Report on the Peer Review on Authorisation under PSD 2 Released European Banking Authority

Are you looking for the Report on the Peer review on Authorisation under PSD2 released today by the European Banking Authority?  Click here or the image above to download it in PDF format.

If you are struggling with an application for an electronic money or payments institution authorisation in Europe, contact us here and/or complete the Authorisation/Licence Enquiry Form here.

If you are looking at becoming authorised in Ireland as an emoney institution or payments institution check out Fintech Ireland's and CompliReg's authorisation guides here.

What does the EBA peer review say?

The report sets out the findings of the EBA’s peer review on the authorisation of #Payment Institutions (PIs) and #ElectronicMoney Institutions (EMIs). In executive summary format, the report says:

• competent authorities (CAs) have largely implemented the Guidelines and, where implemented, the Guidelines have achieved their objective of providing consistency and transparency in the authorisation information that prospective PIs and EMIs have to submit.
• some CAs have not fully implemented the Guidelines, in particular in relation to obtaining the full set of information from applicants. This potentially limits the extent to which those CAs can scrutinise applications compared with having the information required under the Guidelines. 
• significant divergences in the practices of CAs in assessing the information submitted, and the level of scrutiny of those documents varies considerably across CAs.
• there are divergent practices in relation to the assessment of business plans and applicants’ governance arrangements and internal control mechanisms. This includes the assessment of directors and persons responsible for the management of PIs and EMIs, and of whether applicants meet the requirement in PSD2 to have their head office in the jurisdiction where they are seeking authorisation and to conduct part of their activities there (‘local substance’). 
• these deficiencies mean that applicants remain subject to different supervisory expectations as regards the requirements for authorisation as a PI or EMI across the EEA. This gives rise to issues in terms of supervisory level playing field and ‘forum shopping’ and undermines the objectives of the Directive and the Guidelines of establishing a single EU payments market. 
• all CAs should ensure that applicants have a ‘three lines of defence’ model that includes the functions of risk management, compliance and internal audit, where the nature, scale and complexity of their activities makes this appropriate.
• to minimise potential forum shopping and ensure sufficient local substance, all CAs should ensure that applicants are effectively managed and controlled from the jurisdiction in which they seek authorisation, and have close links with that jurisdiction. 
• all CAs should ensure that applicants are effectively managed and controlled from the jurisdiction in which they seek authorisation, and have close links with that jurisdiction.
• significant variations in the resources available and length of the authorisation process
• average duration ranges from 4-6 months to 20 months or more. The main reason for delays is the quality of applications and applicants’ timeliness in addressing issues identified. Other reasons identified for these variations across CAs include different timelines set out in national laws and different procedural approaches in the acceptance and assessment of applications.
•  all CAs are asked to follow-up by reviewing their resources and processes to ensure that they remain adequate to scrutinise applications within a reasonable timescale.

Some good supervisory practices observed by the EBA

Some good supervisory practices observed during the analysis that might be of benefit for other CAs to adopt.

• publishing guidance to clarify the requirements CAs expect applicants must meet;
  
• comparing applicants’ forecasts against data from existing similar PIs/EMIs to inform the CAs’ assessment of the plausibility of the financial forecasts;
  
• making use of existing EBA and EBA/ESMA guidelines under the Capital Requirements Directive to assess independence of the internal control functions and suitability of the directors and persons responsible for the management of PIs and EMIs. The report also recommends that, as part of any future review of the Guidelines, the EBA provides more guidance on how the proportionality principle should be applied in assessing the suitability of shareholders having a qualifying holding in an applicant’s capital.

Some recommendations identified by the EBA

The report expands on the recommendations included in the EBA’s response to the European Commission on the review of the PSD2 (EBA/Op/2022/06) and recommends that, as part of its ongoing PSD2 review process, the European Commission:

• clarifies the delineation between the different categories of payment services as well as emoney issuance;
  
• clarifies the applicable governance arrangements for PIs and EMIs;
  
• clarifies the criteria that CAs should use in assessing the suitability of directors and persons responsible for the management of PIs and EMIs;
  
• mandates the EBA to develop a common assessment methodology for granting authorisation as a PI or as an EMI; and
  
• clarifies the requirements that applicants must meet in order to ensure sufficient local substance, leveraging on the best practices mentioned this report.

What are the objectives of the EBA report?

The objectives of this report are to:

• further strengthen consistency and convergence of the assessment of applications for authorisations of PIs and EMIs across the EEA; and
  
• assess whether the EBA Guidelines have achieved their aim of bringing about consistency and clarity in respect of the information that applicants have to submit as part of an application for authorisation and of contributing to harmonisation in the authorisation process and to a level playing field across the EEA. 

This report is also a partial fulfilment of the mandate conferred by the PSD2 on the EBA to review the Guidelines “on a regular basis and in any event at least every 3 years” (Article 5(5) PSD2).

Which competent authorities are in scope?

The peer review was performed by a Peer Review Committee of EBA and CA staff (see Annex 1 for the composition) and covered the CAs from all EU Member States and from two EEA States, as detailed in Annex 2. One EEA CA (IS) was not reviewed because it has only recently implemented the PSD2 and did not receive any application for the authorisation of PIs and EMIs in the period analysed (2019-2021). [CompliReg - not sure if IS is a typo, and should be 'SI' for Slovenia?]

The Self-Assessment model adopted by the EBA

The analysis has been conducted based on the CAs’ responses to a self-assessment questionnaire (SAQ), which covered a three-year period from 1 January 2019 to 31 December 2021. Where necessary, the PRC followed up with the CAs in writing seeking further clarifications and explanations. The PRC also conducted interviews with a subset of 10 CAs (BG, DK, ES, PL, PT, MT, NL, IT, LT and SE) to gain a better understanding of their supervisory practices.

EBA Conclusion on timeliness of the authorisation process

Page 51, para 171 "5. Conclusions and recommendations" sates:

​"​With regard to the timeliness of the authorisation process, the review found that, while all CAs comply with the requirement in Article 12 PSD2 to take a decision on an application within 3 months from receiving a complete application, the average duration of the authorisation process varies significantly across MS, ranging from 4-6 months to +20 months. The main reason for this is the quality of applications and applicants’ timeliness in addressing the issues identified with the application. The PRC also identified a number of other reasons for these variations in duration across CAs, which include different timelines set out in national law and different procedural approaches adopted by CAs in the acceptance and assessment of applications."

[CompliReg - no doubt, and there is merit here, many firms will struggle with the EBA's finding that "all CAs comply with the requirement in Article 12 PSD2 to take a decision on an application within 3 months from receiving a complete application".]

​The constitution of the 'peer review committee'? 

The Peer reviews were carried out by ad hoc peer review committees composed of staff from the EBA and members of competent authorities, and chaired by the EBA staff.

This peer review was carried out by:

• Co-chairs: Jonathan Overett Somnier Head of Legal and Compliance Unit, EBA and Larisa Tugui Senior Policy Expert, Consumer, Payments and Conduct Unit, EBA
• Members: Adrienne Coleton Legal Expert, Legal and Compliance Unit, EBA; Antonio Barzachki Senior Policy Expert, Consumer, Payments and Conduct Unit, EBA; Gabriel Bosch Senior Expert Specialised institutions and procedures, Autorité de contrôle prudentiel et de resolution; Carolin Kopyto Senior Advisor, Directorate ZK (Supervision of Payment Institutions and Crypto Custody Business), BaFin; and Reinout Temmerman Payments Advisor, Surveillance of financial market infrastructures, payment services and cyber risks, National Bank of Belgium 

 List of Competent Authorities subject to the peer review

• AT = Austrian Financial Market Authority
• BE = National Bank of Belgium
• BG = Bulgarian National Bank
• CY = Central Bank of Cyprus
• CZ = Czech National Bank
• DE = Federal Financial Supervisory Authority (BaFin)
• DK = Danish Financial Supervisory Authority
• EE = Estonian Financial Supervision and Resolution Authority
• EL = Bank of Greece
• ES = Bank of Spain
• FI = Finnish Financial Supervisory Authority
• FR = Prudential Supervisory & Resolution Authority (ACPR)
• HR = Croatian National Bank
• HU = Central Bank of Hungary
• IE = Central Bank of Ireland
• IT = Bank of Italy
• LI = Financial Market Authority Liechtenstein
• LT = Bank of Lithuania
• LU = Commission for the Supervision of the Financial Sector (CSSF)
• LV = Financial and Capital Market Commission
• MT = Malta Financial Services Authority (MFSA)
• NL = Dutch Central Bank (DNB)
• NO = Financial Supervisory Authority of Norway
• PL = Polish Financial Supervision Authority (KNF)
• PT = Bank of Portugal
• RO = National Bank of Romania
• SE = Swedish Financial Supervisory Authority
• SI = Bank of Slovenia
• SK = National Bank of Slovakia