Royal Decree 736/2019 on the legal regime of payment services and payment institutions

Royal Decree 736/2019, of December 20, on the legal regime of payment services and payment institutions, and amending Royal Decree 778/2012, of May 4, on the legal regime of electronic money institutions, and Royal Decree 84/2015, of February 13, developing Law 10/2014, of June 26, on the organization, supervision, and solvency of credit institutions.

Ministry of Economy and Enterprise "BOE" No. 308, of December 24, 2019 Reference: BOE-A-2019-18425

INDEX

Preamble ................................................................... 4 CHAPTER I. Authorization and modification of payment institutions............................... 8 Article 1. Authorization regime for payment institutions. ................................ 8 Article 2. Authorization applications. ............................................... 9 Article 3. Account information service providers. ....................... 11 Article 4. Registration regime and conditions for institutions exempt from authorization................. 12 Article 5. Registers of the Bank of Spain. ............................................ 13 Article 6. Modification of bylaws and expansion of activities. ...................... 14 Article 7. Structural modifications involving a payment institution. .................. 15 Article 8. Use of the reserved denomination. .......................................... 15 CHAPTER II. Cross-border activity of payment institutions ................................ 15 Article 9. Operation in Spain of payment institutions authorized in another Member State of the European Union.................................................................. 15 Article 10. Application for exercise of the right of establishment and free provision of services in a State not a member of the European Union by Spanish payment institutions............................ 16 CONSOLIDATED LEGISLATION Page 1

Article 11. Creation or acquisition of participations in entities analogous to payment institutions in a State not a member of the European Union. ............................................ 17 CHAPTER III. Regime of agents and outsourcing of functions ............................ 18 Article 12. Concept of agent. ................................................... 18 Article 13. Obligation to communicate with the Bank of Spain and registration of agents. .............. 18 Article 14. Liability of payment institutions for acts carried out by their agents and conditions for the exercise of activity by agents................................... 19 Article 15. Outsourcing of functions. ............................................. 19 CHAPTER IV. Guarantee requirements, own funds requirements and operational limitations of payment accounts ................................................................... 20 Article 16. Guarantee requirements. ................................................. 20 Article 17. Own funds. ...................................................... 21 Article 18. Calculation of own funds requirements. ................................. 22 Article 19. Adoption of measures to ensure compliance with rules relating to own funds. ... 22 Article 20. Application of results in case of non-compliance with rules relating to own funds. .... 22 Article 21. Payment accounts. ..................................................... 23 Article 22. Granting of credit................................................... 23 CHAPTER V. Hybrid payment institutions and duty to establish a separate payment institution .. 23 Article 23. Hybrid payment institutions. ....................................... 23 Article 24. Duty to establish a separate payment institution............................. 24 CHAPTER VI. Other provisions relating to the legal regime of payment services ................. 25 Article 25. Limited networks....................................................... 25 Article 26. Payment operations of a provider of electronic communication networks or services. ....... 26 CHAPTER VII. Sanctioning regime, supervision and information obligations of payment service providers ................................................................... 26 Article 27. Sanctioning regime. .................................................. 26 Article 28. Supervision and cooperation with competent authorities of other Member States. ......... 27 Article 29. Information on the capital structure of payment institutions. .................... 27 Article 30. Information obligations in matters of conduct. .............................. 28 Additional Provisions ......................................................... 28 First Additional Provision. Communication by administrators of hybrid payment institutions and hybrid electronic money institutions. .................................. 28 BOLETIN OFICIAL DEL ESTADO CONSOLIDATED LEGISLATION Page 2

Second Additional Provision. Customer service services. ............................... 28 Repealing Provisions ........................................................ 29 Single Repealing Provision. Repeal of legislation....................................... 29 Final Provisions ............................................................ 29 First Final Provision. Competence title. .......................................... 29 Second Final Provision. Modification of Royal Decree 778/2012, of May 4, on the legal regime of electronic money institutions. .................................................. 29 Third Final Provision. Modification of Royal Decree 84/2015, of February 13, developing Law 10/2014, of June 26, on the organization, supervision and solvency of credit institutions. ............... 45 Fourth Final Provision. Incorporation of European Union Law. ......................... 45 Fifth Final Provision. Development powers. ........................................ 45 Sixth Final Provision. Entry into force. .............................................. 46 ANNEX. Methods for calculating own funds requirements ............................. 46 BOLETIN OFICIAL DEL ESTADO CONSOLIDATED LEGISLATION Page 3

CONSOLIDATED TEXT Last modification: no modifications I Directive 2007/64/EC of the European Parliament and of the Council, of November 13, 2007, on payment services in the internal market, amending Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC, known as PSD, was a fundamental milestone in the construction of a single integrated market for payment services in the European Union. With its transposition into our legal system, mainly through Law 16/2009, of November 13, on payment services, it sought to correct the fragmentation of national payment services markets, harmonizing and coordinating national provisions on prudential requirements, market access for new payment service providers, information requirements, and rights and obligations of users and payment service providers. Despite the undeniable success of this legislation, which consolidated a single payments zone, the retail payments market has experienced a series of very important technological innovations in recent years, helping to develop new payment services, whose fit within that regulation was often difficult. The push for new technologies has produced a significant increase in the number and volume of electronic payment operations, both through contactless cards and via mobile terminals. The need to guarantee greater legal certainty for entities and users, as well as a more agile and effective environment, has led to the approval of the second Payment Services Directive, Directive (EU) 2015/2366, of November 25, 2015 on payment services in the internal market and amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010 and repealing Directive 2007/64/EC of the European Parliament and of the Council, of November 13, known as PSD2. This Directive collects the fundamental principles of the previous one and advances in certain key aspects referred to new services and providers, favoring both innovation and a deepening of the regulation of security and user protection of payment services in payments made in e-commerce and in the use of services that until then had been provided outside regulation, in particular payment initiation and account information. That Directive has been partially transposed into our legal system through Royal Decree-Law 19/2018, of November 23, on payment services and other urgent measures in financial matters, so it is necessary to continue its transposition by developing certain aspects regulated in said royal decree-law. II This royal decree is structured similarly to Royal Decree 712/2010, of May 28, on the legal regime of payment services and payment institutions, which it repeals. It consists of seven chapters, containing thirty articles, two additional provisions, one repealing provision, six final provisions, and an annex. Chapter I, on the legal regime of payment institutions, mainly regulates the creation of this type of entity, as well as the fundamental aspects of its operation such as its authorization, the modification of its bylaws, and the expansion of its activities, and structural modifications in which a payment institution is involved. One of the most notable novelties of Royal Decree-Law 19/2018, of November 23, was the change in the competent body to authorize the creation of payment institutions. From the entry into force of the same, this competence ceases to belong to the former Ministry of Economy and Finance and is attributed to the Bank of Spain. This royal decree develops this provision, establishing the details of the procedure, the peculiarities for certain providers of payment services, such as account information service providers, and entities benefiting from the exemption of Article 14 of Royal Decree-Law 19/2018, of November 23. It also details the information requirements that the Bank of Spain must send to the General Secretariat of Treasury and International Financing of the Ministry of Economy and Enterprise regarding authorization applicants. The requirements that these latter must possess to be authorized are also established, as well as the specific content of the application they must submit. In this sense, it is intended to establish requirements and procedures as agile as possible, to avoid undue delays in obtaining authorization, while respecting the mandates of Directive (EU) 2015/2366 of the European Parliament and of the Council, of November 25, 2015 (hereinafter, the Directive). Likewise, with this regulation, the registration of the Bank of Spain, before which these entities are obliged to register, is addressed. Along with the peculiarities of the authorization regime, the first chapter also deals with other aspects. In the same way as established in Royal Decree 712/2010, of May 28, changes in the bylaws of these entities, and the expansion of their activities, will also be subject to authorization, except in cases where, due to their low relevance, communication to the Bank of Spain will be sufficient. Operations of merger, demerger, or transfer of assets and liabilities, or other analogous ones, in which one of these entities is involved, are also subject to authorization. Finally, this chapter deals with the use of the denomination "payment institution" or "P.I.", and "account information service provider" or "AISP", which necessarily remains reserved for them, and which they may optionally include in their corporate name and use in their communications. Chapter II regulates the cross-border activity of payment institutions. The manner of operation in our country of payment institutions authorized in another Member State is established, for which a procedure for communication of information between the supervision authorities of each Member State is fixed. Likewise, this chapter regulates the peculiarities of the authorization procedure when a Spanish entity intends to open a branch or access the free provision of services in the territory of a State not a member of the European Union and determines the procedure for the creation or acquisition of participations, by a Spanish entity, in entities of a State not a member of the European Union that can be considered analogous to a payment institution. Chapter III deals with the use of agents and the outsourcing of functions by payment institutions. This chapter defines the concept of agent, in accordance with what is regulated in Royal Decree-Law 19/2018, of November 23, establishes the requirement to submit certain information about agents to the Bank of Spain, on the one hand, and the obligation of prior inscription in the Special Register of the Bank of Spain, on the other. It also regulates the peculiarities to be taken into account in cases of agents that are going to operate in other Member States of the European Union. Payment institutions and their agents are thus subject to a series of conditions in their exercise. Among these, it stands out that, in acts carried out by their agents, the institutions will be responsible for compliance with the obligations collected in the legislation. Likewise, this chapter deals with the conditions for outsourcing important operational functions. It defines, first, which operational functions can be considered as such. Second, it establishes the obligation of prior communication to the Bank of Spain in these cases, which may oppose such outsourcing. Finally, it introduces the conditions for the exercise of this outsourcing. Chapter IV of this royal decree develops what is provided in Royal Decree-Law 19/2018, of November 23, regarding solvency guarantees and user protection, establishing the obligations that payment institutions, including payment initiation service providers, and account information service providers must fulfill regarding these matters. The first of these requirements refers to the protection and custody of funds received from users, which must be done through one of the two procedures regulated by the royal decree-law, on which this royal decree now details the specific requirements of these forms of guarantee. As for the second requirement, Royal Decree-Law 19/2018, of November 23, states that these entities must maintain at all times a determined volume of own funds. This royal decree collects the three methods that the Directive allows to be used to determine these own funds, whose application must be chosen by the entities themselves. This possibility of choice is a novelty with respect to the previous regulation, where the calculation method was given to the entities. Specifically, this royal decree collects in its single annex the three possible methods that entities can choose for the calculation of their own funds. Likewise, in the event that any entity fails to meet this minimum level of own funds, Chapter IV also collects the procedure to be followed for the entity to return to compliance with the rules relating to own funds. Finally, this chapter collects operational limitations that payment accounts must respect. Chapter V, similarly to current regulation, collects the definition of hybrid payment institution, as that which, in addition to providing regulated payment services, offers other types of services, establishing the particularities of its specific legal regime. In development of the above, it is established that, when the activities of the payment institution regarding services other than payments harm or may harm the financial solidity or the capacity of the competent authorities for supervision, they will have the obligation to constitute a separate entity for the provision of these different services, under the terms collected in Article 23. On the other hand, Royal Decree-Law 19/2018, of November 23, established the exclusion in the application of the legislation regarding payment services that are based on instruments that can only be used in a limited way, mainly to acquire a specific range of goods and services, or that can only be used in the issuer's premises or limited network of providers. Based on this exclusion, Chapter VI of this royal decree develops its terms in more detail to clarify its regulation. This chapter is completed by establishing that payment operations of urban mobility services, including shared use, as well as tickets for cultural services, and others similar, among others that the Bank of Spain may determine, will be considered excluded from the application of payment services legislation, given their nature, meeting the requirements collected in Article 4.l) of Royal Decree-Law 19/2018, of November 23. Finally, Chapter VII collects the sanctioning regime and supervision regarding capital structure and conduct matters, applicable to payment institutions. This regulation follows, in the main, the regime applicable to credit institutions, which in turn had been modified by Royal Decree-Law 19/2018, of November 23. The provisions of this royal decree are completed with two additional provisions, one repealing provision, six final provisions, and an annex. Since the royal decree modifies the legal regime of hybrid payment institutions and hybrid electronic money institutions, by introducing the provision that administrators who will have direct participation in the management of payment services must be compulsorily inscribed in the Register of Senior Management of the Bank of Spain, it is necessary to establish a deadline for them to register. This provision is collected in the First Additional Provision. The Second Additional Provision develops what is provided in Article 69 of Royal Decree-Law 19/2018, of November 23, regarding customer service services of payment service providers, empowering the person holding the Ministry of Economy and Enterprise to establish the requirements that the customer service and, if applicable, the ombudsman must meet, the procedure to which the processing of complaints and claims must be submitted, the administrative verification procedure of the operating regulations, and the minimum content that their annual reports must have. The Single Repealing Provision repeals Royal Decree 712/2010, of May 28. The First Final Provision collects the competence title, stating that this royal decree is issued under what is provided in Article 149.1.6th, 11th, and 13th of the Constitution, which attribute to the State exclusive competences on commercial legislation, bases of the organization of credit, banking, and insurance, and bases and coordination of the general planning of economic activity, respectively. The Second Final Provision contains a profound modification of Royal Decree 778/2012, of May 4, on the legal regime of electronic money institutions, which develops Law 21/2011, of July 26, on electronic money. Given the modifications introduced by Royal Decree-Law 19/2018, of November 23, in Law 21/2011, of July 26, it is now necessary to adapt its regulation to these changes, on the one hand, and to the novelties introduced by this royal decree. This adaptation is essential given the necessary harmonization that must exist between both regulations. The Third Final Provision collects a modification of Royal Decree 84/2015, of February 13, developing Law 10/2014, of June 26, on the organization, supervision, and solvency of credit institutions. This modification aims to collect the information obligations in matters of conduct for credit institutions, in the same way that Article 30 of this royal decree, and the Second Final Provision, relative to Article 28 of Royal Decree 778/2012, of May 4, collect for payment institutions and electronic money institutions, respectively. The Fourth to Sixth Final Provisions contain, respectively, the declaration of incorporation of European Union law, the empowering of the person holding the Ministry of Economy and Enterprise and the Bank of Spain for the development of various provisions, and the date of entry into force of the royal decree. Finally, the annex collects the three methods that entities can use for the calculation of their minimum volume of own funds, following what is established in the Directive. III This norm adapts to the principles of necessity, efficacy, proportionality, legal certainty, transparency, and efficiency, to which the exercise of regulatory power must be subject, in accordance with what is provided in Article 129 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations. This royal decree adapts to European Union legislation, as well as to Royal Decree-Law 19/2018, of November 23, therefore defending the general interest, and applying the principles of necessity and efficacy. Furthermore, since its approval is mandatory, and being the royal decree the most appropriate instrument for it, in accordance with the mandates established in the aforementioned royal decree-law, it fulfills the principles of proportionality and legal certainty. In the elaboration procedure of this royal decree, it has been submitted to public consultation, provided for in both Article 26.2 of Law 50/1997, of November 27, of the Government, and in Article 133.1 of Law 39/2015, of October 1. Likewise, the project has been submitted to the public hearing procedure provided for in Article 26.6 of Law 50/1997, of November 27, and in Article 133.2 of Law 39/2015, of October 1, thus enabling the active participation of potential recipients. In the same way, the Report of the Spanish Data Protection Agency has been requested, among others. Additionally, the own