S.I. No. 6/2018 - European Union (Payment Services) Regulations 2018

• (c) not discriminate between payment orders transmitted through the services of a payment initiation service provider, in particular as regards timing, priority or charges in respect of payment orders transmitted directly by the payer, unless there are objective reasons for such discrimination.

• (6) The provision of a payment initiation service shall not be dependent on the existence of a contractual relationship between a payment initiation service provider and an account servicing payment service provider for that purpose.

• (7) This Regulation does not apply where the payment service provider is a credit union.

Rules on access to and use of payment account information in the case of account information services

• (2) The right referred to in paragraph (1) shall not apply where the payment account is not accessible online.

• (3) An account information service provider shall—

• (a) provide services only where a payment service user has given his or her explicit consent thereto,

• (b) ensure that the personalised security credentials of a payment service user—

• (i) are not, with the exception of the user and the issuer of the personalised security credentials, accessible to other parties, and

• (ii) are transmitted by the account information service provider by safe and efficient means,

• (c) for each communication session, identify itself to the account servicing payment service provider of the payment service user concerned and securely communicate with the account servicing payment service provider and the payment service user, in accordance with the regulatory technical standards specifying the requirements referred to in point (d) of Article 98(1) of the Payment Services Directive,

• (d) access information from payment accounts and associated payment transactions only in accordance with the explicit consent of the payment service user concerned,

• (e) not request sensitive payment data linked to the payment accounts of a payment service user, and

• (f) not use, access or store any data for purposes other than the performance of the account information service explicitly requested by a payment service user, in accordance with data protection rules.

• (4) An account servicing payment service provider shall, in respect of payment accounts—

• (a) communicate securely with an account information service provider in accordance with the regulatory technical standards specifying the requirements referred to in point (d) of Article 98(1) of the Payment Services Directive, and

• (b) not discriminate against data requests transmitted through the services of an account information service provider, unless there are objective reasons for so doing.

• (5) The provision of account information services shall not be dependent on the existence of a contractual relationship between an account information service provider and an account servicing payment service provider for that purpose.

• (6) This Regulation does not apply where the payment service provider is a credit union.

Limits of the use of the payment instrument and of the access to payment accounts by payment service providers

• (2) If agreed in a framework contract, the payment service provider concerned may reserve the right to block a payment instrument for objectively justified reasons relating to—

• (a) the security of the payment instrument,

• (b) the suspicion of unauthorised or fraudulent use of the payment instrument, or

• (c) in the case of a payment instrument with a credit line, a significantly increased risk that the payer concerned may be unable to fulfil its liability to pay.

• (3) Where a payment instrument is blocked in accordance with paragraph (2), the payment service provider concerned shall inform the payer concerned in an agreed manner of the blocking of the payment instrument and the reasons for it, where possible, before the payment instrument is blocked and at the latest immediately after it is blocked, unless providing such information would compromise objectively justified security measures or is unlawful.

• (4) Where a payment instrument is blocked in accordance with paragraph (2), the payment service provider concerned shall unblock the payment instrument or replace the instrument with a new payment instrument as soon as the reasons for blocking no longer apply.

• (5) An account servicing payment service provider may deny an account information service provider or a payment initiation service provider access to a payment account for objectively justified and duly evidenced reasons relating to unauthorised or fraudulent access to the payment account by that account information service provider or that payment initiation service provider, including the unauthorised or fraudulent initiation of a payment transaction.

• (6) Where access to a payment account is denied by an account servicing payment service provider in accordance with paragraph (5), the account servicing payment service provider shall inform the payer concerned—

• (a) that access to the payment account is denied, and

• (b) the reasons why access has been denied,

in the form agreed.

• (7) An account servicing payment service provider shall provide the information referred to in paragraph (6) to the payer concerned, where possible, before access is denied and at the latest immediately after access is denied, unless providing such information would compromise objectively justified security measures or is unlawful.

• (8) Where access to a payment account is denied by an account servicing payment service provider in accordance with paragraph (5), the account servicing payment service provider shall allow access to the payment account as soon as the reasons for denying access no longer apply.

• (9) Where access to a payment account is denied by an account servicing payment service provider in accordance with paragraph (5), the account servicing payment service provider shall immediately report this to the Bank, including the reasons for denying access and other relevant details.

• (10) Where the Bank receives a report in accordance with paragraph (9), it shall assess the information received and shall, if necessary, take such measures, available to it under this or any other law of the State, as it considers appropriate in the circumstances.

Obligations of the payment service user in relation to payment instruments and personalised security credentials

• (a) use the payment instrument in accordance with the terms governing the issue and use of the payment instrument, which must be objective, non-discriminatory and proportionate, and

• (b) notify the payment service provider concerned, or an entity specified by the latter for that purpose, without undue delay on becoming aware of the loss, theft, misappropriation or unauthorised use of the payment instrument.

• (2) For the purposes of paragraph (1) (a), the payment service user concerned shall, in particular, as soon as it is in receipt of a payment instrument, take all reasonable steps to keep its personalised security credentials safe.

Obligations of the payment service provider in relation to payment instruments

• (a) ensure that the personalised security credentials of the payment instrument are not accessible to parties other than the payment service user that is entitled to use the payment instrument,

• (b) refrain from sending an unsolicited payment instrument, except where a payment instrument already given to a payment service user is to be replaced,

• (c) ensure that appropriate means are available at all times to enable the payment service user concerned to make a notification pursuant to Regulation 93(1) (b) or to request the unblocking of a payment instrument pursuant to Regulation 92(4),

• (d) on request, provide the payment service user concerned with the means to prove, for 18 months after notification, that the payment service user made a notification referred to in subparagraph (c),

• (e) provide the payment service user concerned with an option to make a notification pursuant to Regulation 93(1) (b) free of charge and charge, if at all, only replacement costs directly attributed to the payment instrument,

• (f) prevent all use of the payment instrument concerned once notification pursuant to Regulation 93(1) (b) has been made.

• (2) A payment service provider shall bear the risk of sending a payment instrument or any personalised security credentials relating to it to a payment service user.

• (3) Paragraph (1) (a) is without prejudice to the obligations of the payment service user concerned under Regulation 93.

Notification and rectification of unauthorised or incorrectly executed payment transactions

• (2) The time limit for notification under paragraph (1) does not apply where the payment service provider concerned has failed to provide or make available the information on the payment transaction in accordance with Part 3.

• (3) Where a payment initiation service provider is involved in an unauthorised or incorrectly executed payment transaction, the payment service user concerned shall obtain rectification from the account servicing payment service provider concerned pursuant to paragraph (1), without prejudice to Regulation 97(2) and (3) and Regulation 112(1) to (8).

Evidence on authentication and execution of payment transactions

• (2) Where a payment transaction is initiated through a payment initiation service provider, the burden shall be on the payment initiation service provider to prove that within its sphere of competence, the payment transaction was authenticated, accurately recorded and not affected by a technical breakdown or other deficiency linked to the payment service of which it is in charge.

• (3) Where a payment service user denies having authorised an executed payment transaction, the use of a payment instrument recorded by the payment service provider, including a payment initiation service provider as appropriate, shall in itself not necessarily be sufficient to prove either that the payment transaction was authorised by the payer or that the payer acted fraudulently or failed with intent or gross negligence to fulfil one or more of the obligations under Regulation 93.

• (4) A payment service provider, including, where appropriate, a payment initiation service provider, shall provide supporting evidence to prove fraud or gross negligence on the part of a payment service user.

Payment service provider’s liability for unauthorised payment transactions

97.(1) Notwithstanding Regulation 95 and subject to paragraph (2), where a payment transaction is not authorised, the payer’s payment service provider shall—

• (a) refund the payer the amount of the unauthorised payment transaction immediately, and in any event not later than the end of the business day immediately following the date that the payer’s payment service provider notes or is notified of the transaction, except where the payer’s payment service provider has reasonable grounds for suspecting fraud and communicates those grounds to the relevant national authority in writing,

• (b) where applicable, restore the debited payment account to the state in which it would have been had the unauthorised payment transaction not taken place, and

• (c) ensure that the credit value date for the payer’s payment account shall be no later than the date the amount was debited.

• (2) Where a payment transaction is not authorised and the payment transaction is initiated through a payment initiation service provider, the account servicing payment service provider concerned shall refund immediately, and in any event no later than by the end of the business day immediately following the date that the account servicing payment service provider notes or is notified of the transaction, the amount of the unauthorised payment transaction and, where applicable, restore the debited payment account to the state in which it would have been had the unauthorised payment transaction not taken place.

• (3) Where a payment initiation service provider is liable for an unauthorised payment transaction in respect of which an account servicing payment service provider has issued a refund in accordance with paragraph (2), the payment initiation service provider shall immediately compensate the account servicing payment service provider at its request for the losses incurred or sums paid as a result of the refund to the payer concerned, including the amount of the unauthorised payment transaction.

• (4) This Regulation does not affect any other right that the payer concerned may have to obtain compensation (including damages).

Payer’s liability for unauthorised payment transactions

• (2) Paragraph (1) shall not apply where—

• (a) the loss, theft or misappropriation of a payment instrument was not detectable to the payer prior to a payment, except where the payer has acted fraudulently, or

• (b) the loss was caused by an act or omission of an employee, agent or branch of a payment service provider or of an entity to which its activities were outsourced.

• (3) Notwithstanding Regulation 97, a payer shall bear all of the losses relating to an unauthorised payment transaction where the losses were incurred by the payer—

• (a) acting fraudulently, or

• (b) failing to comply with its obligations under Regulation 93 either intentionally or as a result of gross negligence on its part.

• (4) Where a payer’s payment service provider does not require strong customer authentication, the payer shall not bear any financial losses relating to an unauthorised payment transaction unless the payer has acted fraudulently.

• (5) Where a payee or the payment service provider of the payee fails to accept strong customer authentication, it shall refund the financial damage relating to an unauthorised payment transaction caused to the payer’s payment service provider.

• (6) A payer shall not bear any financial consequences resulting from use of a lost, stolen or misappropriated payment instrument after notification in accordance with Regulation 93(1) (b), except where the payer has acted fraudulently.

• (7) Where a payment service provider does not provide appropriate means for the notification at all times of a lost, stolen or misappropriated payment instrument, as required under Regulation 94(1) (c), the payer shall not be liable for the financial consequences resulting from the use of that payment instrument, except where the payer has acted fraudulently.

Payment transactions where the transaction amount is not known in advance

• (2) The payer’s payment service provider shall release the funds blocked on the payer’s payment account under paragraph (1) without undue delay after receipt of information about the exact amount of the payment transaction and at the latest immediately after receipt of the payment order.

Refunds for payment transactions initiated by or through a payee

• (a) the authorisation did not specify the exact amount of the payment transaction when the authorisation was made;

• (b) the amount of the payment transaction exceeded the amount the payer could reasonably have expected taking into account the previous spending pattern, the conditions in the framework contract concerned and any other relevant circumstances.

• (2) At the payment service provider’s request, a payer shall bear the burden of proving the conditions referred to in paragraph (1) are satisfied.

• (3) A refund under paragraph (1) shall be of the full amount of the executed payment transaction.

• (4) The credit value date for the payment account of a payer refunded under paragraph (1) shall be no later than the date the amount was debited.

• (5) Without prejudice to paragraph (7), in addition to the rights referred to in paragraphs (1) to (4), for direct debits as referred to in Article 1 of Regulation (EU) No 260/2012 of the European Parliament and of the Council of 14 March 2012¹⁸ , a payer has an unconditional right to a refund within the time limits laid down in Regulation 101.

• (6) For the purposes of paragraph (1) (b), a payer shall not rely on reasons relating to currency exchange if the reference exchange rate agreed with its payment service provider in accordance with Regulation 69(1) (d) and Regulation 76(c) (ii) was applied.

• (7) A payer and a payment service provider may agree in a framework contract that the payer has no right to a refund where—

• (a) the payer has given consent to execute the payment transaction directly to the payment service provider, and

• (b) where applicable, information on the future payment transaction was provided or made available in an agreed manner by the payment service provider or the payee to the payer not less than 4 weeks before the due date.

Requests for refunds for payment transactions initiated by or through a payee

• (2) Within 10 business days of receiving a request for a refund, a payment service provider shall either refund the full amount of the payment transaction or provide reasons for refusing the refund and indicate the bodies to which the payer may refer the matter in accordance with Regulations 121, 124 and 125 if the payer does not accept the reasons provided.

• (3) A payment service provider’s right to refuse a refund under paragraph (2) shall not apply where a payer has a right to a refund in accordance with Regulation 100(5).

Chapter 3 Execution of payment transactions

Receipt of payment orders

• (2) A payment service provider shall not debit the account of the payer concerned prior to receipt of a payment order.

• (3) Where the time of receipt of a payment order is not on a business day for the payment service provider of the payer concerned, the payment order shall be deemed to have been received on the following business day.

• (4) A payment service provider may establish a cut-off time near the end of a business day beyond which any payment order received shall be deemed to have been received on the following business day.

• (5) Where a payment service user initiating a payment order agrees with the payment service provider concerned that execution of the payment order shall start—

• (a) on a specific day,

• (b) at the end of a certain period, or

• (c) on the day on which the payer has put funds at the payment service provider’s disposal,

the time of receipt for the purposes of Regulation 107 is deemed to be the day agreed upon.

• (6) Where the day agreed in accordance with paragraph (5) is not a business day for the payment service provider, the payment order shall be deemed to have been received on the following business day.

Refusal of payment orders

• (2) A payment service provider shall provide or make available the notification referred to in paragraph (1) in an agreed manner at the earliest opportunity, and in any case, within the periods specified in Regulation 107.

• (3) A framework contract may include a condition that the payment service provider concerned may charge a reasonable fee for a refusal referred to in paragraph (1) if the refusal is objectively justified.

• (4) Where all of the conditions set out in a payer’s framework contract are satisfied, the payer’s account servicing payment service provider shall not refuse to execute an authorised payment order irrespective of whether the payment order is initiated by a payer, including through a payment initiation service provider, or by or through a payee, unless prohibited by law.

• (5) For the purposes of Regulations 107 and 112 a payment order for which execution has been refused shall be deemed not to have been received.

Irrevocability of a payment order

• (2) Where a payment transaction is initiated by a payment initiation service provider or by or through a payee, the payer concerned shall not revoke the payment order concerned after the payer has given consent—

• (a) to the payment initiation service provider to initiate the payment transaction, or

• (b) to the payee to execute the payment transaction.

• (3) In the case of a direct debit and without prejudice to any right to a refund, a payer may revoke the relevant payment order at the latest by the end of the business day preceding the day agreed for debiting the funds.

• (4) Where Regulation 102(5) applies, the payment service user concerned may revoke a payment order at the latest by the end of the business day preceding the day agreed under that paragraph.

• (5) A payment order may only be revoked—

• (a) in a case in which a time limit specified in paragraphs (1) to (4) has been exceeded, but neither paragraph (2) nor paragraph (3) applies, where the payment service user and the relevant payment service provider agree to its revocation, or

• (b) in a case in which a time limit specified in paragraphs (1) to (4) has been exceeded and paragraph (2) or (3) applies, where the payment service user, the relevant payment service provider and the relevant payee agree to its revocation.

• (6) If agreed in a framework contract, the relevant payment service provider may charge for revocation.

Amounts transferred and amounts received

• (2) A payee and a payment service provider may agree that the payment service provider may deduct its charges from the amount transferred before crediting it to the payee, in which case the full amount of the payment transaction and charges shall be separated in the information given to the payee.

• (3) Where any charges other than those referred to in paragraph (2) are deducted from an amount transferred, the payment service provider of the payer concerned shall ensure that the payee concerned receives the full amount of the payment transaction initiated by the payer.

• (4) Where a payment transaction is initiated by or through a payee, the payment service provider of the payee shall ensure that the full amount of the payment transaction is received by the payee.

Scope of Regulations 107 to 110

• (a) payment transactions in euro, and

• (b) payment transactions involving only one currency conversion between the euro and the currency of a Member State outside the euro area, where—

• (i) the required currency conversion is carried out in that Member State, and

• (ii) in the case of a cross-border payment transaction, the cross-border transfer takes place in euro.

• (2) Regulations 107 to 109 apply to payment transactions not referred to in paragraph (1), unless otherwise agreed between the payment service user and the payment service provider.

• (3) Where, in the case of a payment transaction not referred to in paragraph (1) which is an intra-Union payment transaction, the payment service user and the payment service provider agree a period longer than that set out in Regulation 107, that period shall not exceed 4 business days following the time of receipt as referred to in Regulation 102.

• (4) Regulation 110 applies to payment transactions not referred to in paragraph (1) .

Payment transactions to a payment account

• (2) The time limit referred to in paragraph (1) is extended by a further business day for paper-initiated payment transactions.

• (3) The payment service provider of a payee shall value date and make available the amount of the payment transaction to the payee’s payment account after the payment service provider has received the funds in accordance with Regulation 110.

• (4) A payee’s payment service provider shall transmit a payment order initiated by or through the payee to the payer’s payment service provider within the time limits agreed between the payee and the payment service provider, so as to enable settlement, as far as direct debit is concerned, on the agreed due date.

Absence of payee’s payment account with the payment service provider

Cash placed on a payment account

• (2) Where a payment service user that is not a consumer places cash on a payment account with a payment service provider in the currency of that payment account, the amount shall be made available and value dated not later than the following business day after receipt of the funds.

Value date and availability of funds

• (2) The payment service provider of a payee shall ensure that the amount of a payment transaction is at the payee’s disposal immediately after that amount is credited to the payee’s payment service provider’s account where, on the part of the payee’s payment service provider, there is—

• (a) no currency conversion,

• (b) a currency conversion between the euro and a Member State currency, or

• (c) a currency conversion between two Member State currencies.

• (3) Paragraph (2) shall also apply to payments within one payment service provider.

• (4) The debit value date for a payer’s payment account shall not be earlier than the time at which the amount of the payment transaction is debited to that payment account.

Incorrect unique identifiers

• (2) Where the unique identifier provided by a payment service user is not the unique identifier of the person to whom payment was intended to be made, the payment service provider concerned shall not be liable under Regulation 112 for non-execution or defective execution of the payment transaction concerned.

• (3) Where the unique identifier provided by a payment service user is not the unique identifier of the person to whom payment was intended to be made—

• (a) the payer’s payment service provider shall make reasonable efforts to recover the funds involved in the payment transaction, and

• (b) the payee’s payment service provider shall cooperate in those efforts by communicating to the payer’s payment service provider all relevant information for the collection of funds.

• (4) Where the recovery of funds in accordance with paragraph (3) is not possible, the payer’s payment service provider shall provide to the payer, upon written request, all information available to the payer’s payment service provider and relevant to the payer in order for the payer to issue proceedings for the recovery of the funds.

• (5) Where agreed in the framework contract concerned, a payment service provider may charge the payment service user for recovery of funds.

• (6) Where a payment service user provides information in addition to that specified in Regulation 69(1) (a) or Regulation 76(b) (ii), the payment service provider shall be liable only for the execution of payment transactions in accordance with the unique identifier provided by the payment service user.

Payment service providers’ liability for non-execution, defective or late execution of payment transactions

• (2) Where, in accordance with paragraph (1), the payer’s payment service provider can prove to the payer and, where relevant, to the payee’s payment service provider that the payee’s payment service provider received the amount of the payment transaction in accordance with Regulation 107(1) and (2), the payee’s payment service provider shall be liable to the payee for the correct execution of the payment transaction.

• (3) Where a payer’s payment service provider is liable under paragraph (1), it shall, without undue delay, refund to the payer the amount of a non-executed or defective payment transaction, and, where applicable, restore the debited payment account to the state in which it would have been had the defective payment transaction not taken place.

• (4) Where a payer’s payment service provider refunds a payer in accordance with paragraph (3), the credit value date for the payer’s payment account shall be no later than the date on which the amount was debited.

• (5) Where a payee’s payment service provider is liable under paragraph (2), it shall immediately place the amount of the payment transaction at the payee’s disposal and, where applicable, credit the corresponding amount to the payee’s payment account.

• (6) Where a payee’s payment account is credited in accordance with paragraph (5), the credit value date for the payee’s payment account shall be no later than the date on which the amount would have been value dated, had the transaction been correctly executed in accordance with Regulation 110.

• (7) Where a payment transaction is executed late, the payee’s payment service provider shall ensure, upon the request of the payer’s payment service provider acting on behalf of the payer, that the credit value date for the payee’s payment account is no later than the date the amount would have been value dated had the transaction been correctly executed.

• (8) In the case of a non-executed or defectively executed payment transaction where the payment order is initiated by the payer, the payer’s payment service provider shall, regardless of liability under paragraphs (1) to (7) and free of charge for the payer, on request, make immediate efforts to trace the payment transaction and notify the payer of the outcome.

• (9) Where a payment order is initiated by or through a payee, the payee’s payment service provider shall, without prejudice to Regulations 95, 111(2), (3) and (4), and 116, be liable to the payee for correct transmission of the payment order to the payment service provider of the payer in accordance with Regulation 107(4).

• (10) Where a payee’s payment service provider is liable under paragraph (1), it shall immediately re-transmit the payment order in question to the payment service provider of the payer.

• (11) In the case of a late transmission of a payment order, the amount of the payment order shall be value dated on the payee’s payment account no later than the date the amount would have been value dated had the transaction been correctly executed.

• (12) The payment service provider of a payee shall, without prejudice to Regulations 95, 111(2), (3) and (4), and 116, be liable to the payee for handling the payment transaction in accordance with its obligations under Regulation 110.

• (13) Where a payee’s payment service provider is liable under paragraph (12), it shall ensure that the amount of the payment transaction is at the payee’s disposal immediately after that amount is credited to the payee’s payment service provider’s account.

• (14) Where the amount of a payment transaction is put at the payee’s disposal in accordance with paragraph (13), the amount shall be value dated on the payee’s payment account no later than the date the amount would have been value dated had the transaction been correctly executed.

• (15) In the case of a non-executed or defectively executed payment transaction for which a payee’s payment service provider is not liable under paragraph (9), (10) or (11), the payer’s payment service provider shall be liable to the payer concerned.

• (16) Where a payer’s payment service provider is liable under paragraph (15), the payment service provider shall, as appropriate and without undue delay, refund to the payer the amount of the non-executed or defective payment transaction and restore the debited payment account to the state in which it would have been had the defective payment transaction not taken place.

• (17) Where a payer’s payment service provider refunds a payer in accordance with paragraph (16), the credit value date for the payer’s payment account shall be no later than the date on which the amount was debited.

• (18) The obligation under paragraph (16) shall not apply to the payer’s payment service provider where the payer’s payment service provider proves that the payee’s payment service provider has received the amount of the payment transaction, including where execution of the payment transaction has been delayed.

• (19) Where paragraph (18) applies, the payee’s payment service provider shall value date the amount on the payee’s payment account no later than the date the amount would have been value dated had it been executed correctly.

• (20) In the case of a non-executed or defectively executed payment transaction where the payment order is initiated by or through a payee, the payee’s payment service provider shall, regardless of liability under paragraphs (9) to (19) and free of charge for the payee, on request, make immediate efforts to trace the payment transaction and notify the payee of the outcome.

• (21) A payment service provider shall be liable to its payment service user for any charges for which the payment service user is responsible, and for any interest to which the payment service user is subject as a consequence of non-execution or defective, including late, execution of the payment transaction.

Liability in the case of payment initiation services for non-execution, defective or late execution of payment transactions

• (2) Where a payment order is initiated by a payer through a payment initiation service provider, the burden shall be on the payment initiation service provider to prove—

• (a) that the payment order was received by the payer’s account servicing payment service provider in accordance with Regulation 102, and

• (b) to the extent that it is within the sphere of competence of the payer’s payment initiation service provider, that the payment transaction was authenticated, accurately recorded and not affected by a technical breakdown or other deficiency linked to the non-execution, defective or late execution of the transaction.

• (3) Where a payment initiation service provider is liable for the non-execution, defective or late execution of a payment transaction, it shall immediately compensate the account servicing payment service provider at its request for the losses incurred or sums paid as a result of the refund to the payer concerned.

Additional financial compensation

Right of recourse

• (2) Financial compensation in addition to that provided for under paragraph (1) may be determined in accordance with an agreement between the payment service providers concerned or the payment service provider and intermediary concerned, as the case may be, and the law applicable to that agreement.

Abnormal and unforeseeable circumstances

• (a) where, but for this Regulation, the person’s liability would have resulted from abnormal and unforeseeable circumstances beyond that person’s control, the consequences of which could not have been avoided by it, or

• (b) where the person is a payment service provider, they are subject to other legal obligations under Union law or the law of the State.

Chapter 4 Data protection

Data protection

• (2) The provision of information to individuals about the processing of personal data and the processing of such personal data and any other processing of personal data for the purposes of these Regulations shall be in accordance with—

• (a) prior to the date of application of the General Data Protection Regulation, the Data Protection Acts 1988 and 2003, and

• (b) after that date—

• (i) the General Data Protection Regulation, and

• (ii) the law of the State giving further effect to the General Data Protection Regulation.

• (3) A payment service provider shall only access, process and retain personal data necessary for the provision of its payment services, with the explicit consent of the payment service user concerned.

Chapter 5 Operational and security risks and authentication

Management of operational and security risks

• (2) As part of the framework referred to in paragraph (1), a payment service provider shall establish and maintain effective incident management procedures, including for the detection and classification of major operational and security incidents.

• (3) A payment service provider shall provide to the Bank on an annual basis, or at shorter intervals as determined by the Bank, an updated and comprehensive assessment of—

• (a) the operational and security risks relating to the payment services provided by the payment service provider, and

• (b) the adequacy of the mitigation measures and control mechanisms implemented in response to those risks.

Incident reporting

• (2) Where an incident to which paragraph (1) applies has or may have an impact on the financial interests of the payment service users of the payment service provider concerned, the payment service provider shall, without undue delay, inform its payment service users of the incident and of all measures that those users can take to mitigate the adverse effects of the incident.

• (3) The Bank shall, following receipt of a notification referred to in paragraph (1), without undue delay, provide the relevant details of the incident to the European Banking Authority and to the European Central Bank.

• (4) The Bank shall, following receipt of a notification referred to in paragraph (1) and after assessing the relevance of the incident concerned to relevant authorities of the State, notify those authorities accordingly.

• (5) Where the Bank receives a notification from the European Central Bank under Article 96 of the Payment Services Directive, the Bank shall, on the basis of that notification, where appropriate, take all of the necessary measures to protect the immediate safety of the financial system.

• (6) A payment service provider shall provide, at least on an annual basis, statistical data on fraud relating to different means of payment to the competent authority of its home Member State.

• (7) The Bank shall provide to the European Banking Authority and the European Central Bank, in an aggregated form, data received under paragraph (6).

Authentication

• (a) accesses its payment account online,

• (b) initiates an electronic payment transaction, or

• (c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.

• (2) Where a payer initiates an electronic remote payment transaction, a payment service provider shall apply strong customer authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.

• (3) Where paragraph (1) applies, a payment service provider shall have in place adequate security measures to protect the confidentiality and integrity of the personalised security credentials of the payment service user concerned.

• (4) Paragraphs (2) and (3) also apply where a payment is initiated through a payment initiation service provider.

• (5) Paragraphs (1) and (3) also apply where information is requested through an account information service provider.

• (6) An account servicing payment service provider shall permit a payment initiation service provider and an account information service provider to rely on the authentication procedures provided by the account servicing payment service provider to the payment service user in accordance with paragraphs (1) and (3) and, where the payment initiation service provider is involved, in accordance with paragraphs (1), (2) and (3).

Chapter 6 Infringements, supervision, dispute resolution and enforcement

Reporting of infringements

• (2) Where appropriate and without prejudice to any right to bring proceedings before a court, the reply from the Bank to a report submitted to it with regard to an alleged infringement of these Regulations by a payment service provider shall inform the person submitting the report of the existence of the alternative dispute resolution procedures set up in accordance with Regulation 125.

Supervision

• (a) require a payment service provider to provide any information needed to monitor the institution’s compliance with these Regulations,

• (b) carry out on-site inspections at—

• (i) the premises of a payment service provider,

• (ii) any agent or branch providing payment services under the responsibility of a payment service provider,

• (iii) the premises of any entity to which a payment service provider’s activities are outsourced, and

• (iv) any premises at which payment services are, or are suspected of being conducted, and

• (c) issue recommendations, guidelines, policy statements and codes of practice.

Bank’s power to give directions

• (a) a payment institution,

• (b) another person registered to provide payment services, or

• (c) any other person involved in or connected with the provision of a payment service,

in the State.

• (2) A direction under paragraph (1) —

• (a) takes effect on the date, or on the occurrence of the event, specified in the direction for the purpose, and

• (b) ceases to have effect on the earlier of—

• (i) the date, or the occurrence of the event, specified in the direction for the purpose, or

• (ii) the expiration of the period of 12 months immediately following the day on which it took effect.

• (3) If a direction under this Regulation has not been complied with or is unlikely to be complied with, the Bank may apply to the court in a summary manner for such order as the court thinks appropriate by way of enforcement of the direction.

Dispute resolution

• (2) A complaint resolution procedure referred to in paragraph (1) which applies in the State shall be available in Irish or English or, where another language is agreed between a payment service provider and a payment service user, that language.

• (3) A payment service provider shall make every possible effort to reply, on paper or, if agreed between the payment service provider and a payment service user, on another durable medium, to the payment service users’ complaints.

• (4) A reply from a payment service provider to a complaint from a payment service user shall address all points raised in the complaint, within an adequate timeframe and at the latest within 15 business days of receipt of the complaint.

• (5) Where, in an exceptional situation, a payment service provider is unable to comply with paragraph (4) for reasons beyond the control of the payment service provider, the payment service provider shall send a reply to the payment service user clearly indicating the reasons for a delay in answering the complaint and specifying the deadline by which the payment service user will receive a reply in compliance with paragraph (4).

• (6) Where, in an exceptional situation, a payment service provider is unable to comply with paragraph (4) for reasons beyond the control of the payment service provider, the payment service provider shall send a final reply to the payment service user concerned, addressing all points raised in the complaint, at the latest within 35 business days of receipt of the complaint.

• (7) Notwithstanding paragraphs (3) to (6), where the Bank introduces or maintains rules on dispute resolution procedures that are applicable to the complaint and parties concerned and more advantageous to the payment service user than the obligations specified in those paragraphs, those rules shall apply in place of paragraphs (3) to (6).

• (8) Where the Bank has not introduced or maintained rules on dispute resolution procedures that are applicable to the complaint, paragraphs (3) to (6) will not apply in a case in which—

• (a) the complaint has been resolved to the complainant’s satisfaction within five business days of receipt of the complaint, and

• (b) a record of the resolution of the complaint to the satisfaction of the complainant is maintained by the payment service provider.

• (9) A payment service provider shall inform a payment service user of at least one ADR entity which is competent to deal with disputes concerning the rights and obligations arising under Parts 3 and 4.

• (10) A payment service provider shall—

• (a) provide the information referred to in paragraph (9), and

• (b) inform the payment service user how further information on the ADR entity concerned and on the conditions for using it can be accessed,

in a clear, comprehensive and easily accessible way on the website of the payment service provider concerned, where one exists, at the branch, and in the general terms and conditions of the contract between the payment service provider and the payment service user.

• (11) A reference in paragraph (9) or (10) to an ADR entity includes, where applicable, a reference to the Financial Services and Pensions Ombudsman.

Alternative dispute resolution procedures

• (2) The Financial Services and Pensions Ombudsman shall cooperate effectively in the resolution of cross-border disputes concerning the rights and obligations arising under Parts 3 and 4.

Offence — operation as a payment institution without authorisation, etc.

Offence — false or misleading information in application

• (a) knowingly or recklessly makes a false or misleading statement in an application for authorisation to operate as a payment institution, or

• (b) makes a false or misleading statement to the Bank in relation to—

• (i) the obtaining of an authorisation to operate as a payment institution, or

• (ii) an approval, waiver or permission from the Bank concerning the operation of a payment institution.

Offence — misappropriation of users’ funds

Offence — failure to inform Bank of relevant changes, etc.

Offence — failure to keep appropriate records

Offence — provision of false or misleading information under Regulation 122(a)

Prosecution of offences

• (2) Notwithstanding section 10(4) of the Petty Sessions (Ireland) Act 1851 , summary proceedings for an offence under these Regulations may be instituted—

• (a) at any time within 3 years from the date on which the offence was committed,

• (b) where, at the expiry of that period, the person against whom the proceedings are to be brought is outside the State, within 6 months of the date on which he or she next enters the State, or

• (c) at any time within 3 years from the date on which evidence that, in the opinion of the person by whom the proceedings are brought, is sufficient to justify the bringing of the proceedings, comes to that person’s knowledge,

whichever is the later, provided that no such proceedings shall be commenced later than 5 years from the date on which the offence concerned was committed.

• (3) For the purpose of this Regulation, a certificate signed by or on behalf of or jointly with the person bringing the proceedings as to the date on which evidence relating to the offence concerned came to his or her knowledge shall be prima facie evidence and in any legal proceedings a document purporting to be a certificate issued for the purpose of this subsection and to be so signed shall be deemed to be so signed and shall be admitted as evidence without proof of the signature of the person purporting to sign the certificate.

Publication of information

Penalties

• (a) on summary conviction, to a class A fine or to imprisonment for a term not exceeding 6 months, or to both, or

• (b) on conviction on indictment, to a fine not exceeding €500,000 or to imprisonment for a term not exceeding 3 years, or to both.

Offences by bodies corporate and managers etc.

• (a) a director, manager, secretary or other officer of the body corporate, or

• (b) a person who was purporting to act in any such capacity,

that person as well as the body corporate shall be guilty of an offence and shall be liable to be proceeded against and punished as if that person were guilty of the first-mentioned offence.

PART 5 Consumer Rights Information

Obligation to inform consumers of their rights

• (2) A payment service provider shall ensure that the leaflet produced by the Commission of the European Union in accordance with Article 106(1) of the Payment Services Directive is made available—

• (a) in an easily accessible manner on its website (if any), and

• (b) in paper form at its branches (if any), agents (if any) and any entity to which its activities are outsourced.

• (3) A payment service provider shall not charge its clients for making available the information referred to in paragraph (2).

• (4) The Bank and payment service providers shall ensure that the leaflet produced by the Commission of the European Union in accordance with Article 106(1) of the Payment Services Directive is made available in an accessible format to persons with disabilities.

PART 6 Final Provisions

Derogation

• (2) A payment service provider may provide its services to payment service users on more favourable terms than is provided for under these Regulations.

Revocation

Saver

• (a) does not affect any investigation undertaken, or disciplinary or enforcement action undertaken by the Bank or any other person, in respect of any matter in existence at, or before, the time of the revocation, and

• (b) does not preclude the taking of any legal proceedings, or the undertaking of any investigation, or disciplinary or enforcement action by the Bank or any other person, in respect of any contravention of the Regulations of 2009 or any misconduct which may have been committed before the time of the revocation.

Transitional provisions

• (a) shall be permitted to continue those activities in accordance with those Regulations, and

• (b) shall not be required to seek authorisation in accordance with Regulation 7 or to comply with the other provisions of, or referred to in, Part 2,

until 13 July 2018.

• (2) A payment institution to which paragraph (1) applies shall submit all relevant information to the Bank in a timely manner in order to allow the Bank to assess whether the payment institution complies with its requirements under Part 2 and, if not, which measures need to be taken in order to ensure compliance or whether a withdrawal of authorisation is appropriate.

• (3) The Bank shall complete the assessment referred to in paragraph (2) by 13 July 2018.

• (4) Where the Bank is satisfied that a payment institution to which paragraph (1) applies complies with the institution’s obligations under Part 2, the Bank shall grant an authorisation to the payment institution and enter in the Register the information required under Regulation 25 in respect of the payment institution.

• (5) Where the Bank is not satisfied by 13 July 2018 that a payment institution to which paragraph (1) applies complies with the institution’s obligations under Part 2, the payment institution shall, in accordance with Regulation 6, be prohibited from providing payment services.

• (6) Where a person is granted a waiver under Regulation 35(2) of the Regulations of 2009 prior to 13 January 2018 and pursued payment services within the meaning of those Regulations prior to that date, the person—

• (a) shall be permitted to continue those activities within the State in accordance with those Regulations, and

• (b) shall not be required to seek authorisation under Regulation 7 or, to obtain an exemption pursuant to Regulation 41, or to comply with the other provisions of, or referred to in, Part 2,

until 13 January 2019.

• (7) A person to whom paragraph (6) applies who has not, by 13 January 2019, been authorised or exempted under these Regulations shall, in accordance with Regulation 6, be prohibited from providing payment services.

• (8) Notwithstanding paragraphs (1) to (4), a payment institution that has been granted authorisation to provide payment services as referred to in paragraph 7 of Schedule 1 to the Regulations of 2009 shall retain that authorisation for the provision of those payment services which are considered to be payment services as referred to in paragraph 3 of the Schedule where, by 13 January 2020, the Bank has evidence that the requirements laid down in Regulation 8(1) (c) and in Regulations 11 to 16 have been complied with.

• (9) Where a person has provided the payment service referred to in paragraph 7 of the Schedule in the State prior to 12 January 2016, that person shall not be required to seek authorisation in accordance with Regulation 7 or to comply with the other provisions of, or referred to in, Part 2 until the date that is 18 months from the date that the regulatory technical standards referred to in Article 98 of the Payment Services Directive enter into force.

• (10) Where a person has provided the payment service referred to in paragraph 8 of the Schedule in the State prior to 12 January 2016, that person shall not be required to be registered in accordance with Regulation 42 or to comply with the other provisions of, or referred to in, Part 2 until the date that is 18 months from the date that the regulatory technical standards referred to in Article 98 of the Payment Services Directive enter into force.

Amendment of European Communities (Distance Marketing of Consumer Financial Services) Regulations 2004

• (a) in paragraph (1), by the substitution of “Subject to paragraph (1A), within a reasonable time” for “Within a reasonable time”, and

• (b) by the insertion of the following paragraph after paragraph (1) :

• “(1A) Where the European Union (Payment Services) Regulations 2018 also apply, the supplier shall, within a reasonable time before a consumer is bound by a distance contract for the supply of a financial service, give the consumer—

  • (a) the information specified in paragraphs (j), (k), (l), (m), (n), (o), (r), (s) and (x) of Schedule 1, and

  • (b) the information required to be provided under Regulations 68, 69, 75 and 76 of those Regulations.”.

Amendment of European Communities (Electronic Money) Regulations 2011

• (a) in Regulation 3(1) —

• (i) by the insertion of the following definitions:

“ ‘account information service’ has the same meaning as it has in the Payment Services Regulations 2018;

‘Directive (EU) 2015/849’ means of the European Parliament and of the Council of 20 May 2015¹⁹ on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC;

‘European Banking Authority’ means the European Banking Authority established by Regulation (EU) 1093/2010 of the European Parliament and of the Council of 24 November 2010²⁰ establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC;

‘payment initiation service’ has the same meaning as it has in the Payment Services Regulations;

‘payment service provider’ has the same meaning as it has in the Payment Services Regulations;

‘Regulation (EU) No 1093/2010’ means Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC²¹ ;

‘sensitive payment data’ means information, including personalised security credentials, which could be used to carry out fraud; but in relation to account information services and payment initiation services does not include the name of an account holder or an account number;”,

• (ii) by the substitution of the following definition for the definition of “Payment Services Directive”:

“ ‘Payment Services Directive’ means Directive 2015/2366/EU of the European Parliament and of the Council of 25 November 2015²² on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No. 1093/2010, and repealing Directive 2007/64/EC;”, and

• (iii) by the substitution of the following definition for the definition of “Payment Services Regulations”:

“ ‘Payment Services Regulations’ means the European Union (Payment Services) Regulations 2018 ( S.I. No. 6 of 2018 );”,

• (b) in Regulation 7, by the insertion of the following paragraphs after paragraph (2):

• “(2A) The Bank shall enter in the Register any withdrawal of an authorisation and any withdrawal of a waiver pursuant to Regulation 36.

• (2B) The Bank shall notify the European Banking Authority of the reasons for the withdrawal of any authorisation and of any waiver pursuant to Regulation 36.”,

• (c) by the insertion of the following Regulation after Regulation 7:

“European Banking Authority Register

7A. (1) Where information is entered in the Register, the Bank shall, without delay and in a language customary in the field of finance, send a notification to the European Banking Authority informing it of the information so entered.

• (2) The Bank shall ensure that the information provided to the European Banking Authority under paragraph (1) is accurate and up-to-date.”,

• (d) in Regulation 8—

• (i) in paragraph (1) —

• (I) by the substitution of the following subparagraph for subparagraph (f) :

• “(f) for applicants subject to the obligations in relation to money laundering and terrorist financing under Directive (EU) 2015/849 and Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 2015²³ , a description of the internal control mechanisms which the applicant has established in order to comply with those obligations,”,

• (II) by the substitution of the following subparagraph for subparagraph (g) :

• “(g) a description of the applicant’s structural organisation, including, where applicable, a description of the intended use of agents and branches and of the off-site and on-site checks that the applicant undertakes to perform on them at least annually, as well as a description of outsourcing arrangements, and of its participation in a national or international payment system,”,

• (III) in subparagraph (k), by the substitution of “documents,” for “documents, and”,

• (IV) in subparagraph (l), by the substitution of “office,” for “office.”, and

• (V) by the insertion of the following subparagraphs after subparagraph (l) :

• “(m) a description of the procedure in place to monitor, handle and follow up a security incident and security related customer complaints, including an incidents reporting mechanism,

• (n) a description of the process in place to file, monitor, track and restrict access to sensitive payment data,

• (o) a description of business continuity arrangements including a clear identification of the critical operations, effective contingency plans and a procedure to regularly test and review the adequacy and efficiency of such plans,

• (p) a description of the principles and definitions applied for the collection of statistical data on performance, transactions and fraud,

• (q) a security policy document, including a detailed risk assessment in relation to the applicant’s payment services and a description of security control and mitigation measures taken to adequately protect payment service users against the risks identified, including fraud and illegal use of sensitive and personal data, and

• (r) in the case of an applicant that proposes to provide payment initiation services or account information services, information on the professional indemnity insurance policy or comparable guarantee against liability it holds or proposes to put in place to cover potential liabilities in relation to the provision of such services.”,

• (ii) in paragraph (2), by the substitution of “For the purposes of subparagraphs (d), (e), (g) and (m) of paragraph (1), the applicant shall” for “The applicant shall”, and

• (iii) by the insertion of the following paragraphs after paragraph (2):