The Payment Services Regulations 2017

Electronic Money Regulations 2011 U.K.

5.—(1) The Electronic Money Regulations 2011 M1 are amended as follows.

(2) In regulation 2(1) (interpretation)—

(a) in the appropriate places insert—

““account information service” means an online service to provide consolidated information on one or more payment accounts held by the payment service user with another payment service provider or with more than one payment service provider, and includes such a service whether information is provided—

(a) in its original form or after processing;

(b) only to the payment service user or to the payment service user and to another person in accordance with the payment service user's instructions;”;

““European Banking Authority” means the European Banking Authority established by Regulation (EU) 1093/2010 of the European Parliament and of the Council of 24th November 2010 establishing a European Supervisory Authority (European Banking Authority) M2 ;”;

““payment initiation service” means a service to initiate a payment order at the request of the payment service user with respect to a payment account held at another payment service provider;”;

““payment service provider” has the meaning given in regulation 2(1) of the Payment Services Regulations 2017;”;and

““sensitive payment data” means information, including personalised security credentials, which could be used to carry out fraud; but in relation to account information services and payment initiation services does not include the name of an account holder or an account number;”; and

(b) for the definition of “own funds” substitute—

““own funds” means own funds as defined in Article 4(1)(118) of the capital requirements regulation, and “Common Equity Tier 1 capital”, “Tier 1 capital” and “Tier 2 capital” have the same meanings as in that regulation;”;

(c) in the definition of “payment services” for “2009” substitute “ 2017 ”;

(d) for the definition of “the payment services directive” substitute—

““the payment services directive” means Directive 2015/2366/EU of the European Parliament and of the Council of 25th November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No. 1093/2010, and repealing Directive 2007/64/EC;”.

(3) In regulation 3 (exclusions), for paragraphs (a) and (b) substitute—

“(a) monetary value stored on specific payment instruments that can be used only in a limited way and meet one of the following conditions—

(i) allow the holder to acquire goods or services only in the issuer's premises;

(ii) are issued by a professional issuer and allow the holder to acquire goods or services only within a limited network of service providers which have direct commercial agreements with the issuer;

(iii) may be used only to acquire a very limited range of goods or services; or

(iv) are valid only in a single EEA State, are provided at the request of an undertaking or a public sector entity, and are regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers which have a commercial agreement with the issuer;

(b) monetary value that is used to make payment transactions resulting from services provided by a provider of electronic communications networks or services, including transactions between persons other than that provider and a subscriber, where those services are provided in addition to electronic communications services for a subscriber to the network or service, and where the additional service is—

(i) for purchase of digital content and voice-based services, regardless of the device used for the purchase or consumption of the digital content, and charged to the related bill; or

(ii) performed from or via an electronic device and charged to the related bill for the purchase of tickets or for donations to organisations which are registered or recognised as charities by public authorities, whether in the United Kingdom or elsewhere,

provided that the value of any single payment transaction does not exceed £40, and the cumulative value of payment transactions for an individual subscriber in a month does not exceed £240.”.

(4) After regulation 3 (electronic money: exclusions) insert—

“Notification of use of limited network exclusion

3A.— (1) If, in any period of 12 months, the total value of payment transactions made with monetary value falling within regulation 3(a)(i) to (iii) issued by a person (“issuer”) exceeds 1 million euros, the issuer must notify the Authority.

(2) The period of 12 months referred to in paragraph (1) does not include any period in respect of which a notification has already been made under paragraph (1).

(3) A notification under paragraph (1) must—

(a) include a description of the transactions made; and

(b) specify the exclusion by virtue of which the monetary value is not electronic money.

(4) Notifications and information provided to the Authority under this regulation must be given—

(a) within such time as the Authority may direct after the end of the period of 12 months referred to in paragraph (1); and

(b) in such form or verified in such manner as the Authority may direct,

and different directions may be given in relation to different notifications or information or categories of notification or information.

(5) When the Authority receives a notification under this regulation, the Authority must assess whether the notified monetary value falls within regulation 3(a)(i) to (iii).

(6) If the Authority considers that any part of the notified monetary value does not fall within regulation 3(a)(i) to (iii)—

(a) the Authority must notify the issuer, and

(b) the issuer may refer the matter to the Upper Tribunal.

Notification of use of electronic communications exclusion

3B.— (1) If a person (“issuer”) issues, or intends to issue, monetary value falling within regulation 3(b), the service provider must—

(a) notify the Authority, and

(b) include with such notification a description of the transactions for which the monetary value is intended to be used.

(2) The issuer must provide a notification under paragraph (1)—

(a) if the issuer started to issue the monetary value before 13th January 2018, on or before that date, or

(b) otherwise, before the issuer starts to issue the monetary value.

(3) The issuer must also provide to the Authority, at such times as the Authority may direct, an annual audit opinion testifying that the transactions for which the monetary value is used comply with the limits mentioned in regulation 3(b).

(4) Information provided to the Authority under this regulation must be in such form or verified in such manner as the Authority may direct.

(5) Different directions may be given under paragraph (3) and (4) in relation to different issuers or different categories of issuers.”.

(5) In regulation 4 (the register of certain electronic money issuers)—

(a) in paragraph (1) after sub-paragraph (b) insert—

“(ba) persons who have notified the Authority in accordance with regulation 3A or 3B;”;

(b) in paragraph (6) after sub-paragraph (a) insert—

“(aa) enter in the register any cancellation of an authorisation or registration;

(ab) enter in the register a description of the service provided by a person included on the register by virtue of paragraph (1)(ba);”;

(c) after paragraph (6) insert—

“(7) The Authority must, without delay, notify the European Banking Authority of—

(a) the information entered in the register;

(b) any changes to the information in the register;

(c) the reasons for the cancellation of any authorisation or registration; and

(d) where a person is included on the register by virtue of paragraph (1)(ba), the particular exclusion which applies to the person.”.

(6) In regulation 6 (conditions for authorisation)—

(a) in paragraph (2) for “regulation 5” substitute “ regulations 5 and 20 ”;

(b) after paragraph (4) insert—

“(4A) The applicant carries on, or will carry on, at least part of its electronic money and payment service business in the United Kingdom.”;

(c) in paragraph (6), after sub-paragraph (d) insert—

“(e) in the case of an applicant which proposes to carry on payment initiation services, it holds professional indemnity insurance or a comparable guarantee, which covers—

(i) the territories in which the applicant proposes to offer payment initiation services; and

(ii) the applicant's potential liability under regulations 76 and 91 to 95 of the Payment Services Regulations 2017, up to such amount as the Authority may direct; and

(f) in the case of an applicant which proposes to carry on account information services, it holds professional indemnity insurance or a comparable guarantee, which covers—

(i) the territories in which the applicant proposes to offer account information services; and

(ii) the applicant's potential liability to account servicing payment service providers and payment service users resulting from unauthorised or fraudulent access to, or use of, payment account information, up to such amount as the Authority may direct.”.

(7) In regulation 8 (variation at request of an authorised electronic money institution), in the wording after paragraph (c)—

(a) after “provided that” insert “ the Authority is satisfied that ”;

(b) for “will continue to be met” substitute “ are being or are likely to be met ”.

(8) In regulation 10(1) (cancellation of authorisation)—

(a) in sub-paragraph (e) after “own funds” insert “ , or does not inform the Authority of a major change in circumstances which is relevant to its meeting those conditions or that requirement, as required by regulation 37 ”;

(b) in sub-paragraph (g) after “stability of” insert “ , or trust in, ”;

(c) in paragraph (i) after “unlawful” insert “ , including where such provision of services is unlawful because the person's registration in a register maintained under regulation 54 or 55 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 has been cancelled under regulation 60 of those Regulations ”.

(9) In regulation 11(1) (variation of authorisation on Authority's own initiative)—

(a) in sub-paragraph (a) after “own funds” insert “ , or does not inform the Authority of a major change in circumstances which is relevant to its meeting those conditions or that requirement, as required by regulation 37 ”;

(b) in sub-paragraph (c) after “stability of” insert “ , or trust in, ”;

(c) in sub-paragraph (e) after “unlawful” insert “ , including where such provision of services is unlawful because the person's registration in a register maintained under regulation 54 or 55 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 has been cancelled under regulation 60 of those Regulations ”.

(10) In regulation 13 (conditions for registration)—

(a) in paragraph (2) for “regulation 12” substitute “ regulations 12 and 20 ”;

(b) after paragraph (4) insert—

“(4A) The business to which the application relates must not include the provision of account information services or payment initiation services.”;

(c) in paragraph (8)(e) for “2009” substitute “ 2017 ”.

(11) In regulation 15 (supplementary provisions)—

(a) in paragraph (b), in the modified version of regulation 8—

(i) in paragraph (1), in the wording after sub-paragraph (c)—

(aa) after “provided that” insert “ the Authority is satisfied that ”;

(bb) for “continue to be met” substitute “ are being or are likely to be met ”;

(ii) in paragraph (2) omit “that must continue to be met”;

(b) in paragraph (c), in the modified version of regulation 10(1)(e), after “(d)” insert “ , or does not inform the Authority of a major change in circumstances which is relevant to its meeting those conditions, as required by regulation 37 ”.

(12) In regulation 16 (application to become an authorised electronic money institution where a financial limit is exceeded)—

(a) for the heading substitute “ application for authorisation if requirements cease to be met ”;

(b) for “referred to in regulation 8(2)(c) or (d) (as applied by regulation 15)”, substitute “ in regulation 13(3), (4), (8) or (9) ”.

(13) In regulation 20 (safeguarding requirements)—

(a) after paragraph (2) insert—

“(2A) An electronic money institution may safeguard certain relevant funds in accordance with regulation 21 and the remaining relevant funds in accordance with regulation 22.”;

(b) in paragraph (6) for “Regulation 19 of the Payment Services Regulations 2009” substitute “ Regulation 23 of the Payment Services Regulations 2017 ”.

(14) In regulation 21 (safeguarding option 1)—

(a) in paragraph (2)(a) after “authorised credit institution” insert “ or the Bank of England ”;

(b) after paragraph (4) insert—

“(4A) Notwithstanding paragraphs (1), (2), (3)(b) and (4), where an electronic money institution is a participant in a designated system and the institution holds an account at the Bank of England for the purposes of completing the settlement of transfer orders that have been entered into the designated system on behalf of electronic money holders—

(a) funds held in the account pending settlement in accordance with the rules or default arrangements of the designated system, in respect of transfer orders that have been entered into the designated system on behalf of electronic money holders, may continue to be held in the account with relevant funds;

(b) the account, or a specified amount of funds in the account, may be subject to an interest or right in favour of the Bank of England in order to ensure the availability of funds to complete the settlement of transfer orders in accordance with the rules or default arrangements of the designated system;

(c) subject to paragraph (4B), funds received into the account by the electronic money institution upon settlement are to be considered as having been appropriately safeguarded in accordance with this regulation from the time of receipt in the designated system until the time of receipt into the account.

(4B) The Authority may direct that paragraph (4A)(c) does not apply in relation to a designated system if, in the Authority's view, the rules and default arrangements of that system do not adequately insulate the funds of electronic money holders from the claims of other creditors of electronic money institutions which are participants in the system.”;

(c) in paragraph (5)—

(i) omit “and” after sub-paragraph (b);

(ii) after sub-paragraph (c) insert—

“(d) any funds held in an account as permitted by paragraph (4A)(a);

(e) any funds expected to be received into an account as described in paragraph (4A)(c) in respect of transfer orders that have been entered into the designated system; and

(f) any funds received into an account as described in paragraph (4A)(c).”;

(d) in paragraph (7) after the definition of “authorised custodian” insert—

““default arrangements”, “designated system”, “rules”, “settlement”, “system” and “transfer order” have the same meanings as in the Financial Markets and Insolvency (Settlement Finality) Regulations 1999 M3 .”.

(15) In regulation 22 (safeguarding option 2), in paragraph (1)(a)(ii) and (iii) after “a” insert “ comparable ”.

(16) In regulation 24 (insolvency events)—

(a) in paragraph (1)(b) after “21(2)(a) or (b)” insert “ or (4A), ”;

(b) in paragraph (4), in the definition of “asset pool”, after paragraph (b) insert—

“(ba) where regulation 21(4A) applies, any funds that are received into the account held at the Bank of England upon settlement in respect of transfer orders that have been entered into the designated system on behalf of electronic money holders, whether settlement occurs before or after the insolvency event;”;

(c) after paragraph (4) insert—

“(5) In paragraph (4) “designated system”, “settlement” and “transfer order” have the same meanings as in the Financial Markets and Insolvency (Settlement Finality) Regulations 1999.”.

(17) In regulation 26 (outsourcing)—

(a) in paragraph (2)—

(i) after “important operational function” insert “ , including provision of an information technology system ”;

(ii) in sub-paragraph (a)(ii) after “monitor” insert “ and retrace ”;

(b) in paragraphs 2(a)(ii), (b) and (c) and (3)(a) for “2009” substitute “ 2017 ”;

(c) after paragraph (3) insert—

“(4) An authorised electronic money institution must notify the Authority without undue delay of any change in outsourced functions or the persons to which functions are outsourced.”.

(18) In regulation 28 (notice of intention)—

(a) in paragraph (2), for sub-paragraphs (a) to (d) substitute—

“(a) states the name and address of the institution, and any authorisation or reference number;

(b) identifies the EEA States in which it intends to operate;

(c) identifies the electronic money issuance, redemption, distribution or payment services which it seeks to carry on in those States;

(d) if the institution intends to use an agent to provide the services in any of those States, includes the information referred to in regulation 34(3) (requirement for agents to be registered);

(e) if the institution intends to use an EEA branch to provide the services in any of those States, includes—

(i) the information referred to in paragraphs 2 and 5 of Schedule 1 in relation to the services to be provided through each EEA branch;

(ii) the names of those responsible for the management of each proposed EEA branch; and

(iii) details of the organisational structure of each proposed EEA branch;

(f) if the authorised payment institution intends to enter into a contract with a person in another EEA State under which that person will carry out any operational function relating to the issuance, distribution or issuance of electronic money or the provision of payment services in that EEA State, includes notification of that intention; and

(g) identifies the distributors, if any, whom the institution intends to engage to distribute or redeem electronic money in exercise of its passport rights in that State.”;

(b) for paragraphs (3) and (4) substitute—

“(3) If any of the information provided by an authorised electronic money institution in a notice of intention changes, including by the addition of a further branch, the institution must give the Authority notice of such changes in a further notice of intention.

(4) The Authority must, within one month beginning with the date on which it receives a complete notice of intention, inform the host state competent authority of the information contained in the notice of intention.”.

(19) For regulation 29 (registration of EEA branch) substitute—

“Decision following notice of intention

29.— (1) If the Authority, taking into account any information received from the host state competent authority, proposes to determine that an authorised electronic money institution is not permitted to exercise passport rights in an EEA State as notified in a notice of intention, the Authority must give the relevant institution a warning notice.

(2) The Authority must, within the period of three months beginning with the date on which it receives a notice of intention and having considered any representations made in response to the warning notice—

(a) if it decides

(i) that the authorised electronic money institution is not permitted to exercise passport rights in the EEA State, not to register an EEA branch, or to cancel the registration an EEA branch, give the institution a decision notice; or

(ii) that the authorised electronic money institution is permitted to exercise passport rights in the EEA State, to register an EEA branch, or not to cancel the registration of an EEA branch, give the institution notice of its decision; and

(b) notify the host state competent authority of its decision, providing reasons for that decision if the Authority does not agree with the assessment of the host state competent authority.

(3) If the Authority decides that the authorised electronic money institution is not permitted to exercise passport rights in the EEA State, not to register an EEA branch, or to cancel the registration of an EEA branch, the institution may refer the matter to the Upper Tribunal.

(4) If the Authority decides to register an EEA branch, it must update the register as soon as practicable.

(5) If the Authority decides to cancel the registration of an EEA branch, the Authority must, where the period for a reference to the Upper Tribunal has expired without a reference being made, as soon as practicable update the register accordingly.

(6) The authorised electronic money institution may commence activities as notified in its notice of intention only after the Authority has notified the institution of its decision under paragraph (2)(a)(ii) and, in the case of services to be provided through an EEA branch, after entry of the branch on the register.

(7) After registration, the authorised electronic money institution must notify the Authority of the date on which it starts to provide payment services in the other EEA State through the EEA branch, and the Authority must notify such date to the host state competent authority.

Notice of intention from an EEA authorised payment institution

29A.— (1) If a home state competent authority sends information to the Authority about an EEA authorised electronic money institution which intends to provide services in the United Kingdom, the Authority must, before the end of the period of one month beginning on the day which the Authority receives all the required information—

(a) assess the information; and

(b) provide relevant information to the home state competent authority in connection with the intended provision of payment services in the United Kingdom, including in particular any reasonable grounds for concern with regard to money laundering or terrorist financing within the meaning of the money laundering directive in connection with the intended appointment of an agent or establishment of a branch in the United Kingdom.

(2) The EEA authorised electronic money institution may provide services in the United Kingdom in accordance with the information it has provided to the home state competent authority upon entry of the branch or agent in the register maintained by the home state competent authority.”.

(20) In regulation 30 (supervision of firms exercising passport rights)—

(a) in paragraph (2)(b)(ii) after “information” insert “ , including on compliance with the conditions at regulation 6(4)(a) and (4A) ”;

(b) for paragraph (4) substitute—

“(4) The Authority may direct that an EEA authorised electronic money institution exercising its passport rights to services in the United Kingdom through a branch or an agent in the United Kingdom must report to the Authority on such activities, for information and statistical purposes and, where the institution has exercised its right of establishment in the United Kingdom, to monitor compliance with Part 5 of these Regulations.

(5) Reports required under paragraph (4) must be given at such times and in such form, and verified in such manner, as the Authority may direct.

(6) An agent in the United Kingdom appointed by an EEA authorised electronic money institution or a branch of an EEA authorised electronic money institution in the United Kingdom must maintain the confidentiality of any confidential information provided to the Authority under paragraph (4).

(7) If a host state competent authority informs the Authority that an authorised electronic money institution providing services through an EEA branch or an EEA agent does not comply with a provision of the payment services directive, the Authority must—

(a) exercise its powers as appropriate without undue delay, to ensure that the authorised payment institution complies with the relevant provisions; and

(b) inform the host state competent authority and the competent authority of any other relevant EEA State of the measures taken without delay.

(8) Where immediate action is necessary to address a serious risk to the collective interests of electronic money holders or payment service users in the United Kingdom, the Authority may, in addition to providing information under paragraph (2), take precautionary measures in relation to an EEA authorised electronic money institution pending action by the home state competent authority.

(9) Any measures taken under paragraph (8) must be temporary and must end when the risk identified has been addressed.

(10) If the Authority decides to take measures under paragraph (8), it must inform the home state competent authority, the competent authority of any other relevant EEA State, and the European Banking Authority of the measures to be taken and the reason that immediate action is necessary—

(a) in advance of taking the measures, if that is compatible with the need for immediate action; and

(b) in any event without undue delay.

(12) In paragraphs (7)(b) and (10) “competent authority of any other relevant EEA State” means a competent authority designated in accordance with the electronic money directive in an EEA State which the Authority considers to have an interest in the measures taken, or to be taken, by the Authority.”.

(21) Before regulation 32 (additional activities) insert—

“Record keeping

31A.— (1) An electronic money institution must maintain relevant records and keep them for at least five years from the date on which the record was created.

(2) For the purposes of paragraph (1), records are relevant where they relate to compliance with obligations imposed by or under Parts 2 to 4 and, in particular, would enable the Authority to supervise effectively such compliance.”.

(22) In regulation 32(2) for “regulation 27(2) of the Payment Services Regulations 2009” substitute “ regulation 32(2) of the Payment Services Regulations 2017 ”.

(23) In regulation 34 (requirement for agents to be registered)—

(a) in paragraph (3)(a)—

(i) in paragraph (iii) after “the agent and” insert “ , if the agent is not an electronic money institution or an EEA authorised electronic money institution, or a payment service provider within the meaning of the Payment Services Regulations 2017, ”;

(ii) omit “and” after paragraph (iii)

(iii) after paragraph (iii) insert—

“(iiia) the services for which the agent is appointed;

(iiib) the unique identification code or number of the agent, if any; and”;

(b) after paragraph (5) insert—

“(5A) Where the application relates to the provision of services in exercise of passport rights through an EEA agent, the Authority must, within one month beginning with the date on which it received the completed application, inform the host state competent authority of the information provided under paragraph (3) or (5).”;

(c) omit paragraphs (7) and (8);

(d) after paragraph (10) insert—

“(10A) Where the application relates to the provision of services in exercise of passport rights through an EEA agent, the Authority must—

(a) take into account any information received from the host state competent authority in making its decision; and

(b) notify the host state competent authority of its decision, providing reasons for that decision if the Authority does not agree with the assessment of the host state competent authority.

(10B) The Authority must give notice under paragraph (10) and (10A)—

(a) where the application relates to the provision of services in the United Kingdom, within a period of two months beginning on the date on which the Authority received the completed application;

(b) where the application relates to the provision of services in the exercise of passport rights through an EEA agent, within a period of three months beginning on the date on which the Authority received the completed application.”;

(e) after paragraph (12) insert—

“(12A) An authorised electronic money institution must notify the Authority of the date on which it starts to provide services in another EEA State through a registered EEA agent, and the FCA must notify such date to the host state competent authority.”;

(f) after paragraph (14) insert—

“(15) An authorised electronic money institution must notify the Authority without undue delay if there is any change in the information notified under paragraph (3) or (5).”.

(24) In regulation 36(1) (reliance) for “2009” substitute “ 2017 ”.

(25) In regulation 49 (reporting requirements), after paragraph (2) insert—

“(3) A direction under this regulation must specify the purpose for which the information is required, as appropriate, and the time within which the information is to be given.”.

(26) In regulation 71 (duty to co-operate and exchange information)—

(a) in paragraph (1)—

(i) omit “and” after sub-paragraph (b);

(ii) after sub-paragraph (c) insert—

“; and

(d) the European Banking Authority,”;

(b) in paragraph (2)(a) for “and (c)” substitute “ , (c) and (d) ”;

(c) after paragraph (2) insert—

“(3) If the European Banking Authority is assisting the Authority, or a competent authority in another EEA State, in relation to a disagreement between those authorities pursuant to Article 19 of Regulation (EU) 1093/2010 of the European Parliament and of the Council of 24th November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC M4 , the Authority must defer any decision in relation to the subject of the disagreement until the disagreement is resolved under that Article.”.

(27) In regulation 73 (prohibition on contracting out) for “2009” substitute “ 2017 ”.

(28) After regulation 78 (amendments to the banking consolidation directive) insert—

“Transitional arrangements for existing electronic money institutions on the implementation of the second payment services directive

78A.— (1) This regulation applies in relation to an authorised electronic money institution, EEA authorised electronic money institution or small electronic money institution which provides services before 13th January 2018 in accordance with these Regulations or the national law in another EEA State transposing the electronic money directive and, where relevant, the Payment Services Regulations 2009 or the national law in another EEA State transposing the first payment services directive.

(2) In the case of an authorised electronic money institution or small electronic money institution—

(a) the institution may continue to provide the services provided before 13th January 2018 until the end of 12th July 2018 without further authorisation or registration under these Regulations;

(b) the institution is to be treated as if on 13th January 2018 the Authority had imposed a requirement under regulation 7 (imposition of variations), including under that regulation as applied by regulation 15 (supplementary provisions), requiring the institution to refrain from providing account information services or payment initiation services for an indefinite period;

(c) any other requirement imposed by the Authority under regulation 7 (imposition of variations), including under that regulation as applied by regulation 15 (supplementary provisions), applies in relation to services provided pursuant to sub-paragraph (a);

(d) regulations 10 (cancellation of authorisation) and 11 (variation of authorisation on Authority's own initiative), including those regulations as applied by regulation 15, apply in relation to the institution as if references to authorisation or registration included references to entitlement to provide payment services pursuant to sub-paragraph (a); and

(e) the institution may not apply for a variation under regulation 8 (variation etc. at request of authorised electronic money institution), including under that regulation as applied by regulation 15, before it complies with paragraph (4) or (5) of this regulation.

(3) An EEA authorised electronic money institution may continue to provide the services provided before 13th January 2018 until the end of 12th July 2018 without further authorisation or registration under the national law implementing the amendments to the electronic money directive made by Article 111 of the payment services directive.

(4) Where an authorised electronic money institution intends to provide services on or after 13th July 2018, the institution must before 13th April 2018—

(a) provide to the Authority all information specified in Schedule 1 that the person has not previously provided to the Authority; or

(b) notify the Authority that it has previously provided all such information to the Authority.

(5) Where a small electronic money institution intends to provide services as a small electronic money institution on or after 13th July 2018, the institution must before 13th April 2018 notify the Authority whether it continues to meet the requirements for registration as a small electronic money institution, together with any information relevant to that question which is has not previously provided to the Authority.

(6) On receipt of information or a notification pursuant to paragraph (4) or (5), the Authority must consider whether the institution's authorisation or registration should be continued on and after 13th July 2018.

(7) If the Authority does not decide to continue the institution's authorisation or registration under paragraph (6), the institution's authorisation or registration is to be treated as having been cancelled on 13th July 2018.

(8) The Authority must maintain in the register a person entitled to provide services pursuant to this regulation.

(9) In this regulation “first payment services directive” means Directive 2007/64/EC of the European Parliament and of the Council of 13th November 2007 on payment services in the internal market amending Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC M5 .”.

(29) In Schedule 1 (information to be included in or with an application for authorisation)—

(a) after paragraph 5 insert—

“5A.   A description of the applicant's procedure for monitoring, handling and following up security incidents and security-related customer complaints, including where appropriate an incidents reporting mechanism which takes account of the notification obligations under regulation 99 of the Payment Services Regulations 2017.

5B.   A description of the applicant's process for filing, monitoring, tracking and restricting access to sensitive payment data.

5C.   A description of the applicant's business continuity arrangements, including a clear identification of the critical operations, effective contingency plans, and a procedure for regular testing and reviewing of the adequacy and efficiency of such plans.

5D.   A description of the principles and definitions used by the applicant in collecting statistical data on performance, transactions and fraud.

5E.   A statement of the applicant's security policy, including—

(a) a detailed risk assessment in relation to the payment services to be provided, including risks of fraud and illegal use of sensitive and personal data, and

(b) a description of—

(i) the applicant's security control and mitigation measures to provide adequate protection to users against the risks identified,

(ii) how such measures ensure a high level of technical security and data protection, including such security and protection for the software and IT systems used by the applicant and any undertakings to which the applicant outsources any part of its operations, and

(iii) where appropriate, the applicant's measures to comply with regulation 98(1) of the Payment Services Regulations 2017, taking into account any guidelines issued by the European Banking Authority under Article 95(3) of the payment services directive.”;

(b) in paragraph 7, after “branches and” insert “ the off-site and on-site checks that the applicant undertakes to perform on them at least annually, ”;

(c) in paragraph 13, after “5” insert “ , 5A ”; and

(d) after paragraph 13, insert—

“14.   In the case of an applicant which proposes to provide payment initiation services or account information services, the professional indemnity insurance or comparable guarantee which it holds in relation to such services.”.

(30) In Schedule 2 (capital requirements)—

(a) in paragraph 1 for “the items specified in paragraph 4(a), (b) and (c) of this Schedule” substitute “ one or more of the items specified in Article 26(1)(a) to (e) of the capital requirements regulation ”;

(b) in paragraph 4 for “the following items” to the end substitute “ own funds as defined in Article 4(1)(18) of the capital requirements regulation, and are to be calculated in accordance with paragraphs 9 to 12. ”;

(c) omit paragraphs 5 to 8 and the heading preceding paragraph 7;

(d) for paragraph 9 substitute—

“9.   For the purposes of calculating own funds—

(a) the amount of Tier 2 capital must be equal to or less than one third of the amount of Tier 1 capital;

(b) at least 75% of the amount of Tier 1 capital must be in the form of Common Equity Tier 1 capital.”;

(e) in paragraph 13(a) after “payment services” insert “ specified in paragraph 1(a) to (f) of Schedule 1 of the Payment Services Regulations 2017. ”;

(f) in paragraph 21(4)—

(i) in paragraph (a) for “2009” substitute “ 2017 ”;

(ii) omit paragraph (b);

(iii) in paragraph (c) after “payment service” insert “ specified in paragraph 1(a) to (e) of Schedule 1 to those Regulations ”.

(31) In Schedule 3 (application and modification of legislation)—

(a) after paragraph 2 (the tribunal) insert—

“Authority rules

2A.— (1) Section 137A of the 2000 Act applies for the purposes of these Regulations as if—

(a) references to authorised persons were references to authorised electronic money institutions, small electronic money institutions and EEA authorised electronic money institutions;

(b) in subsection (1)—

(i) the reference in paragraph (a) to the carrying on of regulated activities were to the issuance of electronic money, and

(ii) the reference in paragraph (b) to the carrying on of activities which are not regulated activities were to the carrying on of activities in connection with the issuance of electronic money;

(c) in subsection (5)—

(i) references to EEA firms were to EEA authorised issuance of electronic money institutions;

(ii) in paragraph (a), reference to permission conferred by Part 2 of Schedule 3 to the 2000 Act were to permission conferred by regulation 29A(2) of these Regulations;

(iii) in paragraph (b), reference to any of the single market directives or the emission allowance auctioning regulation were to the electronic money directive;

(c) after subsection (5) there were inserted—

“(6) The FCA may make a rule pursuant to paragraph (1) only if the FCA is also making, or has made, a rule under this section or section 137R concerning the same matter which applies to authorised persons in connection with the issuance of electronic money.”.

(2) Sections 137T (general supplementary powers) and 141A (power to make consequential amendments of references to rules) and Chapter 2 of Part 9A (rules: modification, waiver, contravention and procedural provisions) of the 2000 Act apply in relation to rules made pursuant to paragraph (1) as they do in relation to other rules made by the FCA under section 137A of the 2000 Act, subject to sub-paragraph (3).

(3) Section 138D (actions for damages) applies as if in that section subsection (6) were omitted and “private person” had the meaning given in regulation 72(3) of these Regulations.”.

(b) after paragraph 4 (control over electronic money institutions) insert—

“Incoming firms: interventions by the Authority

4A.— (1) Part 13 of the 2000 Act (incoming firms: intervention by FCA or PRA) applies with the following modifications.

(2) References to—

(a) “the regulator” or “the appropriate regulator” are to be read as references to the Authority;

(b) requirements imposed by or under the 2000 Act are to be read as references to requirements imposed by or under these Regulations.

(3) Section 193 (interpretation) is to be read as if—

(a) in subsection (1), for the definition of “incoming firm” there were substituted—

““incoming firm” means an EEA authorised electronic money institution which is exercising, or has exercised, its right to provide services in the United Kingdom in accordance with the Electronic Money Regulations 2011;”,

(b) subsection (1A) were omitted; and

(c) for subsection (2) there were substituted—

“(2) Expressions used in this Part and in the Payment Services Regulations 2017 have the same meaning in this Part as they have in those Regulations.”.

(4) Section 194 (general grounds on which power of intervention is exercisable) is to be read as if subsections (1)(c)(ii) and (1AA) to (5) were omitted.

(5) Sections 194A to 194C, 195A, 195B, 198 to 199A and 201 are to be ignored.

(6) Section 195 (exercise of power in support of overseas regulator) is to be read as if—

(a) subsection (2A) were omitted; and

(b) in subsection (5)(b), the reference to an EEA firm's EEA authorisation were a reference to an EEA authorised electronic money institution's authorisation under the electronic money directive.

(7) Section 196 (the power of intervention) is to be read as if—

(a) in subsection (1), for paragraphs (a) and (b) there were substituted—

“(a) the firm were an authorised electronic money institution; and

(b) the FCA were entitled to exercise its power under regulation 12 of the Electronic Money Regulations 2011 (variation of authorisation on Authority's own initiative) by imposing a requirement such as may, under regulation 7 of those Regulations (imposition of requirements) be included in an authorisation under those Regulations.”; and

(b) subsection (3) were omitted.

(8) Section 202 (contravention of requirement) is to be read as if for subsection (2) there were substituted—

“(2) Regulation 72 of the Electronic Money Regulations 2011 (right to bring actions) applies to the contravention as if it were a contravention of Part 5 of those Regulations.”.”.

Marginal Citations

M1 S.I. 2011/99, amended by S.I. 2011/2742, 2012/1791, 2013/429, 479, 1881 and 3115, 2014/366, 2015/575 and 2016/163 and 937.

M2 OJ L 331, 15.12.2010, p.12.

M3 S.I. 1999/2979. The definitions of “default arrangements” and “transfer order” in regulation 2(1) were amended by S.I. 2010/2993 and 2013/504.

M4 OJ L 331, 15.12.2010, p.12.

M5 OJ L 319 5.12.2007, p.1. The Directive is repealed with effect from 13 January 2018 by Directive 2015/2366/EU.