially opted out from receiving the service referred to in paragraph 1, have the right to opt in to receive that service.deleted

Amendment 349 #

Proposal for a regulation
Article 50 – paragraph 7

7. The matching service referred to in paragraph 1 shall not be required where the payer did not input himself the unique identifier and the name or other identifier of the payee.

Amendment 350 #

Proposal for a regulation
Article 50 – paragraph 8 a (new)

8 a. The EBA shall develop draft regulatory technical standards specifying the technical requirements of the system developed for the purpose of sharing information pursuant to paragraph 1 and 2, taking into account the different methods of identification used across the Union. When developing the draft regulatory technical standards referred to in the first subparagraph, the EBA shall consider various approaches to the methods of information sharing, including decentralised methods. The EBA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by [ OP please insert the date= one year after the date of entry into force of this Regulation]. Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

Amendment 351 #

Proposal for a regulation
Article 50 a (new)

Article 50a Addressing location-based payment account identifier discrimination 1. When a payer makes a credit transfer to a payee holding a payment account located within the Union, the payer shall not be required to specify the Member State in which that payment account is located, provided that payment account is reachable. 2. When a payee accepts a credit transfer or uses a direct debit to collect funds from a payer holding a payment account located within the Union, the payee shall not be required to specify the Member State in which that payment account is located, provided that payment account is reachable.

Amendment 352 #

Proposal for a regulation
Article 51 – paragraph 1

1. Where a specific payment instrument is used for the purposes of giving permission, the ~~payer and the~~ payer’s payment service provider ~~may agree on~~shall offer to the payment service user the possibility to set spending limits for payment transactions executed through that payment instrument. By default, spending limits shall be set at a low level. Payment service providers shall not unilaterally increase the spending limits agreed with their payment service users. Payment service users shall be able to restrict the options of how they can change their spending limit with the possibility to allow for a change in spending limits, for example only in the physical premises of their payment service provider and the possibility to apply a change in the spending limit only after a certain time has passed.

Amendment 353 #

Proposal for a regulation
Article 51 – paragraph 1

1. Where a specific payment instrument is used for the purposes of giving permission, the payer and the payer’s payment service provider may agree on fair and proportionate spending limits for payment transactions executed through that payment instrument. Payment service providers shall not unilaterally increase the spending limits agreed with their payment service users.

Amendment 354 #

Proposal for a regulation
Article 51 – paragraph 1

1. Where a specific payment instrument is used for the purposes of giving permission, the payer and the payer’s payment service provider may agree on spending limits for payment transactions executed through that payment instrument. Payment service providers shall not unilaterally ~~increas~~change the spending limits agreed with their payment service users.

Amendment 355 #

Proposal for a regulation
Article 51 – paragraph 2

2. ~~If agreed in the framework contract, t~~The payment service provider ~~may reserve the right to~~shall block the payment instrument ~~for~~in case of objectively justified r~~eason~~isks relating to the security of the payment instrument, the suspicion of unauthorised or fraudulent use of the payment instrument or, in the case of a payment instrument with a credit line, a significantly increased risk that the payer may be unable to fulfil its liability to pay. Where such blocking does not take place despite reasonable grounds to suspect fraud, the payer shall not bear any financial consequences, except where the payer has acted fraudulently.

Amendment 356 #

José Manuel GARCÍA-MARGALLO Y MARFIL

Proposal for a regulation
Article 51 – paragraph 4 a (new)

4 a. The burden of proof shall lie with the payment service provider to prove that it has complied with the requirements of this Article.

Amendment 357 #

Proposal for a regulation
Article 52 – paragraph 1 – point b

(b) notify the payment service provider, or the entity specified by the payment service provider, without undue delay on becoming aware of the loss, theft, misappropriation or unauthorised use of the payment instrument and/or its personalised security credentials.

Amendment 358 #

Proposal for a regulation
Article 53 – paragraph 1 – point c

(c) ensure that appropriate means, including free of charge telephone lines allowing for well-qualified personal human support without prior identification and in the official language of the host Member State are available at all times to enable the payment service user (i) to make a notification pursuant to Article 52 point (b), or to request unblocking of the payment instrument pursuant to Article 51(4); (ii) to make a notification about a fraudulent transaction; (iii) to receive qualified advice when suspecting to be victim of a fraud attack.

Amendment 359 #

Proposal for a regulation
Article 53 – paragraph 1 – point c

(c) ensure that appropriate means, including a free of charge telephone line allowing for personal human support in the language of the host Member State, are available at all times to enable the payment service user to: (i) make a notification pursuant to Article 52 point (b), or to request unblocking of the payment instrument pursuant to Article 51(4); (ii) notify a fraudulent transaction; (iii) receive feedback when the payment service user suspects a fraud; (iv) notify about problematic issues concerning conducted payments, such as errors of the payment machines during the payments.

Amendment 360 #

Proposal for a regulation
Article 53 – paragraph 1 – point f a (new)

(f a) refrain from using unsafe communication patterns, like sending links or documents via e-mail.

Amendment 361 #

Proposal for a regulation
Article 53 – paragraph 2 a (new)

2 a. Where the payer’s payment service provider fails to comply with the obligations set out in this Article, the payer shall not bear any financial losses unless the payer has acted fraudulently.

Amendment 362 #

Proposal for a regulation
Article 53 – paragraph 2 b (new)

2 b. The burden of proof shall lie with the payment service providers to prove that they have complied with the requirements of this Article.

Amendment 363 #

Proposal for a regulation
Article 54 – paragraph 1 – subparagraph 1

The payment service provider shall only rectify any unauthorised, incorrectly executed payment transaction or authorised payment transaction where the payment service user notifies the payment service provider in accordance with Articles 57 and 59 without undue delay after becoming aware of any such transaction giving rise to a claim, including a claim under Article 75, and no later than 138 months after the debit date.

Amendment 364 #

Proposal for a regulation
Article 55 – title

Evidence on auth~~oris~~entication and execution of payment transactions

Amendment 365 #

Bogdan RZOŃCA

Proposal for a regulation
Article 55 – paragraph 1 – subparagraph 1

Where a payment service user denies having authorised an executed payment transaction or claims that the payment transaction was not correctly executed, the burden shall be on the payment service provider to prove that the payment transaction ~~was~~followed required authentification and authorised, was accurately recorded, entered in the accounts and not affected by a technical breakdown or some other deficiency of the service provided by the payment service provider. Until other evidence is collected and properly assesed, the payment service provider is entitled to treat the tramsaction as authorised and correctly executed.

Amendment 366 #

Proposal for a regulation
Article 55 – paragraph 1 – subparagraph 1

Where a payment service user denies having authorised an executed payment transaction or claims that the payment transaction was not correctly executed, the burden shall be on the payment service provider to prove that the payment transaction was ~~authorise~~followed required authentication and, accurately recorded, entered in the accounts and not affected by a technical breakdown or some other deficiency of the service provided by the payment service provider. Until other evidence is collected and properly assessed, the payment service provider is entitled to treat the transaction as authorised and correctly executed.

Amendment 367 #

Proposal for a regulation
Article 55 – paragraph 1 – subparagraph 1

Amendment 368 #

Proposal for a regulation
Article 55 – paragraph 1 – subparagraph 2

If the payment transaction is initiated through a payment initiation service provider, the burden shall be on the payment initiation service provider to prove that within its sphere of competence, the payment transaction followed required authentication and was auth~~oris~~enticated, accurately recorded and not affected by a technical breakdown or other deficiency linked to the payment service of which it is in charge. Until other evidence is collected and properly assessed, the payment service provider is entitled to treat the transaction as authorised and correctly executed.

Amendment 369 #

Bogdan RZOŃCA

Proposal for a regulation
Article 55 – paragraph 1 – subparagraph 2

If the payment transaction is initiated through a payment initiation service provider, the burden shall be on the payment initiation service provider to prove that within its sphere of competence, the payment transaction ~~was authorised,~~followed required authentification and was accurately recorded and not affected by a technical breakdown or other deficiency linked to the payment service of which it is in charge. Until other evidence is collected and properly assesed, the payment service is entitled to treat the transaction as authorised and correctly executed.

Amendment 370 #

Proposal for a regulation
Article 55 – paragraph 1 – subparagraph 2

Amendment 371 #

Proposal for a regulation
Article 55 – paragraph 2

2. Where a payment service user denies having authorised an executed payment transaction, the use of a payment instrument recorded by the payment service provider, including the payment initiation service provider as appropriate, and the use of the payer’s personalised security credentials to authenticate a payment, including where relevant the application of strong customer authentication, shall in itself not be sufficient to prove either that the payment transaction was authorised by the payer or that the payer acted fraudulently or failed with intent or gross negligence to fulfil one or more of the obligations under Article 52. The payment service provider, including, where appropriate, the payment initiation service provider, shall provide supporting evidence to prove fraud or gross negligence on part of the payment service user.

Amendment 372 #

Proposal for a regulation
Article 55 – paragraph 2

2. Where a payment service user denies having authorised an executed payment transaction, the use of a payment instrument recorded by the payment service provider, including the payment initiation service provider as appropriate, shall in itself not necessarily be sufficient to prove either that the payment transaction was auth~~oris~~enticated by the payer or that the payer acted fraudulently or failed with intent or gross negligence to fulfil one or more of the obligations under Article 52. The payment service provider, including, where appropriate, the payment initiation service provider, shall provide supporting evidence to prove fraud or gross negligence on part of the payment service user.

Amendment 373 #

Bogdan RZOŃCA

Proposal for a regulation
Article 55 – paragraph 2

2. Where a payment service user denies having authorised an executed payment transaction, the use of a payment instrument recorded by the payment service provider, including the payment initiation service provider as appropriate, shall in itself not necessarily be sufficient to prove either that the payment transaction was authorised by the payer or that the payer acted fraudulently or failed with intent or gross negligence to fulfil one or more of the obligations under Article 52. The payment service provider, including, where appropriate, the payment initiation service provider, shall provide supporting evidence to prove fraud or gross negligence on part of the payment service user.

Amendment 374 #

Proposal for a regulation
Article 56 – paragraph 1

1. Without prejudice to Article 54, in the case of an unauthorised payment transaction, the payer’s payment service provider shall refund the payer the amount of the unauthorised payment transaction immediately, and in any event no later than by the end of the following business day, after noting or being notified of the unauthorised transaction, except where the payer’s payment service provider has reasonable grounds for suspecting gross negligence or fraud committed by the payer and communicates those grounds to the relevant national authority in writing.

Amendment 375 #

Proposal for a regulation
Article 56 – paragraph 2 – introductory part

2. Where the payer’s payment service provider had reasonable grounds for suspecting gross negligence or fraud committed by the payer, the payer’s payment service provider shall, within 105 business days after noting or being notified of the transaction, do either of the following:

Amendment 376 #

Proposal for a regulation
Article 56 – paragraph 2 – introductory part

2. Where the payer’s payment service provider had reasonable grounds for suspecting fraud committed by the payer, the payer’s payment service provider shall, within 120 business days after noting or being notified of the transaction, do either of the following:

Amendment 377 #

Proposal for a regulation
Article 56 – paragraph 2 – point a

(a) refund the payer the amount of the unauthorised payment transaction if the payer’s payment service provider has concluded, after further investigation, that no gross negligence or fraud has been committed by the payer;

Amendment 378 #

Proposal for a regulation
Article 56 – paragraph 2 – point b

(b) provide aevidence to the relevant national authority in a written justification that the payer has acted fraudulently, and provide to the payer a substantiated justification for refusing the refund and indicate the bodies to which the payer may refer the matter in accordance with Articles 90, 91, 93, 94 and 95 if the payer does not accept the reasons provided.

Amendment 379 #

Proposal for a regulation
Article 56 – paragraph 2 – subparagraph 1 (new)

The burden of proof shall be on the payment service providers to prove that the payer has acted fraudulently.

Amendment 380 #

Proposal for a regulation
Article 56 – paragraph 6 a (new)

6 a. Set-off against the payer’s claims arising from this Article is not permitted.

Amendment 381 #

Proposal for a regulation
Article 57 – paragraph 1

1. The payer shall not bear any financial losses for any authorised credit transfer where the payment service provider of the payer failed, in breach of Article 50(1), to notify the payer of a detected discrepancy between the unique identifier and the name of the payee provided by the payer. The payer’s payment service provider shall refund the payer the amount of the financial losses immediately, and in any event no later than by the end of the following business day, after noting or being notified of the financial losses, except where the payer’s payment service provider has reasonable grounds for suspecting that there was no breach of Article 50(1) and communicates those grounds to the relevant national authority in writing.

Amendment 382 #

Proposal for a regulation
Article 57 – paragraph 2 – introductory part

2. Within 105 business days after noting or being notified of a credit transfer transaction executed in the circumstances referred to in paragraph 1, the payment service provider shall do either of the following:

Amendment 383 #

Proposal for a regulation
Article 57 – paragraph 2 – introductory part

2. Within 120 business days after noting or being notified of a credit transfer transaction executed in the circumstances referred to in paragraph 1, the payment service provider shall do either of the following:

Amendment 384 #

Proposal for a regulation
Article 57 – paragraph 2 – point b

(b) provide aevidence that there was no breach of Article 50(1) to the relevant national authority and provide a substantiated justification for refusing the refund and indicate the bodies to which the payer may refer the matter in accordance with Articles 90, 91, 93, 94 and 95 if the payer does not accept the reasons provided.

Amendment 385 #

Proposal for a regulation
Article 57 – paragraph 5

5. Paragraphs 1 to 4 shall not apply if the payer has acted fraudulently ~~or if the payer opted out from receiving the verification service in accordance with Article 50(4)~~.

Amendment 386 #

Proposal for a regulation
Article 57 – paragraph 5

5. Paragraphs 1 to 4 shall not apply if the payer has acted fraudulently or grossly negligent or if the payer opted out from receiving the verification service in accordance with Article 50(4).

Amendment 387 #

Proposal for a regulation
Article 57 – paragraph 5 a (new)

5 a. The burden of proof shall be on the payment service providers to prove that the payer has acted fraudulently.

Amendment 388 #

Proposal for a regulation
Article 58

Liability of technical service providers and of operators of payment schemes for failure to support the application of Technical service providers and operators of payment schemes that either provide services to the payee, or to the payment service provider of the payee or of the payer, shall be liable for any financial damage caused to the payee, to the payment service provider of the payee or of the payer for their failure, within the remit of their contractual relationship, to provide the services that are necessary to enable the application ofArticle 58 deleted strong customer authentication.

Amendment 389 #

Proposal for a regulation
Article 58 – paragraph 1

Technical service providers and operators of payment schemes that ~~either~~ provide services ~~to the payee, or to~~relating to strong customer authentication under an outsourcing agreement with the payment service provider of the payee or of the payer, shall be liable for ~~any~~direct financial damage caused to the payee, to the payment service provider of the payee or of the payer for, and proportionate to, their failure, within the remit of their contractual relationship, and not exceeding the amount of the transaction in question, to provide the services that are necessary to enable the ~~application~~carrying out of strong customer authentication.

Amendment 390 #

Proposal for a regulation
Article 58 – paragraph 1

Technical service providers, e-wallet providers and operators of payment schemes that either provide services to the payee, or to the payment service provider of the payee or of the payer, shall be liable for any financial damage caused to the payee, to the payment service provider of the payee or of the payer for their failure, within the remit of their contractual relationship, to provide the services that are necessary to enable the application of strong customer authentication.

Amendment 391 #

Proposal for a regulation
Article 58 – paragraph 1

~~Technical service providers and o~~Operators of payment schemes that either provide services to the payee, or to the payment service provider of the payee or of the payer, shall be liable for any financial damage caused to the payee, to the payment service provider of the payee or of the payer for their failure, within the remit of their contractual relationship, to provide the services that are necessary to enable the application of strong customer authentication.

Amendment 392 #

Proposal for a regulation
Article 59 – title

~~Payment service provider’s liability for i~~Impersonation fraud

Amendment 393 #