Resolution of 13 October 2021 by the Executive Committee of the Bank of Spain modifying general clauses for TARGET2 payment module, T2S, and TIPS cash accounts

III. OTHER PROVISIONS BANK OF SPAIN 17165 Resolution of 13 October 2021, by the Executive Committee of the Bank of Spain, modifying the general clauses relating to the uniform conditions for the opening and operation of a payment module account, a T2S dedicated cash account, and a TIPS dedicated cash account in TARGET2-Bank of Spain.

Pursuant to points (a) and (h) of Article 23.1 of Law 13/1994, of 1 June, on the Autonomy of the Bank of Spain; to points (a) and (i) of Article 66.1 of the Internal Regulations of the Bank of Spain; to Clause 49 of the general clauses relating to the uniform conditions for the opening and operation of a payment module account in TARGET2-Bank of Spain, approved by resolution of the Executive Committee of the Bank of Spain of 20 July 2007; to Clause 35 of the general clauses relating to the uniform conditions for the opening and operation of a T2S dedicated cash account in TARGET2-Bank of Spain, approved by resolution of the Executive Committee of the Bank of Spain of 11 June 2015; and to Clause 32 of the general clauses relating to the uniform conditions for the opening and operation of a TIPS dedicated cash account in TARGET2-Bank of Spain, approved by resolution of the Executive Committee of the Bank of Spain of 6 November 2018; and in light of the adoption of European Central Bank Guideline (EU) 2021/1759 of 20 July 2021 amending ECB Guideline ECB/2012/27 on the Trans-European Automated Real-time Gross settlement Express Transfer system (TARGET2) (ECB/2021/30);

The Executive Committee of the Bank of Spain agrees:

First. To include the modifications set out below in the current version of the general clauses relating to the uniform conditions for the opening and operation of a payment module account in TARGET2-Bank of Spain, approved by resolution of the Executive Committee of the Bank of Spain of 20 July 2007:

1. Clause 1 (Definitions) is modified as follows: (a) A definition for the term "TIPS linked system technical account" or "TIPS LS technical account" is introduced following the definition of the term "payment module main account", which shall read as follows: "– 'TIPS linked system technical account' or 'TIPS LS technical account', an account held by a LS or a central bank on behalf of a LS in the TARGET2 constituent system of the central bank for use by the LS in order to settle immediate payments in its own books;"

(b) A definition for the term "accessible entity" is introduced following the definition of the term "investment firm", which shall read as follows: "– 'accessible entity', the entity that: (a) holds a BIC code, (b) is designated as an accessible entity by the holder of a TIPS dedicated cash account or by an LS, (c) is a correspondent, client, or branch of a holder of a TIPS dedicated cash account or a participant of an LS or a correspondent, client, or branch of a participant of an LS, and (d) is accessible via the TIPS platform and can send and receive immediate payment orders through the holder of the TIPS dedicated cash account or the LS, or directly, if authorized by the holder of the TIPS dedicated cash account or the LS;"

(c) A definition for the term "SEPA Instant Credit Transfer Scheme of the European Payments Council" or "SEPA Instant Credit Transfer Scheme" is introduced following the definition of the term "technical specifications for payment order processing", which shall read as follows: "– 'SEPA Instant Credit Transfer Scheme of the European Payments Council' or 'SEPA Instant Credit Transfer Scheme', an automated scheme with open standards that establishes a set of interbank rules that participants must comply with, which allows payment service providers in the SEPA area to offer an automated euro instant transfer product throughout the SEPA area;"

(d) The wording of paragraph (a) of the definition of "group" is modified, which shall now read as follows: "(a) a set of credit institutions included in the consolidated financial statements of a parent undertaking, where the parent undertaking is obliged to present consolidated financial statements in accordance with International Accounting Standard 27 (IAS 27), adopted by Commission Regulation (EC) No 1126/2008 of 3 November 2008 adopting certain international accounting standards in accordance with Regulation (EC) No 1606/2002 of the European Parliament and of the Council, and consisting of: (i) a parent undertaking and one or more subsidiaries, or (ii) two or more subsidiaries of a parent undertaking;"

(e) The definition of the term "immediate payment order" is modified, which shall now read as follows: "– 'immediate payment order', in accordance with the SEPA Instant Credit Transfer Scheme of the European Payments Council, a payment instruction that can be executed 24 hours a day, any calendar day of the year, with processing and notification to the immediate payer or almost immediately, and includes: (i) immediate payment orders from a TIPS dedicated cash account to another TIPS dedicated cash account, (ii) immediate payment orders from a TIPS dedicated cash account to a TIPS LS technical account, (iii) immediate payment orders from a TIPS LS technical account to a TIPS dedicated cash account, and (iv) immediate payment orders from a TIPS LS technical account to another TIPS LS technical account;"

(f) Following the definition of the term "liquidity transfer order from the TIPS dedicated cash account to the payment module", definitions for the terms "liquidity transfer order from the TIPS dedicated cash account to a TIPS LS technical account" and "liquidity transfer order from a TIPS LS technical account to a TIPS dedicated cash account" are introduced, which shall read as follows: "– 'liquidity transfer order from the TIPS dedicated cash account to a TIPS LS technical account', the instruction to transfer a specific amount of funds from a TIPS dedicated cash account to a TIPS LS technical account to finance the position of the holder of the TIPS dedicated cash account (or the position of another participant in the LS) in the LS books; – 'liquidity transfer order from a TIPS LS technical account to a TIPS dedicated cash account', the instruction to transfer a specific amount of funds from a TIPS LS technical account to a TIPS dedicated cash account to cease financing the position of the holder of the TIPS dedicated cash account (or the position of another participant in the LS) in the LS books;"

(g) The definition of the term "TIPS network service provider" is deleted.

2. Clause 3 (General description of TARGET2) is modified as follows: (a) The wording of paragraph (f quater) of section 2 is modified, which shall now read as follows: "(f quater) liquidity transfer orders from the TIPS dedicated cash account to the payment module, and liquidity transfer orders from the payment module to the TIPS dedicated cash account,"

(b) A new paragraph (f quinquies) is introduced in section 2, with the following wording: "(f quinquies) liquidity transfer orders from the TIPS dedicated cash account to a TIPS LS technical account, and liquidity transfer orders from a TIPS LS technical account to a TIPS dedicated cash account, and"

(c) The wording of section 3 is modified, which shall now read as follows: "3. TARGET2 provides for euro payments real-time gross settlement and central bank money settlement between the payment module accounts, the T2S dedicated cash accounts, and the TIPS dedicated cash accounts. TARGET2 is established and operates on the basis of the single shared platform, through which payment orders are sent and processed, and payments are finally received, in a technically identical manner. With regard to the technical operation of the T2S dedicated cash accounts, TARGET2 is established and operates technically through the T2S platform. With regard to the technical operation of the TIPS dedicated cash accounts and the TIPS LS technical accounts, TARGET2 is established and operates technically through the TIPS platform."

3. The wording of Clause 5 (Direct Participants) is modified, which shall now read as follows: "Clause 5. Direct Participants.

4. The holders of payment module accounts in TARGET2-Bank of Spain are direct participants and shall meet the requirements set out in sections 1 and 2 of the following Clause 8. Direct participants shall have at least one payment module account with the Bank of Spain. Payment module account holders who have adhered to the SEPA Instant Credit Transfer Scheme by signing the corresponding adherence agreement shall be and remain accessible on the TIPS platform at all times, either as holders of TIPS dedicated cash accounts or as accessible entities through a holder of a TIPS dedicated cash account.

5. Payment module account holders may designate accessible BIC holders regardless of where they are established. Payment module account holders may designate accessible BIC holders who have adhered to the SEPA Instant Credit Transfer Scheme by signing the corresponding adherence agreement only if such entities are accessible on the TIPS platform, either as holders of TIPS dedicated cash accounts or as accessible entities through a holder of a TIPS dedicated cash account.

6. Subject to the provisions of the following Clause 6, payment module account holders may designate entities as indirect participants in the payment module. Payment module account holders may designate as indirect participants entities that have adhered to the SEPA Instant Credit Transfer Scheme by signing the corresponding adherence agreement only if such entities are accessible on the TIPS platform, either as holders of TIPS dedicated cash accounts with the Bank of Spain or as accessible entities through a holder of a TIPS dedicated cash account.

7. Multiple account access may be granted to branches as follows: (a) A credit institution within the meaning of paragraphs (a) or (b) of section 1 of the preceding Clause 4, admitted as the holder of the payment module account, may grant access to its payment module account to one or more of its branches established in the Union or in the EEA in order to send payment orders or receive payments directly, provided that this has been reported to the Bank of Spain. (b) If a branch of a credit institution has been admitted as the holder of the payment module account, the other branches of the same institution or its head office, provided that they are established in the Union or in the EEA, may access the payment module account of the branch provided that this has been reported to the Bank of Spain."

8. The wording of section 4 of Clause 12 (Opening and management of payment module accounts) is modified, which shall now read as follows: "4. Payment module accounts and their sub-accounts shall be remunerated at zero percent or at the deposit facility rate, if lower, unless they are used to hold minimum reserves or to hold excess reserves. In the case of minimum reserves, the calculation and payment of remuneration for holdings shall be governed by Council Regulation (EC) No 2531/98 of 23 November 1998 concerning the application of minimum reserves by the European Central Bank, and by European Central Bank Regulation (EU) 2021/378 of 22 January 2021 on the application of minimum reserves (ECB/2021/1). In the case of excess reserves, the calculation and payment of remuneration for holdings shall be governed by European Central Bank Decision (EU) 2019/1743 of 15 October 2019 on the remuneration of excess reserve holdings and certain deposits (ECB/2019/31)."

9. The wording of Clause 35 (Security Requirements) is modified, which shall now read as follows: "Clause 35. Security Requirements and Control Procedures.

10. Participants shall establish adequate security controls to protect their systems from unauthorized access and use. Participants shall be solely responsible for adequately protecting the confidentiality, integrity, and availability of their systems.

11. Participants shall report to the Bank of Spain any security incident occurring in their technical infrastructure, and, where applicable, any security incident occurring in the technical infrastructure of third-party providers. The Bank of Spain may request further information about the incident and, if necessary, request that the participant take appropriate measures to prevent recurrence.

12. The Bank of Spain may impose other security requirements, particularly regarding cybersecurity or fraud prevention, on all participants or those it considers critical.

13. Participants shall provide the Bank of Spain with: (i) permanent access to their declaration of adherence to the endpoint security requirements of their chosen network service provider, and (ii) annually, the TARGET2 self-certification statement as published on the Bank of Spain's internet address and on the ECB's internet address in English. 4 bis. The Bank of Spain shall evaluate the self-certification statement(s) regarding the participant's level of compliance with each of the requirements established in the TARGET2 self-certification. These requirements are listed in the Technical Application approved by the Bank of Spain, which sets out requirements relating to information security management and business continuity management, which the participant declares to know and accept and undertakes to comply with. 4 ter. The participant's level of compliance with the TARGET2 self-certification requirements shall be classified as follows, in increasing order of severity: 'full compliance', 'minor non-compliance', or 'major non-compliance'. The following criteria shall apply: (i) full compliance is achieved when participants satisfy 100% of the requirements, (ii) minor non-compliance is understood to be the fact that a participant satisfies less than 100% but at least 66% of the requirements, and (iii) major non-compliance, when the participant complies with less than 66% of the requirements. If a participant demonstrates that a specific requirement is not applicable to them, the corresponding requirement shall be considered met for categorization purposes. Any participant that does not achieve 'full compliance' shall submit an action plan demonstrating how it proposes to achieve full compliance. The Bank of Spain shall inform the relevant supervisory authorities of the participant's compliance status. 4 quater. If the participant refuses to grant permanent access to their declaration of adherence to the endpoint security requirements of their chosen network service provider or does not provide the TARGET2 self-certification, the participant's compliance level shall be classified as 'major non-compliance'. 4 quinquies. The Bank of Spain shall re-evaluate participant compliance annually. 4 sexies. The Bank of Spain may impose the following remedial measures on participants whose compliance level has been assessed as minor or major non-compliance, in increasing order of severity: (i) Enhanced supervision: the participant shall provide the Bank of Spain with a monthly report, signed by a senior executive, on their progress in resolving the non-compliance. In addition, a monthly financial penalty shall be imposed on the participant for each affected account equal to their monthly fee, as established in section 1.1.1 of Section I of the Technical Application approved by the Bank of Spain, which sets out the fees applicable to the various accounts and services of TARGET2-Bank of Spain, excluding transaction fees. This remedial measure may be imposed if the participant receives a second consecutive assessment of minor non-compliance or an assessment of major non-compliance. (ii) Suspension: participation in TARGET2-Bank of Spain may be suspended if the circumstances described in paragraph (b) or paragraph (c) of section 2 of the following Clause 41 occur. Notwithstanding the provisions of the following Clause 41, suspension shall be notified to the participant three months in advance. In addition, a monthly financial penalty shall be imposed on the participant for each affected account equal to double their monthly fee, as established in section 1.1.1 of Section I of the Technical Application approved by the Bank of Spain, which sets out the fees applicable to the various accounts and services of TARGET2-Bank of Spain, excluding transaction fees. This remedial measure may be imposed if the participant receives a second consecutive assessment of major non-compliance. (iii) Termination: participation in TARGET2-Bank of Spain may be terminated if the circumstances described in paragraph (b) or paragraph (c) of section 2 of the following Clause 41 occur. Notwithstanding the provisions of the following Clause 41, termination shall be notified to the participant three months in advance. In addition, an additional financial penalty of 1,000 euros shall be imposed on the participant for each account removed. This remedial measure may be imposed if the participant has not remedied the major non-compliance to the satisfaction of the Bank of Spain three months after suspension.

14. Participants who grant access to third parties to their payment module accounts in accordance with sections 2, 3, and 4 of the preceding Clause 5 shall treat the risk arising from such access in accordance with the security requirements of the preceding sections 1 to 4 sexies. The self-certification referred to in section 4 above shall specify that the participant requires third parties accessing their payment module account to comply with the endpoint security requirements of the TARGET2 network service provider."

15. The wording of section 5 of Clause 38 (Liability Regime) is modified, which shall now read as follows: "5. Notwithstanding the provisions of Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market and of Royal Decree-Law 19/2018, of 23 November, on payment services and other urgent measures in the financial field, and its implementing regulations, as well as other provisions on transfer management in general, the preceding sections 1 to 4 shall apply to the extent that the liability of the Bank of Spain may be excluded."

16. The wording of section 1 of Clause 46 (Personal data protection, anti-money laundering, and other related matters) is modified, which shall now read as follows: "1. Participants shall comply with and shall be able to demonstrate to the relevant authorities compliance with all obligations, the knowledge of which is presumed, imposed on them by data protection legislation. Participants shall comply with all obligations, the knowledge of which is presumed, imposed on them by anti-money laundering and counter-terrorist financing legislation, strategic nuclear proliferation, and nuclear weapons vector system creation legislation, especially with regard to adopting appropriate measures regarding payments owed or credited to their payment module accounts. Participants shall ensure they are informed about the data recovery rules of the TARGET2 network service provider before contracting with them."

17. A new Clause 53 bis (Transitional Provisions) is introduced, with the following wording: "Clause 53 bis. Transitional Provisions.

18. Once TARGET is operational and TARGET2 has ceased activity, the balances of payment module accounts shall be transferred to the corresponding successor accounts of the account holder in TARGET.

19. The requirement that payment module account holders, indirect participants, and accessible BIC holders who adhere to the SEPA Instant Credit Transfer Scheme be accessible on the TIPS platform in accordance with the preceding Clause 5 shall apply from 25 February 2022."

Second. To include the modifications set out below in the current version of the general clauses relating to the uniform conditions for the opening and operation of a T2S dedicated cash account in TARGET2-Bank of Spain, approved by resolution of the Executive Committee of the Bank of Spain of 11 June 2015:

1. Clause 1 (Definitions) is modified as follows: (a) A definition for the term "TIPS linked system technical account" or "TIPS LS technical account" is introduced following the definition of the term "payment module main account", u