Circular NBB_2024_01 / Protection of funds for the execution of payment transactions and funds in exchange for electronic money

boulevard de Berlaimont 14 - 1000 Bruxelles tel. +32 2 221 48 66 numero d'entreprise: 0203.201.340 RPM Bruxelles www.bnb.be BANQUE NATIONALE DE BELGIQUE DE NATIONALE BANK VAN BELGIE CIRCULAIRE Public Brussels, 23 January 2024 Reference: NBB_2024_01 your correspondent:
Camille Debacq
Reinout Temmerman tel. +32 2 221 45 66 tel. +32 2 221 32 09 Camille.debacq@nbb.be Reinout.temmerman@nbb.be Protection of funds for the execution of payment transactions and funds in exchange for electronic money Scope Belgian payment institutions, limited Belgian payment institutions, Belgian electronic money institutions, and limited Belgian electronic money institutions. Summary/Objectives This circular replaces Circular NBB_2022_13 and clarifies: 1) the requirements set out in Articles 42 and 194 of the Law of 11 March 2018¹ concerning the measures taken by payment institutions and electronic money institutions to protect funds intended for the execution of payment transactions or funds received in exchange for electronic money and still held at the end of the business day following the day on which they were received; and 2) the transmission of information set out in Articles 36 and 180 of the Law of 11 March 2018 regarding the content of the annual report on measures for compliance with and application of Articles 42, § 1, 2°, a), b), c), 3°, and 194, § 1, 2°, a), b), c), 3°, of the Law of 11 March 2018².

Law of 11 March 2018 on the status and supervision of payment institutions and electronic money institutions, on access to the activity of payment service providers, and on the activity of issuing electronic money, and on access to payment systems (hereinafter "the Law of 11 March 2018").

Circular NBB_2024_01 differs from Circular NBB_2022_13 mainly in that Chapter III "Reporting" has been expanded to include expectations regarding the transmission of information set out in Articles 36 and 180 of the Law of 11 March 2018.

Public NBB_2024_01 - 23 January 2024 Circular - Page 1/11

Dear Sir,
Dear Madam,

Funds received by Belgian payment institutions³, limited Belgian payment institutions⁴, Belgian electronic money institutions⁵ and limited Belgian electronic money institutions⁶ (hereinafter "the Institutions") must be protected in accordance with Articles 42 and 194 of the Law of 11 March 2018.

The protection measures provided for by the aforementioned provisions must be taken:
i. for received funds:
(i) by a (limited) payment institution in the context of the provision of payment services 1 to 6 as listed in Annex I.A of the Law of 11 March 2018 directly to payment service users or through other payment service providers for the execution of payment transactions; or (ii) by an (limited) electronic money institution in exchange for electronic money.
ii. when at the end of the business day following the day on which they were received, these funds:
(i) are still held by the (limited) payment institution and have not yet been transferred to the beneficiary or to another payment service provider; or (ii) have not yet been transferred by the electronic money institution following the use of the electronic money or its redemption.

By this circular, the National Bank of Belgium (hereinafter the "Bank") wishes to clarify the requirements set out in Articles 42 and 194, § 1, 2°, a) and c), and 3°, of the Law of 11 March 2018 as well as the manner in which Institutions must report to the Bank on this matter.

³ Article 8, § 1, 1°, of the Law of 11 March 2018.
⁴ Article 8, § 1, 2°, a), of the Law of 11 March 2018.
⁵ Article 166, § 1, 1°, of the Law of 11 March 2018.
⁶ Article 166, § 1, 2°, of the Law of 11 March 2018.

Public NBB_2024_01 - 23 January 2024 Circular - Page 2/11

I. Protection of funds in accordance with Articles 42 and 194 of the Law of 11 March 2018

The obligation to protect funds provided for in Articles 42 and 194 of the Law of 11 March 2018 ends when these funds are transferred:
i. to the beneficiary; or
ii. to another payment service provider: it is specified that in this case this is the payment service provider mandated by the beneficiary.

This does not apply in the case where funds are transferred to another payment service provider to which the payment institution or electronic money institution has outsourced the payment of the funds concerned, for which it is specified that the (limited) payment institution or (limited) electronic money institution is not exempt from its obligation to protect these funds in accordance with Articles 42 and 194 of the Law of 11 March 2018, unless it proves that these funds are protected by the relevant payment service provider in accordance with a protection mechanism subject to Articles 42 and 194 of the Law of 11 March 2018 which is deemed equivalent by the Bank (hereinafter an "equivalent protection mechanism").

The burden of proof differs depending on:

• the authorization of the relevant payment service provider (credit institution, payment institution, electronic money institution, etc.);
• the legislation applicable to the relevant payment service provider.

The Bank considers payment institutions (limited or not), electronic money institutions (limited or not) and credit institutions subject to the law of a Member State to be subject to an equivalent protection mechanism. The Bank may also consider a credit institution subject to the law of a third country to be subject to an equivalent protection mechanism, if the institution concerned issues an independent and duly reasoned legal opinion to this effect.

However, in this case, the obligation to protect passes from the (limited) payment institution or (limited) electronic money institution to the relevant payment service provider only when the latter provides proof of the effective protection of the funds concerned in accordance with an equivalent protection mechanism.

Public NBB_2024_01 - 23 January 2024 Circular - Page 3/11

II. Protection of funds in accordance with Articles 42, § 1, 2°, a) and c), and 3°, and 194, § 1, 2°, a) and c), and 3°, of the Law of 11 March 2018

1. Deposit in a separate global or individual client account

In the case where the Institution deposits the funds in accordance with Articles 42, § 1, 2°, a), and 194, § 1, 2°, a), of the Law of 11 March 2018 in a separate global or individual client account with one or more entities qualifying as credit institutions subject to the law of a Member State or as a branch in Belgium of a credit institution subject to the law of a third country⁷, this implies:

• that it ensures that the contract concluded with the credit institution or branch for the opening of this account (including the general and specific terms applicable to it) (hereinafter the "Contract") explicitly confirms that this account is a client account within the meaning of Article 42, § 1, 2°, a), or Article 194, § 1, 2°, a), of the Law of 11 March 2018⁸ or that the credit institution or branch prepares a similar document containing the same information;
• that it requests at least every three years from the credit institution or branch where it has opened this client account an attestation indicating the IBAN of the client account and the amount held in the client account at that time;
• that it communicates the Contract and the attestations it has received to the Bank in accordance with the reporting schemas provided for by Circulars NBB_2018_31 on the periodic reporting schema for payment institutions and NBB_2019_10 on the periodic reporting schema for electronic money institutions as last amended on 3 December 2021.

The Bank emphasizes that the communication of the contact details of the file manager of the credit institution or branch where the client account was opened is considered a "best practice".

2. Investment in low-risk, liquid and safe assets

In the case where the Institution invests the funds in assets, these assets must, in accordance with Article 42, § 1, 2°, c), or Article 194, § 1, 2°, c), of the Law of 11 March 2018, be "low-risk, liquid and safe assets". The Bank specifies that:

The requirement regarding "liquidity" must be understood to mean that these assets must be able to be quickly liquidated with minimal negative impact on their price. This implies that:
i. these assets are freely transferable without regulatory or contractual restrictions;
ii. there is an active market for these instruments comprising a diversified group of buyers and sellers, even in turbulent periods;
iii. reliable price data are published regularly.

⁷ Article 333 of the Law of 25 April 2014 on the status and supervision of credit institutions.
⁸ Or a reference to Article 10 of Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (hereinafter: the "PSD2 Directive") or to Article 7 of Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions, amending Directives 2005/60/EC and 2006/48/EC and repealing Directive 2000/46/EC (hereinafter the "EMD2 Directive") and to the applicable national provisions transposing the aforementioned articles of the PSD2 Directive or the EMD2 Directive.

Public NBB_2024_01 - 23 January 2024 Circular - Page 4/11

The Bank is of the opinion that the assets referred to in Article 10, 1°, a), b), c), d), e) and g), of Regulation 2015/619 and the assets referred to in Article 11, 1°, a), b) and e), of Regulation 2015/61 meet the liquidity criterion.

The requirement regarding "safety" must be understood to mean that these assets are protected by the institution against the various risks inherent in their nature. This implies that:
i. the assets can at any time be identified separately in the accounting;
ii. the assets must be held in a separate securities account with a regulated entity subject to the law of a Member State or a branch in Belgium of an entity subject to the law of a third country;
iii. the assets must be distinctly identifiable;
iv. in order to limit the effects of any exchange rate risk, the Institution must monitor risks arising from investment in assets denominated in currencies other than the currencies for which protection is ensured;
v. the maturity of the assets must be limited in order to control security risk. The Bank recommends that the weighted average maturity of the portfolio be limited to 2 years;
vi. the assets selected by the Institution are not financial instruments linked to the Institution itself or to any of its affiliated companies.

The requirement regarding "low risk" must be understood to mean that the various risks inherent in the assets are limited. In the case of investment in financial instruments, this implies that the Institution ensures:
i. that the issuer of these financial instruments is solvent (the expected rating scale of the issuer must at least correspond to the ratings provided for in category 1 of the correspondence tables in Annex III of Implementing Regulation 2016/1799¹⁰);
ii. that the credit risk of the investment is limited, and consequently:

• that the value of the underlying assets is sufficiently high;
• that the concentration risk remains limited.

⁹ Delegated Regulation (EU) 2015/61 of the Commission of 10 October 2014 supplementing Regulation (EU) No 575/2013 of the European Parliament and of the Council as regards the liquidity coverage requirement for credit institutions (hereinafter "Regulation 2015/61").
¹⁰ Implementing Regulation (EU) 2016/1799 of 7 October 2016 defining implementing technical standards with regard to the mapping of credit assessments established by external credit assessment institutions for credit risk under Article 136(1) and Article 136(3) of Regulation (EU) No 575/2013 of the European Parliament and of the Council.

Public NBB_2024_01 - 23 January 2024 Circular - Page 5/11

3. Coverage by insurance, guarantee or surety

In the case where the funds are covered, in accordance with Articles 42, § 1, 3°, and 194, § 1, 3°, of the Law of 11 March 2018, by "an insurance, a guarantee or a surety from an insurance company or a credit institution subject to the law of a Member State or subject to the law of a third country and having an establishment in Belgium, which insurance company or credit institution may not belong to the same group as the payment institution", the Bank specifies that:

• this insurance, guarantee or surety must have the payment service users of the Institution as beneficiaries;
• the payment obligation under this insurance, guarantee or surety arises as soon as the Institution is unable to meet its financial obligations towards payment service users;
• the covered amount corresponds to the highest amount of all sums, over a period of three years at the end of the business day following the day of its receipt, not transferred by the Institution to the beneficiary or to a payment service provider or arising from the use of the electronic money or its redemption;

It is recalled for all purposes that:

• the insurance company or credit institution granting the insurance, guarantee or surety may not, on the funds due under the insurance, guarantee or surety contract, assert rights resulting from its own claims against the payment institution that contracted this insurance, guarantee or surety (Article 42, § 1, paragraph 4, and Article 194, § 1, paragraph 4, of the Law of 11 March 2018);
• these funds may not be subject to any garnishment by the creditors of the (limited) payment institution or (limited) electronic money institution (Article 42, § 1, paragraph 4, and Article 194, § 1, paragraph 4, of the Law of 11 March 2018);
• in the event of a situation of concurrence affecting the (limited) payment institution or (limited) electronic money institution, the funds paid under the insurance, guarantee or surety contract are allocated by special privilege for the repayment of funds received for the execution of payment transactions or funds received in exchange for the electronic money issued (Article 42, § 3 and Article 194, § 4, of the Law of 11 March 2018).

The protection of received funds effected by this insurance, guarantee or surety requires prior explicit authorization from the Bank.

Public NBB_2024_01 - 23 January 2024 Circular - Page 6/11

To this end, the Institution must submit to the Bank an application file containing at least the following elements:

• the draft convention to be signed with the insurance company or credit institution (subject to the law of a Member State or third country and having an establishment in Belgium, and not belonging to the same group as the Institution), explicitly confirming that its purpose is to grant an insurance, guarantee or surety to the Institution within the meaning of Article 42, § 1, 3°, or Article 194, § 1, 3°, of the Law of 11 March 2018¹¹;
• the amount covered by the insurance, guarantee or surety;
• a description of the internal procedure applied by the Institution to annually evaluate the amount contractually covered by the insurance, guarantee or surety, based on its own updated internal calculation of the amount of funds to be protected in accordance with Article 42 or Article 194 of the Law of 11 March 2018.

The Bank emphasizes that the communication of the contact details of the file manager of the insurance company or credit institution with which the convention is concluded is considered a "best practice".

¹¹ Or a reference to the relevant articles of the PSD2 Directive or the EMD2 Directive and to the applicable national provisions transposing the relevant articles of the PSD2 Directive or the EMD2 Directive.

Public NBB_2024_01 - 23 January 2024 Circular - Page 7/11

III. Reporting

Quarterly reporting for payment institutions and electronic money institutions

Pursuant to Article 77 or Article 197, § 2 of the Law of 11 March 2018, the reporting modalities to the Bank concerning the protection of funds for the execution of payment transactions and funds received in exchange for the issuance of electronic money are set out in Circular NBB_2018_31 of 3 December 2021 on the periodic reporting calendar for payment institutions and in Circular NBB_2019_10 of 3 December 2021 on the periodic reporting calendar for electronic money institutions.

Annual report for payment institutions and electronic money institutions

Pursuant to Article 36 or Article 180 of the Law of 11 March 2018, the persons responsible for the effective management of the Institution annually communicate to the Bank a report on the adequacy of the measures taken by the Institution to protect the funds of payment service users or the funds received in exchange for the issuance of electronic money in the interest of the users.

The reporting is prepared each year. It is transmitted to the Bank and the approved auditor within three months following the closing of the Institution's financial year.

The content of the report is proportional to the nature, volume and complexity of the Institution's payment services or activities, as well as the associated risks (application of the principle of proportionality).

The reporting includes the following elements, according to the Articles under which the Institution operates:

1. if the Institution, in accordance with Articles 42, § 1, 2°, a), and 194, § 1, 2°, a), of the Law of 11 March 2018, deposits the funds in a separate global or individual client account with one or more entity(ies) qualifying as credit institutions subject to the law of a Member State or as a branch in Belgium of a credit institution subject to the law of a third country, the report contains:
   i. a description and evaluation of access management, as well as the number of persons having access to the separate global or individual client account and their respective functions;
   ii. a description and evaluation of the Institution's procedure and calculation method regarding the deposited funds, the monitoring of cash flows of the client account, and the information escalation procedure in the event of abnormal or atypical transactions;
   iii. a description and evaluation of the management and reconciliation process between the Institution's accounting and the client accounts in order to guarantee that the funds of payment service users are protected against the claims of other creditors of the Institution in the interest of payment service users, particularly in the event of insolvency;
   iv. in the case where the Institution holds a fixed amount of funds to protect the funds of payment service users or the funds received in exchange for the issuance of electronic money: the method of calculation of this amount and the frequency of recalculation.

Public NBB_2024_01 - 23 January 2024 Circular - Page 8/11

2. if the institution, in accordance with Article 42, § 1, 2°, b), and Article 194, § 1, 2°, b), of the Law of 11 March 2018, invests the funds in a qualified money market fund, and/or, in accordance with Article 42, § 1, 2°, c), and Article 194, § 1, 2°, c), of the Law of 11 March 2018, invests the funds in low-risk, liquid, and safe assets, the report contains:

i. a description and evaluation of the institution's investment policy;
ii. a description and evaluation of the institution's management and calculation process regarding deposited funds, aimed at ensuring that the funds of payment service users or the funds received by an electronic money institution on behalf of users are protected against the claims of other creditors of the payment institution on behalf of users, particularly in the event of insolvency.

3. if the institution, in accordance with Article 42, § 1, 3°, and Article 194, § 1, 3°, of the Law of 11 March 2018, proceeds to cover, in a manner deemed satisfactory by the Bank, the funds with insurance, a guarantee, or a surety from an insurance undertaking or a credit institution subject to the law of a Member State or subject to the law of a third country and having an establishment in Belgium, provided that such insurance undertaking or credit institution does not belong to the same group as the institution, the report contains:

i. a confirmation that the insurance, guarantee, or surety from an insurance undertaking or credit institution originates from an entity not part of the same group as the payment institution, in the event of a change since the previous reporting period in the insurance undertaking or credit institution providing the insurance, guarantee, or surety;
ii. the details of the existing reconciliation process to ensure that the insurance, guarantee, or surety is at all times sufficient to meet the institution's protection obligations;
iii. the duration and any possibility of extension of the coverage.

In each of the 3 cases mentioned above, the report contains:

i. a clear identification of each type of fund (i.e., global or distinct individualized client accounts, qualified money market funds, low-risk, liquid, and safe assets, insurance, guarantees, and/or sureties¹²) held by the institution and used to protect the funds of payment service users or the funds received in exchange for the issuance of electronic money;
ii. a description and evaluation of the internal procedure in the event that the mode of protection of the funds of payment service users or the funds received in exchange for the issuance of electronic money proves insufficient to cover the full amount of client funds at a given time;
iii. a specific description and evaluation of the internal control measures taken regarding the protection of the funds of payment service users or the funds received in exchange for the issuance of electronic money;
iv. a separate notification of any changes in the procedures applied since the previous financial year;
v. an explicit confirmation by the institution that Article 42, § 1, 2° and 3°, or Article 194, § 1, 2° and 3°, of the Law of 11 March 2018 is respected, specifying precisely which measure of the aforementioned provisions is respected;
vi. an explicit confirmation by the institution that Article 42, § 1, third or fourth paragraph, or Article 194, § 1, second or third paragraph of the Law of 11 March 2018 is respected, specifying precisely which requirement of the aforementioned provisions is respected.

¹² As indicated in Article 42, § 1, 2°, a), b), and c), and 3°, and Article 194, § 1, 2°, a), b), and c), and 3°, of the Law of 11 March 2018.

Public NBB_2024_01 - 23 January 2024 Circular - Page 9/11

If the institution does not at any time hold funds received from payment service users to protect, the report contains an explicit declaration by the institution stating that:

no funds are received at any time:
i. by a payment institution (limited) in the course of providing payment services 1 to 6 as listed in Annex I.A of the Law of 11 March 2018 directly from payment service users or through other payment service providers for the execution of payment transactions; or
ii. by an electronic money institution (limited) in exchange for electronic money;

The report is signed by the person(s) representing the effective management.

Annual report of the approved auditor

It is recommended that institutions, pursuant to Article 115, § 6, or Article 213, 4°, of the Law of 11 March 2018, submit the documents and elements mentioned in Chapters I, II, and III of this circular to their approved company auditor so that the latter may include and judge, in their annual report, the appropriateness of the measures taken by the institution to protect the funds received from payment service users or the funds received in exchange for the issuance of electronic money.

Public NBB_2024_01 - 23 January 2024 Circular - Page 10/11

IV. Entry into force

This circular will enter into force on 31 March 2024.
The clarifications specified in Chapter III Reporting, title Annual Report, will be applied from the next reporting period for the 2023 financial year.
A copy of this circular is addressed to the auditor(s), approved auditor(s) of your institution.

Please accept, Madam, Sir, the assurance of our very distinguished consideration.

Pierre Wunsch
Governor

Public NBB_2024_01 - 23 January 2024 Circular - Page 11/11