Final Guidelines on Authorisations of Payment Institutions (EBA-GL-2017-09)

EBA/GL/2017/09
11/07/2017
Final Report on the EBA Guidelines under Directive (EU) 2015/2366 (PSD2) on the information to be provided for the authorisation of payment institutions and e-money institutions and for the registration of account information service providers

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Abbreviations AIS Account information services AISP Account information service provider ASPSP Account servicing payment service provider CA Competent Authority CP Consultation Paper CRDIV Directive (EU) 2013/36/EU (Capital Requirements Directive) EMD Directive 2009/110/EC (Electronic Money Directive) EMI E-money institution GL Guideline PI Payment institution PISP Payment initiation service provider PII Professional indemnity insurance PIS Payment initiation services PSD2 Directive (EU) 2015/2366 on payment services in the internal market PSP Payment service provider

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Contents

1. Executive summary 4
2. Background and rationale 5
3. Guidelines 12
   Guidelines on the information required from applicants for authorisation as payment institutions for the provision of services 1-8 of Annex I to PSD2 18 Guidelines on the information required from applicants for registration for the provision of only service 8 of Annex I to PSD2 (account information services) 38 Guidelines on the information requirements from applicants for authorisation as electronic money institutions 50 Guidelines regarding the assessment of completeness of the application 71
4. Accompanying documents 72
   4.1 Draft cost-benefit analysis/impact assessment 72
   4.2 Feedback table 77

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 1.Executive summary The EBA published a Consultation Paper (CP) on 3 November 2016 for a three-month consultation period in order to gather views from the industry, and received 23 responses. The EBA has reviewed and assessed the responses and identified several issues and requests for clarification by respondents, such as the level of detail of the guidelines (GLs); the proportionality of the GLs; the interest of respondents for the EBA to further clarify the addressees of each specific set of GLs; and the transitional provisions. The EBA agrees with some of the proposals made by respondents and has made a number of changes to the draft GLs as a result. The GLs specify the type of information that applicants are required to submit to fulfil the requirements set out in Directive (EU) 2015/2366 on payment services in the internal market (PSD2), including those in respect of the applicant’s programme of operations; its business plan; the measures taken for safeguarding payment service users’ funds; its internal control mechanisms for the purpose of anti-money laundering (AML) obligations; the applicant’s structural organisation; the identity of statutory auditors; the identity of persons holding qualifying holdings; and the identity of directors and persons responsible for the management of the payment institution (PI) and, where relevant, persons responsible for the management of the payment service activities of the PI. The GLs have been separated into four different sets, the first three of which apply to PIs, account information service providers (AISPs) and electronic money institutions (EMIs) respectively. The fourth set of GLs, in turn, provides clarity to applicants in respect of the completeness of the application. Next steps The final GLs will be translated into the official languages of the European Union (EU). Competent authorities (CAs) will have two months from the publication date of the translation to notify the EBA of whether or not they comply or intend to comply with the GLs, and, if not, to provide reasons for non-compliance.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 2.Background and rationale
2.1 Background

1. On 13 January 2016, Directive (EU) 2015/2366 (PSD2) entered into force in the EU. PSD2 aims
   in particular to enhance competition in the payment services market and, in so doing, increase choice for consumers. In order to support the transposition of the Directive by 13 January 2018, PSD2 confers on the EBA the mandate to develop six technical standards and five sets of GLs.
2. One of these mandates is set out in Article 5(5) of PSD2, which confers on the EBA the
   mandate to:
   "issue guidelines […] concerning the information to be provided to the competent authorities in the application for the authorisation of payment institutions, including the requirements laid down in points (a), (b), (c), (e) and (g) to (j) of the first subparagraph of paragraph 1 of this Article.”
3. On 3 November 2016, the EBA published a CP containing its proposals for the fulfilment of
   this mandate.
   1 In the CP, the EBA also set out the scope of the GLs as provided for in PSD2, which states that the GLs should apply:

• to applicants intending to obtain authorisation as a payment institution under PSD2
  (chapter 4.1), including applicants that intend to provide only payment initiation services (PIS). However, given that these payment institutions do not enter in possession of funds, some specific provisions of the GLs do not apply to them;
• to applicants that intend to provide only account information services (AIS, chapter
  4.2);
• to those payment service providers (PSPs) under Article 32 of PSD2 or Article 9 of
  Directive 2009/110/EC (EMD) that have not been exempted from all of the information requirements under Article 5 of PSD2, but only regarding those specific, non-exempted requirements;
• to electronic money institutions, in line with Article 3(1) of Directive (EU) 2009/110,
  the E-Money Directive (EMD), which states that Article 5 of PSD2 shall apply to electronic money institutions mutatis mutandis (chapter 4.3).

1 See http://www.eba.europa.eu/regulation-and-policy/payment-services-and-electronic-money/guidelines-on￾authorisation-and-registration-under-psd2

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
4. The EBA received 23 responses to its consultation, which the EBA assessed to decide which, if
any, changes should be made before finalising the GLs. The rationale section (section 2.2) below assesses four concerns that were raised particularly often by respondents, which is followed by the final GLs in Chapter 3. Chapter 4 provides an exhaustive and comprehensive assessment of all of the comments that the EBA had received.
2.2 Rationale
5. Overall, the respondents agreed with the objectives of the GLs set out by the EBA in the CP
(for applicants; for CAs and Member States; for payment service users; and for the EBA). In addition, a few respondents requested that a further objective for account information service providers should be added, specifically that the GLs seek to strengthen the liability regime governing the interactions between the different actors involved in electronic payment transactions. In the respondents’ view, from the perspective of account servicing payment service providers (ASPSPs), the GLs should contain clear and precise rules to increase the certainty with which ASPSPs can make decisions and, ultimately, the GLs should strengthen the principle of legal certainty.
6. The EBA agrees with this proposal and to add this objective to those that the EBA had set out
in the CP. However, the EBA clarifies that the rules on rights, obligations and the liability regime among PSPs are set out in Title IV of PSD2 itself, whereas the GLs that the EBA has been mandated to develop under Article 5 merely specify the information to be submitted in the application for authorisation as PIs. The GLs therefore contribute to providing certainty to market participants only indirectly. When assessing the responses, the following four concerns emerged as particularly noteworthy: the scope of the GLs, the great level of detail of the information that is to be provided, the potentially disproportionate impact of the GLs on smaller and/or less complex applicants, and the transitional provisions. Scope of the guidelines
7. Some respondents had doubts about the scope of application of the GLs, specifically if they
were also addressed to credit institutions that provide AIS or PIS, and also queried which set of GLs apply to applicants that intend to provide both AIS and PIS. The EBA hereby clarifies that credit institutions are outside the scope of the GLs. Applicants that apply for both AIS and PIS are subject to the first set of GLs set out in this document, i.e. Guidelines on information required from applicants for authorisation as PIs for the provision of services 1-8 of Annex I to PSD2.
8. The EBA has further clarified the scope by introducing a new paragraph 1 to GL 1 of each of
the three sets of GLs applicable to PIs, AISPs and EMIs.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Level of detail of the guidelines
9. Several respondents considered that the proposed GLs were too detailed, which in their view
could have the effect of discouraging new entrants from applying, increasing the time required by authorities to assess applications, and adding to the ongoing regulatory burden as information needs to be updated.
10. Respondents also considered that the level of detail could provide information on ways in
which the organisation could be attacked by those trying to gain a foothold onto the networks of the organisation. In addition, respondents were of the view that the excessive level of detail could also potentially prevent or deter innovative solutions.
11. Respondents were also of the view that there is a lack of clarity about the basis upon which
the CA will decide whether or not to grant authorisation and they raise the concern that there is a risk of a race to the bottom or of regulatory arbitrage if there is not sufficient detail on how regulators in Member States are supposed to make judgements on all of the required documentation.
12. The EBA assessed the merits of this concern but concluded that the level of detail is necessary
given the fully harmonised nature of Article 5 of PSD2 which prevents national competent authorities (CASs) from maintaining provisions other than those in the Directive. If the guidelines are not sufficiently comprehensive, there would be a lack of certainty for PIs as to the expectations of CAs.
13. Moreover, the EBA is of the view that detailed requirements, as opposed to general
principles, reduce the margin of discretion of CASs when assessing applications, and hence mitigate the race-to-the-bottom issue raised by some respondents and contribute to a level playing field among applicants across Member States.
14. The EBA also considers that the level of detail contributes to transparency for applicants, will
help them better prepare for their application and will prevent follow-up requests for additional information at a later stage.
15. However, and in application of proportionality considerations based on the lower risk
associated with the activities of PIs than with the activities of credit institutions, the EBA has decided to streamline the information requirements, without prejudice to the compliance with the EU requirement that is applicable to credit institutions and PIs alike. The EBA has therefore streamlined and/or removed the following GLs from the first set of GLs (and corresponding GLs in the second and third sets):

• GL 1
• GL 2 (h) and (i)

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2

• GL 3 (a), (b), (c), (e), (i) and (j)
• GL 4 (a), (c)(iii), (d) and (e)
• GL 5 (b), (c), (e)(ii) and (iii)
• GL 7 (b), (d) and a new point (e)
• GL 8 (b), (c), (f), (i) and (j)
• GL 9
• GL 10 (a) and (e)
• GL 11 (e)
• GL 12 (g), (h) and (i)
• GL 13 (c) and (j)
• GL 14 (c)
• GL 15 (1), 15(2), 15(3), 15(5)(b) and (f), and 15(6)
• GL 16 (a), (i), (b), (c) and (e)
• GL 17
• GL 18.
  The potentially disproportionate impact of the guidelines on smaller and/or less complex applicants

16. Some respondents raised the concern that the level of information required for small
    payment institutions, payment initiation service providers (PISPs) and AISPs is disproportionate and will result in a significant burden, especially for small entities that could, as a result, be discouraged from entering the market.
17. The EBA has assessed this concern and would like to recall that:
    i. A significant degree of proportionality is already achieved through the
    Directive itself, specifically in Article 32 for small payment institutions and
    Article 33 for AISPs.
    ii. Notwithstanding, the EBA acknowledges that, while the applicants have to
    comply with all of the requirements, the level of detail provided can plausibly vary depending on a number of factors.
18. To that end, the EBA has modified GL 1 to clarify that the information provided by applicants
    should be true, complete, accurate and up to date, and the level of detail should be proportionate and adjusted to the particular service or services that the applicant intends to

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 provide, namely their nature, scope, complexity and riskiness, and to the institution’s size and internal organisation.
19. The EBA then assessed the extent to which additional elements of proportionality could be
introduced into the GLs, for example for particular types of legal entities such as applicants below a particular size, AISPs, PISPs, distributors (but not agents) and PIs (but not credit institutions). The EBA has also considered proportionality overall and has assessed whether or not some requirements could be removed for all applicants regardless of their nature.
20. As regards additional proportionality for smaller applicants, the EBA assessed the option of
removing specific pieces of information, for example by setting a specific threshold for a particular criterion (such as the volume of transactions) below which the entity would need to provide less information, while still complying with all the requirements of Article 5 of PSD2.
21. However, the EBA arrived at the conclusion that this option is not viable because Article 5 of
PSD2 does not allow for any type of PSP to be exempted from any of the requirements listed therein, and because, from a practical perspective, the imposition of a threshold would require the PSP to provide additional documents to the CAS. In addition, PSD2 already provides for exemptions under certain thresholds; therefore, proportionality for smaller players is already provided in PSD2 itself.
22. Such is the case for natural or legal persons providing payment services as referred to in
points (1) to (6) of Annex I; such persons can be exempted at national level from the application of all or part of the procedure and conditions set out in Sections 1, 2 and 3. This applies with the exception of Articles 14, 15, 22, 24, 25 and 26, where the monthly average of the preceding 12 months’ total value of payment transactions executed by the person concerned, including any agent for which it assumes full responsibility, does not exceed a limit set by the Member State but that, in any event, amounts to no more than EUR 3 million; and where none of the natural persons responsible for the management or operation of the business has been convicted of offences relating to money laundering or terrorist financing or other financial crimes.
23. As regards additional proportionality for AISPs and PISPs, the EBA assessed the possibility of
exempting these providers from certain information requirements. As a result, the EBA decided to make several changes, specifically exempting AISPs from the requirement on the description of the mitigation measures to be adopted by the applicant, in case of termination of its payment service activities, in order to avoid adverse effects on payment systems and on the payment service users, ensuring execution of pending payment transactions and termination of existing contracts; and the requirement on the framework contract, and the information regarding any trade association the applicant plans to join. The rationale behind this is the specificity of the business model.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
24. In a further effort to streamline the GLs, the EBA has removed GLs 5(1) (e) and 5(2) (e) from
the second set of GLs, which had required undertakings to provide information regarding their access to payment systems. This is because the EBA could not identify a plausible scenario under which AISPs would have access to such systems.
25. The EBA arrived at the conclusion that no further changes should be made because such
exemptions are already provided in PSD2 itself, through Article 33 of PSD2 for AISPs (for example the requirements related to AML and statutory auditors), which are accordingly reflected in the GLs, too.
26. As for PISPs, the GLs already take into account that these providers do not enter into
possession of funds and that, accordingly, all the information related to this is not required. The EBA therefore considers the level of information requested from these providers to be proportionate to their business model.
27. As regards more proportionality for distributors than for agents, PSD2 is not conclusive as to
whether distributors and agents should be subject to the same requirements. Article 111(1)(a) of PSD2 provides that Article 5 of PSD2 is applicable mutatis mutandis to EMIs as a result of which the third set of GLs in the CP applies to EMIs. Following this mutatis mutandis principle, references to distributors of electronic money were added in all the GLs that refer to agents:

• GL 5(e), which relates to Article 5(l) of PSD2;
• GL 8(h), which relates to Article 5(e) of PSD2;
• GL 12(b), which relates to Article 5(i) of PSD2;
• GL 14(c), (d) and (g), which relate to Article 5(k) of PSD2.

28. The EBA assessed whether some of the information requirements above could be deleted on
    the grounds of being disproportionate for distributors compared with agents. The assessment started with the information required on the structural organisation of PIs/EMIs, the description of the intended use of agents and the at least annual on-site and off-site checks that the applicant undertakes to perform on them. However, the EBA concluded that distributors should be considered as part of the structural organisation of EMIs in the same way agents are, and are therefore to be included in the description of its structural organisation by the EMI.
29. Regarding proportionality for PIs as compared with credit institutions, the EBA has assessed
    all pieces of information and compared them with those required for credit institutions under Directive (EU) 2013/36/EU (CRD IV) in order to ensure that the requirements are not disproportionate compared with those applicable to credit institutions when providing payment services. The EBA concluded that some requirements are indeed too specific to the prudential regulation of credit institutions, that they would therefore not be proportionate for PIs, and that they could therefore be removed or streamlined. The EBA therefore removed

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 from the GLs several requirements, such as GL 16.1(c) that relates to information on financial and non-financial interests.
30. Finally, the EBA has removed GL 10.1(j): ‘any other information relevant to the risks arising
from the specific activities of the applicant’ which was considered too open and hence disproportionate for the applicant. Transitional provisions
31. Several respondents have raised concerns with regard to transitional issues that may arise
and have requested the EBA to clarify , among other things, the following:
a. whether or not existing addressees of the GLs that are already licensed need to reapply for a licence; b. when, in time, existing providers of AIS and PIS need to apply for authorisation.
32. Transitional provisions are regulated in PSD2, specifically in Articles 109 and 115.5 of PSD2.
Hence, the clarification of these is out of the scope of the GLs. The EBA will explore which, if any, EBA measures are available to provide clarity to the market later in the year.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
3. Guidelines

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 EBA/GL/2017/09 11/07/2017 Guidelines on the information to be provided for the authorisation of payment institutions and e-money institutions and for the registration of account information service providers under
Article 5(5) of Directive (EU) 2015/2366

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 1.Compliance and reporting obligations Status of these guidelines

1. This document contains guidelines issued pursuant to Article 16 of Regulation (EU)
   No 1093/20102
   . In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities and financial institutions must make every effort to comply with the guidelines.
2. Guidelines set out the EBA’s view of appropriate supervisory practices within the European
   System of Financial Supervision or of how Union law should be applied in a particular area. Competent authorities as defined in Article 4(2) of Regulation (EU) No 1093/2010 to whom guidelines apply should comply by incorporating them into their practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where guidelines are directed primarily at institutions. Reporting requirements
3. In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities
   must notify the EBA that they comply or intend to comply with these guidelines, or otherwise give reasons for non-compliance, by two months after publication of all the translations in all EU languages. In the absence of any notification by this deadline, competent authorities will be considered by the EBA to be non-compliant. Notifications should be sent by submitting the form available on the EBA website to compliance@eba.europa.eu with the reference ‘EBA/GL/2017/09’. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Any change in the status of compliance must also be reported to the EBA.
4. Notifications will be published on the EBA website, in line with Article 16(3).

2 Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12).

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 2.Subject matter, scope and definitions Subject matter
5. These guidelines set out the information to be provided to the competent authorities in the
application for the authorisation of payment institutions, in the application for registration of account information service providers and in the application for authorisation of electronic money institutions. Scope of application
6. These guidelines apply in relation to: (a) applications for authorisation as a payment
institution in accordance with Article 5 of Directive (EU) 2015/2366; (b) registration as an account information service provider, in accordance with Article 5 and Article 33 of Directive (EU) 2015/2366; and (c) applications for authorisation as an electronic money institution, by virtue of the application mutatis mutandis of Article 5 of Directive (EU) 2015/2366 to electronic money institutions, in accordance with Article 3(1) of Directive 2009/110/EC. Addressees
7. These guidelines are addressed to competent authorities, as defined in point (i) of Article 4(2)
of Regulation (EU) No 1093/2010, and to the following financial institutions: payment institutions as defined in point (4) of Article 4 of Directive (EU) 2015/2366; electronic money institutions as defined in point (1) of Article 2 of Directive 2009/110/EC; and account information service providers as defined in point (19) of Article 4 of Directive (EU) 2015/2366. Definitions
8. The terms used and defined in Directive (EU) 2015/2366 and Directive 2009/110/EC have the
same meaning in the guidelines.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
3. Implementation
Date of application
9. These guidelines apply from 13 January 2018.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
4. Four sets of Guidelines, applicable to
payment institutions (PIS), account information services providers (AISPs), electronic money institutions (EMIs), and competent authorities (CAs) respectively

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
4.1. Guidelines on the information
required from applicants for authorisation as payment institutions for the provision of services 1-8 of
Annex I to Directive (EU) 2015/2366
Guideline 1: General principles
1.1 This set of guidelines applies to applicants for authorisation as payment institutions (PIs).
This includes applicants that intend to provide any service(s) referred to in points 1-7 of
Annex I to PSD2 or service 8 in combination with other payment services. Applicants that
intend to provide only the service referred to in point 8 of Annex I to Directive (EU) 2015/2366 (PSD2) are subject to the specific set of guidelines for account information service providers (AISPs) set out in section 4.2.
1.2 The information provided by applicants should be true, complete, accurate and up to date.
All applicants should comply with all the provisions in the set of guidelines that applies to them. The level of detail should be proportionate to the applicant’s size and internal organisation, and to the nature, scope, complexity and riskiness of the particular service(s) that the applicant intends to provide. In any event, in accordance with Directive (EU) 2015/2366, the directors and the persons responsible for the management of the payment institution are of good repute and possess appropriate knowledge and experience to perform payment services, regardless of the institution’s size, internal organisation and the nature, scope and complexity of its activities and the duties and responsibilities of the specific position.
1.3 When submitting the information required, the applicant should avoid making references
to specific sections of internal procedures/documents. Instead, the applicant should extract the relevant sections and provide these to the competent authority (CA).
1.4 Should the CAs require clarifications on the information that has been submitted, the
applicant should provide such clarification without delay.
1.5 All data requested under these guidelines for authorisations as payment institutions are
needed for the assessment of the application and will be treated by the CA in accordance with the professional secrecy obligations set out in PSD2, without prejudice to applicable

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Union law and national requirements and procedures on the exercise of the right to access, rectify, cancel or oppose. Guideline 2: Identification details
2.1 The identification details to be provided by the applicant should contain the following
information:
a) the applicant’s corporate name and, if different, trade name; b) an indication of whether the applicant is already incorporated or in process of incorporation; c) the applicant’s national identification number, if applicable; d) the applicant’s legal status and (draft) articles of association and/or constitutional documents evidencing the applicant’s legal status; e) the address of the applicant’s head office and registered office; f) the applicant’s electronic address and website, if available; g) the name(s) of the person(s) in charge of dealing with the application file and authorisation procedure, and their contact details; h) an indication of whether or not the applicant has ever been, or is currently being, regulated by a competent authority in the financial services sector; i) any trade association(s) in relation to the provision of payment services that the applicant plans to join, where applicable; j) the register certificate of incorporation or, if applicable, negative certificate of a mercantile register that certifies that the name applied by the company is available; k) evidence of the payment of any fees or of the deposit of funds to file an application for authorisation as a payment institution, where applicable under national law. Guideline 3: Programme of operations
3.1. The programme of operations to be provided by the applicant should contain the following
information:
a) a step-by-step description of the type of payment services envisaged, including an explanation of how the activities and the operations that will be provided are identified

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 by the applicant as fitting into any of the legal categories of payment services listed in
Annex I to PSD2.
b) a declaration of whether the applicant will at any point enter or not into possession of funds; c) a description of the execution of the different payment services, detailing all parties involved, and including for each payment service provided:
i. a diagram of flow of funds, unless the applicant intends to provide payment
initiation services (PIS) only;
ii. settlement arrangements, unless the applicant intends to provide PIS only;
iii. draft contracts between all the parties involved in the provision of payment
services including those with payment card schemes, if applicable;
iv. processing times.
d) a copy of the draft framework contract, as defined in Article 4(21) of PSD2; e) the estimated number of different premises from which the applicant intends to provide the payment services, and/or carry out activities related to the provision of the payment services, if applicable; f) a description of any ancillary services to the payment services, if applicable; g) a declaration of whether or not the applicant intends to grant credit and, if so, within which limits; h) a declaration of whether or not the applicant plans to provide payment services in other Member States or third countries after the granting of the licence; i) an indication of whether or not the applicant intends, for the next three years, to provide or already provides other business activities as referred to in Article 18 of Directive (EU) 2015/2366, including a description of the type and expected volume of the activities; j) the information specified in the EBA Guidelines on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantee under Article 5(4) of Directive (EU) 2015/2366 where the applicant intends to provide services 7 and 8 (PIS and account information services (AIS).

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Guideline 4: Business plan
4.1. The business plan to be provided by the applicant should contain:
a) a marketing plan consisting of:
i. an analysis of the company’s competitive position in the payment market
segment concerned;
ii. a description of the payment service users, marketing materials and distribution
channels; b) where available for existing companies, certified annual accounts for the previous three years, or a summary of the financial situation for those companies that have not yet produced annual accounts; c) a forecast budget calculation for the first three financial years that demonstrates that the applicant is able to employ appropriate and proportionate systems, resources and procedures that allow the applicant to operate soundly; it should include:
i. an income statement and balance-sheet forecast, including target scenarios and
stress scenarios as well as their base assumptions, such as volume and value of transactions, number of clients, pricing, average amount per transaction, expected increase in profitability threshold;
ii. explanations of the main lines of income and expenses, the financial debts and
the capital assets;
iii. a diagram and detailed breakdown of the estimated cash flows for the next
three years; d) information on own funds, including the amount and detailed breakdown of the composition of initial capital as set out in Article 7 of PSD2; e) information on, and calculation of, minimum own funds requirements in accordance with the method(s) referred to in Article 9 of Directive (EU) 2015/2366 (PSD2) as determined by the competent authority, unless the applicant intends to provide PIS only, including:
i. an annual projection of the breakdown of the own funds for three years
according to the method used;
ii. an annual projection of the own funds for three years according to the other
methods.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Guideline 5: Structural organisation
5.1. The applicant should provide a description of the structural organisation of its undertaking
consisting of:
a) a detailed organisational chart, showing each division, department or similar structural separation, including the name of the person(s) responsible, in particular those in charge of internal control functions; the chart should be accompanied by descriptions of the functions and responsibilities of each division, department or similar structural separation; b) an overall forecast of the staff numbers for the next three years; c) a description of relevant operational outsourcing arrangements consisting of:
i. the identity and geographical location of the outsourcing provider;
ii. the identity of the persons within the payment institution that are responsible
for each of the outsourced activities;
iii. a clear description of the outsourced activities and their main characteristics;
d) a copy of draft outsourcing agreements; e) a description of the use of branches and agents, where applicable, including:
i. a mapping of the off-site and on-site checks that the applicant intends to
perform, at least annually, on branches and agents and their frequency;
ii. the IT systems, the processes and the infrastructure that are used by the
applicant’s agents to perform activities on behalf of the applicant;
iii. in the case of agents, the selection policy, monitoring procedures and agents’
training and, where available, the draft terms of engagement;
iv. an indication of the national and/or international payment system that the
applicant will access, if applicable; f) a list of all natural or legal persons that have close links with the applicant, indicating their identities and the nature of those links.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Guideline 6: Evidence of initial capital
6.1. For the evidence of initial capital to be provided by the applicant (of EUR 125 000 for
services 1-5 of Annex I to PSD2; EUR 20 000 for service 6; and EUR 50 000 for service 7), the applicant should submit the following documents:
a) for existing undertakings, an audited account statement or public register certifying the amount of capital of the applicant; b) for undertakings in the process of being incorporated, a bank statement issued by a bank certifying that the funds are deposited in the applicant’s bank account. Guideline 7: Measures to safeguard the funds of payment service users (applicable to payment services 1-6 only)
7.1. Where the applicant safeguards the payment service users’ funds through depositing funds
in a separate account in a credit institution or through an investment in secure, liquid, low￾risk assets, the description of the safeguarding measures should contain:
a) a description of the investment policy to ensure the assets chosen are liquid, secure and low risk, if applicable; b) the number of persons that have access to the safeguarding account and their functions; c) a description of the administration and reconciliation process to ensure that payment service users’ funds are insulated in the interest of payment service users against the claims of other creditors of the payment institution, in particular in the event of insolvency; d) a copy of the draft contract with the credit institution; e) an explicit declaration by the payment institution of compliance with Article 10 of PSD2.
7.2. Where the applicant safeguards the funds of the payment service user through an
insurance policy or comparable guarantee from an insurance company or a credit institution, the description of the safeguarding measures should contain the following:
a) a confirmation that the insurance policy or comparable guarantee from an insurance company or a credit institution is from an entity that is not part of the same group of firms as the applicant; b) details of the reconciliation process in place to ensure that the insurance policy or comparable guarantee is sufficient to meet the applicant’s safeguarding obligations at all times;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 c) duration and renewal of the coverage; d) a copy of the (draft) insurance agreement or the (draft) comparable guarantee. Guideline 8: Governance arrangements and internal control mechanisms
8.1. The applicant should provide a description of the governance arrangement and the internal
control mechanisms consisting of:
a) a mapping of the risks identified by the applicant, including the type of risks and the procedures the applicant will put in place to assess and prevent such risks; b) the different procedures to carry out periodical and permanent controls including the frequency and the human resources allocated; c) the accounting procedures by which the applicant will record and report its financial information; d) the identity of the person(s) responsible for the internal control functions, including for periodic, permanent and compliance control, as well as an up-to-date curriculum vitae; e) the identity of any auditor that is not a statutory auditor pursuant to Directive 2006/43/EC; f) the composition of the management body and, if applicable, of any other oversight body or committee; g) a description of the way outsourced functions are monitored and controlled so as to avoid an impairment in the quality of the payment institution’s internal controls; h) a description of the way any agents and branches are monitored and controlled within the framework of the applicant’s internal controls; i) where the applicant is the subsidiary of a regulated entity in another EU Member State, a description of the group governance. Guideline 9: Procedure for monitoring, handling and following up on security incidents and security-related customer complaints
9.1. The applicant should provide a description of the procedure in place to monitor, handle and
follow up on security incidents and security-related customer complaints to be provided by the applicant, which should contain:
a) organisational measures and tools for the prevention of fraud;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 b) details of the individual(s) and bodies responsible for assisting customers in cases of fraud, technical issues and/or claim management; c) reporting lines in cases of fraud; d) the contact point for customers, including a name and email address; e) the procedures for the reporting of incidents, including the communication of these reports to internal or external bodies, including notification of major incidents to national competent authorities under Article 96 of PSD2, and in line with the EBA guidelines on incident reporting under the referred Article. f) the monitoring tools used and the follow-up measures and procedures in place to mitigate security risks. Guideline 10: Process for filing, monitoring, tracking and restricting access to sensitive payment data
10.1. The applicant should provide a description of the process in place to file, monitor, track and
restrict access to sensitive payment data consisting of:
a) a description of the flows of data classified as sensitive payment data in the context of the payment institution’s business model; b) the procedures in place to authorise access to sensitive payment data; c) a description of the monitoring tool; d) the access right policy, detailing access to all relevant infrastructure components and systems, including databases and back-up infrastructures; e) unless the applicant intends to provide PIS only, a description of how the collected data are filed; f) unless the applicant intends to provide PIS only, the expected internal and/or external use of the collected data, including by counterparties; g) the IT system and technical security measures that have been implemented including encryption and/or tokenisation; h) identification of the individuals, bodies and/or committees with access to the sensitive payment data; i) an explanation of how breaches will be detected and addressed;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 j) an annual internal control programme in relation to the safety of the IT systems. Guideline 11: Business continuity arrangements
11.1. The applicant should provide a description of the business continuity arrangements
consisting of the following information:
a) a business impact analysis, including the business processes and recovery objectives, such as recovery time objectives, recovery point objectives and protected assets; b) the identification of the back-up site, access to IT infrastructure, and the key software and data to recover from a disaster or disruption; c) an explanation of how the applicant will deal with significant continuity events and disruptions, such as the failure of key systems; the loss of key data; the inaccessibility of the premises; and the loss of key persons; d) the frequency with which the applicant intends to test the business continuity and disaster recovery plans, including how the results of the testing will be recorded; e) a description of the mitigation measures to be adopted by the applicant, in cases of the termination of its payment services, ensuring the execution of pending payment transactions and the termination of existing contracts. Guideline 12: The principles and definitions applicable to the collection of statistical data on performance, transactions and fraud
12.1. The applicant should provide a description of the principles and definitions applicable to
the collection of the statistical data on performance, transactions and fraud consisting of the following information:
a) the type of data that is collected, in relation to customers, type of payment service, channel, instrument, jurisdictions and currencies; b) the scope of the collection, in terms of the activities and entities concerned, including branches and agents; c) the means of collection; d) the purpose of collection; e) the frequency of collection; f) supporting documents, such as a manual, that describe how the system works.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Guideline 13: Security policy document
13.1. The applicant should provide a security policy document containing the following
information:
a) a detailed risk assessment of the payment service(s) the applicant intends to provide, which should include risks of fraud and the security control and mitigation measures taken to adequately protect payment service users against the risks identified; b) a description of the IT systems, which should include:
i. the architecture of the systems and their network elements;
ii. the business IT systems supporting the business activities provided, such as the
applicant’s website, wallets, the payment engine, the risk and fraud management engine, and customer accounting;
iii. the support IT systems used for the organisation and administration of the
applicant, such as accounting, legal reporting systems, staff management, customer relationship management, e-mail servers and internal file servers;
iv. information on whether those systems are already used by the applicant or its
group, and the estimated date of implementation, if applicable; c) the type of authorised connections from outside, such as with partners, service providers, entities of the group and employees working remotely, including the rationale for such connections; d) for each of the connections listed under point c), the logical security measures and mechanisms in place, specifying the control the applicant will have over such access as well as the nature and frequency of each control, such as technical versus organisational; preventative versus detective; and real-time monitoring versus regular reviews, such as the use of an active directory separate from the group, the opening/closing of communication lines, security equipment configuration, generation of keys or client authentication certificates, system monitoring, authentication, confidentiality of communication, intrusion detection, antivirus systems and logs; e) the logical security measures and mechanisms that govern the internal access to IT systems, which should include:
i. the technical and organisational nature and frequency of each measure, such as
whether it is preventative or detective and whether or not it is carried out in real time;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
ii. how the issue of client environment segregation is dealt with in cases where the
applicant’s IT resources are shared; f) the physical security measures and mechanisms of the premises and the data centre of the applicant, such as access controls and environmental security; g) the security of the payment processes, which should include:
i. the customer authentication procedure used for both consultative and
transactional access, and for all underlying payment instruments;
ii. an explanation of how safe delivery to the legitimate payment service user and
the integrity of authentication factors, such as hardware tokens and mobile applications, are ensured, at the time of both initial enrolment and renewal;
iii. a description of the systems and procedures that the applicant has in place for
transaction analysis and the identification of suspicious or unusual transactions; h) a detailed risk assessment in relation to its payment services, including fraud, with a link to the control and mitigation measures explained in the application file, demonstrating that the risks are addressed; i) a list of the main written procedures in relation to the applicant’s IT systems or, for procedures that have not yet been formalised, an estimated date for their finalisation. Guideline 14: Internal control mechanisms to comply with obligations in relation to money laundering and terrorist financing (AML/CFT obligations)
14.1. The description of the internal control mechanisms that the applicant has established in
order to comply, where applicable, with those obligations should contain the following information:
a) the applicant’s assessment of the money laundering and terrorist financing risks associated with its business, including the risks associated with the applicant’s customer base, the products and services provided, the distribution channels used and the geographical areas of operation; b) the measures the applicant has or will put in place to mitigate the risks and comply with applicable anti-money laundering and counter terrorist financing obligations, including the applicant’s risk assessment process, the policies and procedures to comply with customer due diligence requirements, and the policies and procedures to detect and report suspicious transactions or activities;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 c) the systems and controls the applicant has or will put in place to ensure that its branches and agents comply with applicable anti-money laundering and counter terrorist financing requirements, including in cases where the agent or branch is located in another Member State; d) arrangements the applicant has or will put in place to ensure that staff and agents are appropriately trained in anti-money laundering and counter terrorist financing matters; e) the identity of the person in charge of ensuring the applicant’s compliance with anti￾money laundering and counter-terrorism obligations, and evidence that their anti￾money laundering and counter-terrorism expertise is sufficient to enable them to fulfil this role effectively; f) the systems and controls the applicant has or will put in place to ensure that its anti￾money laundering and counter terrorist financing policies and procedures remain up to date, effective and relevant; g) the systems and controls the applicant has or will put in place to ensure that the agents do not expose the applicant to increased money laundering and terrorist financing risk; h) the anti-money laundering and counter terrorism manual for the staff of the applicant. Guideline 15: Identity and suitability assessment of persons with qualifying holdings in the applicant
15.1 For the purposes of the identity and evidence of the suitability of persons with qualifying
holdings in the applicant payment institution, without prejudice to the assessment in accordance with the criteria, as relevant, introduced with Directive 2007/44/EC and specified in the joint guidelines for the prudential assessment of acquisitions of qualifying holdings (JC/GL/2016/01), the applicant should submit the following information:
a) a description of the group to which the applicant belongs and an indication of the parent undertaking, where applicable; b) a chart setting out the shareholder structure of the applicant, including:
i) the name and the percentage holding (capital/voting right) of each person that has or will have a direct holding in the share capital of the applicant, identifying those that are considered as qualifying holders and the reason for such qualifications; ii) the name and the percentage holding (capital/voting rights) of each person that has or will have an indirect holding in the share capital of the applicant,

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 identifying those that are considered as indirect qualifying holders and the reason for such qualification; c) a list of the names of all persons and other entities that have or, in the case of authorisation, will have qualifying holdings in the applicant’s capital, indicating for each such person or entity:
i. the number and type of shares or other holdings subscribed or to be subscribed;
ii. the nominal value of such shares or other holdings.
15.2 Where a person who has or, in the case of authorisation, will have a qualifying holding in
the applicant’s capital is a natural person, the application should set out all of the following information relating to the identity and suitability of that person:
a) the person’s name and name at birth, date and place of birth, citizenship (current and previous), identification number (where available) or passport number, address and a copy of an official identity document; b) a detailed curriculum vitae stating the education and training, previous professional experience and any professional activities or other functions currently performed; c) a statement, accompanied by supporting documents, containing the following information concerning the person:
i. subject to national legislative requirements concerning the disclosure of spent
convictions, any criminal conviction or proceedings where the person has been found against and which were not set aside;
ii. any civil or administrative decisions in matters of relevance to the assessment or
authorisation process where the person has been found against and any administrative sanctions or measures imposed as a consequence of a breach of laws or regulations (including disqualification as a company director), in each case which were not set aside and against which no appeal is pending or may be filed;
iii. any bankruptcy, insolvency or similar procedures;
iv. any pending criminal investigations;
v. any civil or administrative investigations, enforcement proceedings, sanctions or
other enforcement decisions against the person concerning matters that may be considered relevant to the authorisation to commence the activity of a payment institution or to the sound and prudent management of a payment institution;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
vi. where such documents can be obtained, an official certificate or any other
equivalent document evidencing whether or not any of the events set out in sub-paragraphs (i)-(v) has occurred in respect of the relevant person;
vii. any refusal of registration, authorisation, membership or licence to carry out
trade, business or a profession;
viii. any withdrawal, revocation or termination of a registration, authorisation,
membership or licence to carry out trade, business or a profession;
ix. any expulsion by an authority or public sector entity in the financial services
sector or by a professional body or association;
x. any position of responsibility with an entity subject to any criminal conviction or
proceedings, administrative investigations, sanctions or other enforcement decisions for conduct failings, including in respect of fraud, dishonesty, corruption, money laundering, terrorist financing or other financial crime, or of failure to put in place adequate policies and procedures to prevent such events, held at the time when the alleged conduct occurred, together with details of such occurrences and of the person’s involvement, if any, in them;
xi. any dismissal from employment or a position of trust, any removal from a
fiduciary relationship (other than as a result of the relevant relationship coming to an end by passage of time) and any similar situation; d) a list of undertakings that the person directs or controls and of which the applicant is aware of after due and careful enquiry; the percentage of control either direct or indirect in these companies; their status (whether or not they are active, dissolved, etc.); and a description of insolvency or similar procedures; e) where an assessment of reputation of the person has already been conducted by a competent authority in the financial services sector, the identity of that authority and the outcome of the assessment; f) the current financial position of the person, including details concerning sources of revenues, assets and liabilities, security interests and guarantees, whether granted or received; g) a description of any links to politically exposed persons, as defined in Article 3(9) of Directive (EU) 2015/8493 .

3 Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (OJ L 141, 5.6.2015, p. 73).

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
15.3 Where a person or entity who has or, in the case of authorisation, will have a qualifying
holding in the applicant’s capital (including entities that are not a legal person and which hold or should hold the participation in their own name), the application should contain the following information relating to the identity and suitability of that legal person or entity:
a) name; b) where the legal person or entity is registered in a central register, commercial register, companies register or similar register that has the same purposes of those aforementioned, a copy of the good standing, if possible, or otherwise a registration certificate; c) the addresses of its registered office and, where different, of its head office, and principal place of business; d) contact details; e) corporate documents or, where the person or entity is registered in another Member State, a summary explaining the main legal features of the legal form or the entity; f) whether or not the legal person or entity has ever been or is regulated by a competent authority in the financial services sector or other government body; g) where such documents can be obtained, an official certificate or any other equivalent document evidencing the information set out in paragraphs (a) to (e) issued by the relevant competent authority; h) the information referred to in Guideline 15(2)(c),15(2)(d) 15(2)(e), 15(2)(f),and 15(2)(g) in relation to the legal person or entity; i) a list containing details of each person who effectively directs the business of the legal person or entity, including their name, date and place of birth, address, their national identification number, where available, and a detailed curriculum vitae (stating relevant education and training, previous professional experience, any professional activities or other relevant functions currently performed), together with the information referred to in Guideline 15(2)(c) and 15(2)(d) in respect of each such person; j) the shareholding structure of the legal person, including at least their name, date and place of birth, address and, where available, personal identification number or registration number, and the respective share of capital and voting rights of direct or indirect shareholders or members and beneficial owners, as defined in Article 3(6) of Directive (EU) 2015/849;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 k) a description of the regulated financial group of which applicant is a part, or may become a part, indicating the parent undertaking and the credit, insurance and security entities within the group; the name of their competent authorities (on an individual or consolidated basis); and l) annual financial statements, at the individual and, where applicable, the consolidated and sub-consolidated group levels, for the last three financial years, where the legal person or entity has been in operation for that period (or, if less than three years, the period for which the legal person or entity has been in operation and for which financial statements have been prepared), approved by the statutory auditor or audit firm within the meaning of Directive 2006/43/EC4 , where applicable, including each of the following items:
i. the balance sheet;
ii. the profit-and-loss accounts or income statement;
iii. the annual reports and financial annexes and any other documents registered
with the relevant registry or competent authority of the legal person; m) where the legal person has not been operating for a sufficient period to be required to prepare financial statements for the three financial years immediately prior to the date of the application, the application shall set out the existing financial statements (if any); n) where the legal person or entity has its head office in a third country, general information on the regulatory regime of that third country as applicable to the legal person or entity, including information on the extent to which the third country’s anti￾money laundering and counter-terrorist financing regime is consistent with the Financial Action Task Force Recommendations; o) for entities that do not have legal personality such as a collective investment undertaking, a sovereign wealth fund or a trust, the application shall set out the following information:
i. the identity of the persons who manage assets and of the persons who are
beneficiaries or subscribers;
ii. a copy of the document establishing and governing the entity including the
investment policy and any restrictions on investment applicable to the entity.

4 Directive 2006/43/EC of the European Parliament and of the Council of 17 May 2006 on statutory audits of annual accounts and consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC (OJ L 157, 9.6.2006, p. 87-107).

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
15.4. The application shall set out all of the following information for each natural or legal person
or entity who has or, in the case of authorisation, will have a qualifying holding in the capital of the applicant:
a) details of that person’s or entity’s financial or business reasons for owning that holding and the person’s or the entity’s strategy regarding the holding, including the period for which the person or the entity intends to hold the holding and any intention to increase, reduce or maintain the level of the holding in the foreseeable future; b) details of the person’s or the entity’s intentions in respect of the applicant and of the influence the person or the entity intends to exercise over the applicant, including in respect of the dividend policy, the strategic development and the allocation of resources of the applicant, whether or not it intends to act as an active minority shareholder, and the rationale for such intention; c) information on the person’s or the entity’s willingness to support the applicant with additional own funds if needed for the development of its activities or in the case of financial difficulties; d) the content of any intended shareholder’s or member’s agreements with other shareholders or members in relation to the applicant; e) an analysis as to whether or not the qualifying holding will impact in any way, including as a result of the person’s close links to the applicant, on the ability of the applicant to provide timely and accurate information to the competent authorities; f) the identity of each member of the management body or of senior management who will direct the business of the applicant and will have been appointed by, or following a nomination from, such shareholders or members, together with, to the extent not already provided, the information set out in Guideline 16.
15.5. The application should set out a detailed explanation of the specific sources of funding for
the participation of each person or entity having a qualifying holding in the applicant’s capital, which should include:
a) details on the use of private financial resources, including their availability and (so as to ensure that the competent authority is satisfied that the activity that generated the funds is legitimate) source; b) details on access to financial markets, including details of financial instruments to be issued;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 c) information on the use of borrowed funds, including the name of the lenders and details of the facilities granted, such as maturities, terms, security interests and guarantees, as well as information on the source of revenue to be used to repay such borrowings; where the lender is not a credit institution or a financial institution authorised to grant credit, the applicant should provide to the competent authorities information on the origin of the borrowed funds; d) information on any financial arrangement with other persons who are shareholders or members of the applicant. Guideline 16: Identity and suitability assessment of directors and persons responsible for the management of the payment institution
16.1. For the purposes of the identity and suitability assessment of directors and persons
responsible for the management of the payment institution, the applicant should provide the following information:
a) personal details, including:
i. their full name, gender, place and date of birth, address and nationality, and
personal identification number or copy of ID card or equivalent;
ii. details of the position for which the assessment is sought, whether or not the
management body position is executive or non-executive. This should also include the following details:

• the letter of appointment, contract, offer of employment or relevant
  drafts, as applicable;
• the planned start date and duration of the mandate;
• a description of the individual’s key duties and responsibilities;
  b) where applicable, information on the suitability assessment carried out by the applicant, which should include details of the result of any assessment of the suitability of the individual performed by the institution, such as relevant board minutes or suitability assessment reports or other documents; c) evidence of knowledge, skills and experience, which should include a curriculum vitae containing details of education and professional experience, including academic qualifications, other relevant training, the name and nature of all organisations for which the individual works or has worked, and the nature and duration of the functions performed, in particular highlighting any activities within the scope of the position sought;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 d) evidence of reputation, honesty and integrity, which should include:
i. criminal records and relevant information on criminal investigations and
proceedings, relevant civil and administrative cases, and disciplinary actions, including disqualification as a company director, bankruptcy, insolvency and similar procedures, notably through an official certificate or any objectively reliable source of information concerning the absence of criminal conviction, investigations and proceedings, such as third-party investigations and testimonies made by a lawyer or a notary established in the European Union;
ii. a statement as to whether criminal proceedings are pending or the person or
any organisation managed by him or her has been involved as a debtor in insolvency proceedings or comparable proceedings;
iii. information concerning the following:

• investigations, enforcement proceedings or sanctions by a supervisory
  authority that the individual has been directly or indirectly involved in;
• refusal of registration, authorisation, membership or licence to carry out a
  trade, business or profession; the withdrawal, revocation or termination of registration, authorisation, membership or licence; or expulsion by a regulatory or government body or by a professional body or association;
• dismissal from employment or a position of trust, fiduciary relationship or
  similar situation, or having been asked to resign from employment in such a position, excluding redundancies;
• whether or not an assessment of reputation of the individual as an
  acquirer or a person who directs the business of an institution has already been conducted by another competent authority, including the identity of that authority, the date of the assessment and evidence of the outcome of this assessment, and the consent of the individual, where required, to seek and process such information and use the provided information for the suitability assessment;
• whether or not any previous assessment of the individual, on authority
  from another, non-financial sector, has already been conducted, including the identity of that authority and evidence of the outcome of such an assessment.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Guideline 17: Identity of statutory auditors and audit firms The identity of statutory auditors and audit firms as defined in Directive 2006/43/EC to be provided by the applicant, where relevant, should contain the names, addresses and contact details of auditors. Guideline 18: Professional indemnity insurance or a comparable guarantee for payment initiation services and account information services As evidence of a professional indemnity insurance or comparable guarantee that is compliant with EBA Guidelines on the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantee (EBA/GL/2017/08) and Article 5(2) and 5(3) of PSD2, the applicant for the provision of PIS or AIS should provide the following information:
a) an insurance contract or other equivalent document confirming the existence of professional indemnity insurance or a comparable guarantee, with a cover amount that is compliant with the referred EBA Guidelines, showing the coverage of the relevant liabilities; b) documentation of how the applicant has calculated the minimum amount in a way that is compliant with the referred EBA Guidelines, including all applicable components of the formula specified therein.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
4.2. Guidelines on the information
required from applicants for registration for the provision of only service 8 of
Annex I to Directive (EU) 2015/2366
(account information services)
Guideline 1: General principles
1.1 This set of guidelines applies to applicants for registration as account information service
providers (AISPs). This refers to applicants that intend to provide only account information services (AIS). Should the applicant intend to provide additional services to those of AIS they should apply for authorisation and refer to the guidelines set out in section 4.1 for payment institutions (PIs).
1.2 The information provided by applicants should be true, complete, accurate and up to date.
All applicants should comply with all the provisions in the set of guidelines that applies to them. The level of detail required to be compliant should be proportionate to the applicant’s size and internal organisation, and to the nature, scope, complexity and riskiness of the particular service(s) that the applicant intends to provide. In any event, in accordance with Directive EU 2015/2366, the directors and the persons responsible for the management of the payment institution are of good repute and possess appropriate knowledge and experience to perform payment services, regardless of the institution’s size, internal organisation and the nature, scope and complexity of its activities and the duties and responsibilities of the specific position.
1.3 When submitting the information required, the applicant should avoid making references
to specific sections of internal procedures/documents. Instead, the applicant should extract the relevant sections and provide these to the competent authority (CA).
1.4 Should the CAs require clarifications on the information that has been submitted, the
applicant should provide such clarification without delay.
1.5 All data requested under these guidelines for registration as account information service
providers (AISPs) are needed for the assessment of the application and will be treated by the competent authority in accordance with the professional secrecy obligations set out in PSD2, without prejudice to applicable Union law and national requirements and procedures on the exercise of the right to access, rectify, cancel or oppose.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Guideline 2: Identification details
2.1 If the applicant is a natural person, the identification details to be provided by the applicant
should contain the following information:
a) name, address, nationality and date and place of birth; b) a copy of the identity card or equivalent piece of identification; c) an updated curriculum vitae; d) a criminal record check not older than 3 months; e) the name(s) of the person(s) in charge of dealing with the application file and authorisation procedure, and their contact details.
2.2 If the applicant is a legal person, the identification details to be provided by the applicant
should contain the following information:
a) the applicant’s corporate name and, if different, trade name; b) an indication of whether the applicant is already incorporated or in process of incorporation; c) the applicant’s national identification number, if applicable; d) the applicant’s legal status and (draft) articles of association and/or constitutional documents evidencing the applicant’s legal status; e) the address of the applicant’s head office and registered office; f) the applicant’s electronic address and website, if available; g) the name of the person(s) in charge of dealing with the application file and authorisation procedure, and their contact details; h) an indication of whether or not the applicant has ever been, or is currently being, regulated by a competent authority in the financial services sector; i) the register certificate of incorporation or, if applicable, negative certificate of a mercantile register that certifies that the name applied by the company is available; j) evidence of the payment of any fees or of the deposit of funds to file an application for registration as an account information service provider, where applicable under national law.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Guideline 3: Programme of operations 3.1.The programme of operations to be provided by the applicant should contain the following information:
a) a description of the account information service that is intended to be provided, including an explanation of how the applicant determined that the activity fits the definition of account information services as defined in Article 4(16) of Directive (EU) 2015/2366 (PSD2); b) a declaration of the applicant that they will not enter at any time into possession of funds; c) a description of the provision of the account information service including:
i. draft contracts between all the parties involved, if applicable;
ii. terms and conditions of the provision of the account information services;
iii. processing times;
d) the estimated number of different premises from which the applicant intends to provide the services, if applicable; e) a description of any ancillary services to the account information service, if applicable; f) a declaration of whether or not the applicant intends to provide account information services in another EU Member State or another country once registered; g) an indication of whether the applicant intends, for the next three years, to provide, or already provides, business activities other than account information services as referred to in Article 18 of Directive 2015/2366, including a description of the type and expected volume of the activities; h) the information specified in EBA Guidelines on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantee under Article 5(4) of Directive (EU) 2015/2366 (EBA/GL/2017/08) where the applicant intends to provide only service 8 (AIS). Guideline 4: Business plan
4.1. The business plan to be provided by the applicant should contain:
a) a marketing plan consisting of:

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
i. an analysis of the company’s competitive position;
ii. a description of account information service users in the account information
market segment concerned, marketing materials and distribution channels; b) certified annual accounts for the previous three years, if available, or a summary of the financial situation for those applicants that have not yet produced annual accounts; c) a forecast budget calculation for the first three financial years that demonstrates that the applicant is able to employ appropriate and proportionate systems, resources and procedures that allow the applicant to operate soundly; it should include:
i. an income statement and balance-sheet forecast, including target scenarios and
stress scenarios as well as their base assumptions, such as number of clients, pricing and expected increase in profitability threshold;
ii. explanations of the main lines of income and expenses, the financial debts and
the capital assets;
iii. a diagram and detailed breakdown of the estimated cash flows for the next
three years.
Guideline 5: Structural organisation
5.1. If the applicant is a natural person, the description of the structural organisation of the
applicant’s undertaking should contain the following information:
a) an overall forecast of the staff numbers for the next three years; b) a description of the relevant operational outsourcing arrangements consisting of:
i. the identity and geographical location of the outsourcing provider;
ii. the identities of the persons within the AISP that are responsible for each of the
outsourced activities;
iii. a detailed description of the outsourced activities and its main characteristics;
c) a copy of draft outsourcing agreements; d) if applicable, a description of the use of branches and agents, including:
i. a mapping of the off-site and on-site checks that the applicant intends to
perform of branches and agents;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
ii. the IT systems, processes and infrastructure that are used by the applicant’s
agents to perform activities on behalf of the applicant;
iii. in the case of agents, the selection policy, monitoring procedures and agents’
training and, where available, the draft terms of engagement; e) a list of all natural or legal persons that have close links with the applicant AISP, indicating their identity and the nature of those links.
5.2. If the applicant is a legal person, the description of the structural organisation of its
undertaking should contain the following information:
a) a detailed organisational chart, showing each division, department or similar structural separation, including the name of the person(s) responsible, in particular those in charge of internal control functions; the chart should be accompanied by a description of the functions and responsibilities of each division, department or similar structural separation; b) an overall forecast of the staff numbers for the next three years; c) a description of the relevant outsourcing arrangements consisting of:
i. the identity and geographical location of the outsourcing provider;
ii. the identities of the persons within the AISP that are responsible for each of the
outsourced activities;
iii. a detailed description of the outsourced activities and its main characteristics;
d) a copy of draft outsourcing agreements; e) if applicable, a description of the use of branches and agents, including:
i. a mapping of the off-site and on-site checks that the applicant intends to
perform of branches and agents;
ii. The IT systems, processes and infrastructures that are used by the applicant’s
agents to perform activities on behalf of the applicant;
iii. in the case of agents, the selection policy, monitoring procedures and
agents’ training and, where available, the draft terms of engagement; f) a list of all natural or legal persons that have close links with the applicant, indicating their identities and the nature of those links.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Guideline 6: Governance arrangements and internal control mechanisms
6.1. The applicant should provide a description of the governance arrangement and internal
control mechanisms consisting of:
a) a mapping of the risks identified by the applicant, including the type of risks and the procedures the applicant will put in place to assess and prevent such risks; b) the different procedures intended to carry out periodical and permanent controls, including the frequency, and the human resources allocated; c) the accounting procedures by which the applicant will record and report its financial information; d) the identity of the person(s) responsible for the internal control functions, including for the periodic, permanent and compliance controls, as well as an up-to-date curriculum vitae; e) the identity of any auditor that is not a statutory auditor pursuant to Directive 2006/43/EC; f) the composition of the management body and, if applicable, any other oversight body or committee; g) a description of the way outsourced functions are monitored and controlled so as to avoid an impairment in the quality of the applicant’s internal controls; h) a description of the way any agents and branches are monitored and controlled within the framework of the applicant’s internal controls; i) where the applicant is the subsidiary of a regulated entity in another EU Member State, a description of the group governance. Guideline 7: Procedure for monitoring, handling and following up on security incidents and security-related customer complaints
7.1. The applicant should provide a description of the procedure in place to monitor, handle and
follow up on security incidents and security-related customer complaints to be provided by the applicant, which should contain:
a) organisational measures and tools for the prevention of fraud; b) details of the individuals and bodies responsible for assisting customers in cases of fraud, technical issues and/or claim management;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 c) reporting lines in cases of fraud; d) the contact point for customers, including a name and email address; e) the procedures for the reporting of incidents, including the communication of these reports to internal or external bodies, including the notification of major incidents to national competent authorities under Article 96 of PSD2 and in line with EBA guidelines on incident reporting under the referred Article. f) the monitoring tools used and the follow-up measures and procedures in place to mitigate security risks. Guideline 8: Process in place to file, monitor, track and restrict access to sensitive payment data
8.1. The applicant should provide a description of the process in place to file, monitor, track,
and restrict access to sensitive payment data consisting of:
a) a description of the flow of data classified as sensitive payment data in the context of the AISP’s business model; b) the procedures in place to authorise access to the sensitive payment data; c) a description of the monitoring tool; d) the access right policy, detailing access to all relevant infrastructure components and systems, including databases and back-up infrastructures; e) a description of how the collected data are filed; f) the expected internal and/or external use of the collected data, including by counterparties; g) the IT system and technical security measures that have been implemented, including encryption and/or tokenisation; h) identification of the individual(s), bodies and/or committee(s) with access to the sensitive payment data; i) an explanation of how breaches will be detected and addressed; j) an annual internal control programme in relation to the safety of the IT systems.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Guideline 9: Business continuity arrangements
9.1. The applicant should provide a description of the business continuity arrangements
consisting of the following information:
a) a business impact analysis, including the business processes and recovery objectives, such as recovery time objectives, recovery point objectives and protected assets; b) the identification of the back-up site, access to IT infrastructure, and the key software and data to recover from a disaster or disruption; c) an explanation of how the applicant will deal with significant continuity events and disruptions, such as the failure of key systems; the loss of key data; the inaccessibility of the premises; and the loss of key persons; d) the frequency with which the applicant intends to test the business continuity and disaster recovery plans, including how the results of the testing will be recorded. Guideline 10: Security policy document
10.1. The applicant should provide a security policy document containing the following
information:
a) a detailed risk assessment of the payment service(s) the applicant intends to provide, which should include risks of fraud and the security control and mitigation measures taken to adequately protect payment service users against the risks identified; b) a description of the IT systems, which should include:
i. the architecture of the systems and their network elements;
ii. the business IT systems supporting the business activities provided, such as the
applicant’s website, the risk and fraud management engine, and customer accounting;
iii. the support IT systems used for the organisation and administration of the AISP,
such as accounting, legal reporting systems, staff management, customer relationship management, e-mail servers and internal file servers;
iv. information on whether or not those systems are already used by the AISP or its
group, and the estimated date of implementation, if applicable;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 c) the type of authorised connections from outside, such as with partners, service providers, entities of the group and employees working remotely, including the rationale for such connections; d) for each of the connections listed under point c), the logical security measures and mechanisms in place, specifying the control the payment institution will have over such access as well as the nature and frequency of each control, such as technical versus organisational; preventative versus detective; real-time monitoring versus regular reviews, such as the use of an active directory separate from the group, the opening/closing of communication lines, security equipment configuration, generation of keys or client authentication certificates, system monitoring, authentication, confidentiality of communication, intrusion detection, antivirus systems and logs; e) the logical security measures and mechanisms that govern the internal access to IT systems, which should include:
i. the technical and organisational nature and frequency of each measure, such as
whether it is preventative or detective and whether or not it is carried out in real time;
ii. how the issue of client environment segregation is dealt with in cases where the
applicant’s IT resources are shared; f) the physical security measures and mechanisms of the premises and the data centre of the applicant, such as access controls and environmental security; g) the security of the payment processes, which should include:
i. the customer authentication procedure used for both consultative and
transactional access;
ii. an explanation of how safe delivery to the legitimate payment service user and
the integrity of authentication factors, such as hardware tokens and mobile applications, are ensured, at the time of both initial enrolment and renewal;
iii. a description of the systems and procedures that the applicant has in place for
transaction analysis and the identification of suspicious or unusual transactions. h) a detailed risk assessment in relation to its payment services, including fraud, with a link to the control and mitigation measures explained in the application file, demonstrating that the risks are addressed;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 i) a list of the main written procedures in relation to the applicant’s IT systems or, for procedures that have not yet been formalised, an estimated date for their finalisation. Guideline 11: Identity and suitability assessment of directors and persons responsible for the management of the account information service provider
11.1. For the purposes of the identity and suitability assessment of directors and persons
responsible for the management of the account information service provider, the applicant should provide the following information:
a) personal details, which should include:
i. the full name, gender, place and date of birth, address and nationality, and
personal identification number or copy of ID card or equivalent;
ii. details of the position for which the assessment is sought, and whether or not
the management body position is executive or non-executive; this should also include the following details:

• the letter of appointment, contract, offer of employment or relevant
  drafts, as applicable;
• the planned start date and duration of the mandate;
• a description of the individual’s key duties and responsibilities;
  b) where applicable, information on the suitability assessment carried out by the applicant, which should include details of the result of any assessment of the suitability of the individual performed by the institution, such as relevant board minutes or suitability assessment reports or other documents; c) evidence of knowledge, skills and experience, which should include a curriculum vitae containing details of education and professional experience, including academic qualifications, other relevant training, the name and nature of all organisations for which the individual works or has worked, and the nature and duration of the functions performed, in particular highlighting any activities within the scope of the position sought; d) evidence of reputation, honesty and integrity, which should include:
  i. criminal records and relevant information on criminal investigations and
  proceedings, relevant civil and administrative cases, and disciplinary actions, including disqualification as a company director, bankruptcy, insolvency and similar procedures, notably through an official certificate or any objectively

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 reliable source of information concerning the absence of criminal conviction, investigations and proceedings, such as third-party investigations, testimonies made by a lawyer or a notary established in the European Union;
ii. a statement as to whether or not criminal proceedings are pending or the
person or any organisation managed by him or her has been involved as a debtor in insolvency proceedings or comparable proceedings;
iii. information concerning the following:

• investigations, enforcement proceedings or sanctions by a supervisory
  authority that the individual has been directly or indirectly involved in;
• refusal of registration, authorisation, membership or licence to carry out a
  trade, business or profession; the withdrawal, revocation or termination of registration, authorisation, membership or licence; or expulsion by a regulatory or government body or by a professional body or association;
• dismissal from employment or a position of trust, fiduciary relationship or
  similar situation, or having been asked to resign from employment in such a position, excluding redundancies;
• whether or not an assessment of reputation of the individual as an
  acquirer or a person who directs the business of an institution has already been conducted by another competent authority, including the identity of that authority, the date of the assessment and evidence of the outcome of this assessment, and the consent of the individual, where required, to seek and process such information and use the provided information for the suitability assessment;
• whether or not any previous assessment of the individual, on authority
  from another, non-financial sector, has already been conducted, including the identity of that authority and the evidence of the outcome of this assessment. Guideline 12: Professional indemnity insurance or a comparable guarantee
  12.1. As evidence of a professional indemnity insurance or comparable guarantee that is
  compliant with the EBA Guidelines on Professional Indemnity Insurance (EBA/GL/2017/08) and Articles 5(2)and 5(3) of PSD2 the applicant should provide the following information:
  a) an insurance contract or other equivalent document confirming the existence of professional indemnity insurance or a comparable guarantee, with a cover amount that

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 is compliant with the referred EBA Guideline showing the coverage of the relevant liabilities; b) documentation of how the applicant has calculated the minimum amount in a way that is compliant with the referred EBA Guidelines, including all applicable components of the formula specified therein.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
4.3. Guidelines on the information
requirements from applicants for authorisation as electronic money institutions Guideline 1: General principles
1.1 This set of guidelines applies to applicants for authorisation as electronic money institutions
(EMIs).This refers to applicants that intend to provide e-money services and, if applicable, any payment service(s) referred to in points 1-8 of Annex I to PSD2. Applicants that intend to provide only payment services referred to in points 1-7 of Annex I to PSD2 or service 8 referred to in this Annex in combination with other service(s) referred to in points 1-7 without providing e-money services should refer to the specific set of guidelines on the information required from applicants for authorisation as payment institutions (PIs) set out in section 4.1. Applicants that intend to provide only the payment service referred to in point 8 of Annex I to PSD2 without providing e-money services should refer to the guidelines on the information required from applicants for registration for the provision of only service 8 of Annex I PSD2 set out in section 4.2.
1.2 The information provided by applicants should be true, complete, accurate and up to date.
All applicants should comply with all the provisions in the set of guidelines that applies to them. The level of detail should be proportionate to the applicant’s size and internal organisation, and to the nature, scope, complexity and riskiness of the particular service(s) that the applicant intends to provide. In any event, in accordance with Directive (EU) 2015/2366, the directors and the persons responsible for the management of the electronic money institution are of good repute and possess appropriate knowledge and experience to perform payment services, regardless of the institution’s size, internal organisation and the nature, scope and complexity of its activities and the duties and responsibilities of the specific position.
1.3 When submitting the information required, the applicant should avoid making references
to specific sections of internal procedures/documents. Instead, the applicant should extract the relevant sections and provide these to the competent authority.
1.4 Should the competent authorities (CAs) require clarifications on the information that has
been submitted, the applicant should provide such clarification without delay.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
1.5 All data requested under these guidelines for authorisation as EMIs are needed for the
assessment of the application and will be treated by the competent authority in accordance with the professional secrecy obligations set out in PSD2, without prejudice to applicable Union law and national requirements and procedures on the exercise of the right to access, rectify, cancel or oppose. Guideline 2: Identification details
2.1 The identification details to be provided by the applicant should contain the following
information:
a) the applicant’s corporate name and, if different, trade name; b) an indication of whether the applicant is already incorporated or in the process of incorporation; c) the applicant’s national identification number, if applicable; d) the applicant’s legal status and (draft) articles of association and/or constitutional documents evidencing the applicant’s legal status; e) the address of the applicant’s head office and registered office; f) the applicant’s electronic address and website, if available; g) the name(s) of the person(s) in charge of dealing with the application file and authorisation procedure, and their contact details; h) an indication of whether or not the applicant has ever been, or is currently being, regulated by a competent authority in the financial services sector; i) any trade association(s), in relation to the provision of e-money services and/or payment services, that the applicant plans to join, where applicable; j) the register certificate of incorporation or, if applicable, negative certificate of a mercantile register that certifies that the name applied by the company is available; k) evidence of the payment of any fees or of the deposit of funds to file an application for authorisation as an electronic money institution, where applicable under national law. Guideline 3: Programme of operations
3.1 The programme of operations to be provided by the applicant should contain the following
information:

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 a) an indication of the e-money services the applicant intends to provide: issuance, redemption, distribution; b) if applicable, a step-by-step description of the type of payment services envisaged, including an explanation of how the activities and the operations that will be provided are identified by the applicant as fitting into any of the legal categories of payment services listed in Annex I to PSD2, and an indication of whether these payment services would be provided in addition to electronic money services or whether they are linked to the issuance of electronic money; c) a declaration of whether the applicant will at any point enter or not into possession of funds; d) if applicable, a description of the execution of the different e-money services and, if applicable, payment services, detailing all parties involved, for each e-money service and, if applicable, each payment service provided:
i. a diagram of flow of funds;
ii. settlement arrangements;
iii. draft contracts between all the parties involved in the provision of payment
services including those with payment card schemes, if applicable;
iv. processing times;
e) a copy of the draft contract between the electronic money issuer and the electronic money holder and the draft framework contract, as defined in Article 4(21) of PSD2 if the applicant pretends to provide payment services in addition to e-money services; f) the estimated number of different premises from which the applicant intends to provide the services, if applicable; g) a description of any ancillary services to e-money services and, if applicable, to payment services; h) when the applicant intends to provide payment services in addition to e-money services, a declaration of whether or not the applicant intends to grant credit and, if so, within which limits; i) a declaration of whether or not the applicant plans to provide e-money services and, if applicable, payment services in other EU Member States or third countries after the granting of the licence;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 j) an indication of whether or not the applicant intends, for the next three years, to provide or already provides business activities other than e-money services and, if applicable, payment services, as referred to in Article 11(5) of Directive (EU) 2015/2366, including a description of the type and expected volume of the activities; k) the information specified in EBA Guidelines on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantee under Article 5(4) of Directive (EU) 2015/2366’ (EBA/GL2017/08), where the applicant intends to provide services 7 and 8 (payment initiation services (PIS) and account information services (AIS)). Guideline 4: Business plan 4.1.The business plan to be provided by the applicant should contain:
a) a marketing plan consisting of:
i. an analysis of the company’s competitive position in the e-money market and, if
applicable, payment market segment concerned;
ii. a description of the payment service users and electronic money holders,
marketing materials and distribution channels; b) certified annual accounts for the previous three years, if available, or a summary of the financial situation for those companies that have not yet produced annual accounts; c) a forecast budget calculation for the first three financial years that demonstrates that the applicant is able to employ appropriate and proportionate systems, resources and procedures that allow the applicant to operate soundly; it should include:
i. an income statement and balance-sheet forecast, including target scenarios and
stress scenarios as well as their base assumptions, such as volume and value of transactions, number of clients, pricing, average amount per transaction, expected increase in profitability threshold;
ii. explanations of the main lines of income and expenses, the financial debts and
the capital assets;
iii. a diagram and detailed breakdown of the estimated cash flows for the next
three years; d) information on own funds, including the amount and detailed breakdown of the composition of initial capital as set out in Article 57(a) and (b) of Directive 2006/48/EC;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 e) information on, and calculation of, minimum own funds requirements in accordance with method D, as referred to in Article 5.3 of Directive (EU) 2009/110 (the second E￾Money Directive (EMD2)), if the electronic money institution intends to provide e￾money services only, or the method(s) referred to in Article 9 of Directive (EU) 2015/2366 (PSD2) as determined by the competent authority, if the applicant intends to provide payment services in addition to e-money services, including an annual projection of the breakdown of own funds for three years according to the method used and, If applicable, an annual projection of the own funds for three years according to the other methods used. Guideline 5: Structural organisation
5.1. The applicant should provide a description of the structural organisation of its
undertaking consisting of:
a) a detailed organisational chart, showing each division, department or similar structural separation, including the name of the person(s) responsible, in particular those in charge of internal control functions; the chart should be accompanied by a description of the functions and responsibilities of each division, department or similar structural separation; b) an overall forecast of the staff numbers for the next three years; c) a description of the relevant operational outsourcing arrangements consisting of:
i. the identity and geographical location of the outsourcing provider;
ii. the identity of the persons within the electronic money institution that are
responsible for each of the outsourced activities;
iii. a clear description of the outsourced activities and their main characteristics;
d) a copy of draft outsourcing agreements; e) a description of the use of branches, agents and distributors, where applicable, including:
i. a mapping of the off-site and on-site checks that the applicant intends to
perform of branches, agents and distributors;
ii. the IT systems, processes and infrastructure that are used by the applicant’s
agents and distributors to perform activities on behalf of the applicant;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
iii. in the case of agents and distributors, the selection policy, monitoring
procedures, agents’ and distributor’s training and, where available, the draft terms of engagement of agents and distributors; f) an indication of the national and/or international payment system that the applicant will access, if applicable; g) a list of all natural or legal persons that have close links with the applicant, indicating their identities and the nature of those links. Guideline 6: Evidence of initial capital
6.1. For the evidence of initial capital to be provided by the applicant (of EUR 350 000), the
applicant should submit the following documents:
a) for existing undertakings, an audited account statement or public register certifying the amount of capital of the applicant; b) for undertakings in the process of being incorporated, a bank statement issued by a bank certifying that the funds are deposited in the applicant’s bank account. Guideline 7: Measures to safeguard the funds of electronic money users and/or payment service users
7.1. Where the applicant safeguards the electronic money users’ and/or payment service users’
funds through depositing funds in a separate account in a credit institution or through an investment in secure, liquid, low-risk assets, the description of the safeguarding measures should contain:
a) a description of the investment policy to ensure the assets chosen are liquid, secure and low risk, if applicable; b) the number of persons that have access to the safeguarding account and their functions; c) a description of the administration and reconciliation process for electronic money users and, if applicable, payment service users, against the claims of other creditors of the electronic money institution, in particular in the event of insolvency; d) a copy of the draft contract with the credit institution; e) an explicit declaration by the electronic money institution of compliance with Article 10 of PSD2.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
7.2. Where the applicant safeguards the funds of the electronic money users and, if applicable,
the payment service users through an insurance policy or comparable guarantee from an insurance company or credit institution, and unless the applicant intends to provide PIS only, the description of the safeguarding measures should contain the following:
a) a confirmation that the insurance policy or comparable guarantee from an insurance company or credit institution is from an entity that is not part of the same group of firms as the applicant; b) details of the reconciliation process in place to ensure that the insurance policy or comparable guarantee is sufficient to meet the applicant’s safeguarding obligations at all times; c) duration and renewal of the coverage; d) a copy of the (draft) insurance agreement or (draft) comparable guarantee. Guideline 8: Governance arrangements and internal control mechanisms
8.1. The applicant should provide a description of the governance arrangement and internal
control mechanisms consisting of:
a) a mapping of the risks identified by the applicant, including the type of risks and the procedures the applicant will put in place to assess and prevent such risks, in relation to e-money services and, if applicable, payment services; b) the different procedures to carry out periodical and permanent controls, including the frequency and the human resources allocated; c) the accounting procedures by the which the applicant will record and report its financial information; d) the identity of the person(s) responsible for the internal control functions, including for periodic, permanent and compliance control, as well as an up-to-date curriculum vitae; e) the identity of any auditor that is not a statutory auditor pursuant to Directive 2006/43/EC; f) the composition of the management body and, if applicable, any other oversight body or committee; g) a description of the way outsourced functions are monitored and controlled so as to avoid an impairment in the quality of the electronic money institution’s internal controls;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 h) a description of the way any agents, branches and distributors are monitored and controlled within the framework of the applicant’s internal controls; i) where the applicant is the subsidiary of a regulated entity in another EU Member State, a description of the group governance. Guideline 9: Procedure for monitoring, handling and following up on security incidents and security-related customer complaints
9.1. The applicant should provide a description of the procedure in place to monitor, handle and
follow up on security incidents and security-related customer complaints to be provided by the applicant, which should contain:
a) organisational measures and tools for the prevention of fraud; b) details of the individuals and bodies responsible for assisting customers in cases of fraud, technical issues and/or claim management; c) reporting lines in cases of fraud; d) the contact point for customers, including a name and email address; e) the procedures for the reporting of incidents, including the communication of these reports to internal or external bodies, including for applicants that intend to provide payment services in addition to e-money services, and the notification of major incidents to national competent authorities under Article 96 of PSD2 and in line with the EBA guidelines on incident reporting under the referred Article. f) the monitoring tools used and the follow-up measures and procedures in place to mitigate security risks. Guideline 10: Process for filing, monitoring, tracking and restricting access to sensitive payment data
10.1. The applicant should provide a description of the process in place to file, monitor, track and
restrict access to sensitive payment data consisting of:
a) a description of the flows of data classified as sensitive payment data in the context of the electronic money institution’s business model; b) the procedures in place to authorise access to the sensitive payment data; c) a description of the monitoring tool;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 d) the access right policy, detailing access to all relevant infrastructure components and systems, including databases and back-up infrastructures; e) a description of how the collected data are filed; f) the expected internal and/or external use of the collected data, including by counterparties; g) the IT system and technical security measures that have been implemented, including encryption and/or tokenisation; h) identification of the individuals, bodies and/or committees with access to the sensitive payment data; i) an explanation of how breaches will be detected and addressed; j) an annual internal control programme in relation to the safety of the IT systems. Guideline 11: Business continuity arrangements
11.1. The applicant should provide a description of the business continuity arrangements
consisting of the following information:
a) a business impact analysis, including the business processes and recovery objectives, such as recovery time objectives, recovery point objectives and protected assets; b) the identification of the back-up site and access to IT infrastructure, and the key software and data to recover from a disaster or disruption; c) an explanation of how the applicant will deal with significant continuity events and disruptions, such as the failure of key systems; the loss of key data; the inaccessibility of the premises; and the loss of key persons; d) the frequency with which the applicant intends to test the business continuity and disaster recovery plans, including how the results of the testing will be recorded; e) a description of the mitigation measures to be adopted by the applicant, in cases of the termination of its payment services, ensuring the execution of pending payment transactions and the termination of existing contracts.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Guideline 12: The principles and definitions applicable to the collection of statistical data on performance, transactions and fraud.
12.1. The applicant should provide a description of the principles and definitions applicable to
the collection of the statistical data on performance, transactions and fraud consisting of the following information:
a) the type of data that is collected, in relation to customers, type of payment service, channel, instrument, jurisdictions and currencies; b) the scope of the collection, in terms of the activities and entities concerned, including branches, agents and distributors; c) the means of collection; d) the purpose of collection; e) the frequency of collection; f) supporting documents, such as a manual, that describe how the system works. Guideline 13: Security policy document
13.1. The applicant should provide a security policy document in relation to its e-money
service(s) and, where applicable, payment service(s) containing the following information:
a) a detailed risk assessment of the e-money service(s) and, where applicable, the payment service(s) the applicant intends to provide, which should include risks of fraud and the security control and mitigation measures taken to adequately protect e￾money service users and, where applicable, payment service users against the risks identified; b) a description of the IT systems, which should include:
i. the architecture of the systems and their network elements;
ii. the business IT systems supporting the business activities provided, such as the
applicant’s website, wallets, the payment engine, the risk and fraud management engine, and customer accounting;
iii. the support IT systems used for the organisation and administration of the
electronic money institution, such as accounting, legal reporting systems, staff management, customer relationship management, e-mail servers, internal file servers;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
iv. information on whether those systems are already used by the electronic money
institution or its group, and the estimated date of implementation, if applicable; c) the type of authorised connections from outside, such as with partners, service providers, entities of the group and employees working remotely, including the rationale for such connections; d) for each of the connections listed under point c), the logical security measures and mechanisms in place, specifying the control the electronic money institution will have over such access as well as the nature and frequency of each control, such as technical versus organisational; preventative versus detective; and real-time monitoring versus regular reviews, such as the use of an active directory separate from the group, the opening/closing of communication lines, security equipment configuration, generation of keys or client authentication certificates, system monitoring, authentication, confidentiality of communication, intrusion detection, antivirus systems and logs; e) the logical security measures and mechanisms that govern the internal access to IT systems, which should include:
i. the technical and organisational nature and frequency of each measure, such as
whether it is preventative or detective and whether or not it is carried out in real time;
ii. how the issue of client environment segregation is dealt with in cases where the
applicant’s IT resources are shared; f) the physical security measures and mechanisms of the premises and the data centre of the applicant, such as access controls and environmental security; g) the security of the e-money and, where applicable, payment processes, which should include:
i. the customer authentication procedure used for both consultative and
transactional access, and for all underlying payment instruments;
ii. an explanation of how safe delivery to the legitimate e-money services user
and, where applicable, payment service user and the integrity of authentication factors, such as hardware tokens and mobile applications, are ensured, at the time of both initial enrolment and renewal;
iii. a description of the systems and procedures that the electronic money
institution has in place for transaction analysis and the identification of suspicious or unusual transactions;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 h) a detailed risk assessment in relation to its e-money services and, where applicable, its payment services, including fraud, with a link to the control and mitigation measures explained in the application file, demonstrating that the risks are addressed; i) a list of the main written procedures in relation to the applicant’s IT systems or, for procedures that have not yet been formalised, an estimated date for their finalisation. Guideline 14: Internal control mechanisms to comply with obligations in relation to money laundering and terrorist financing (AML/CFT obligations)
14.1 The description of the internal control mechanisms that the applicant has established in
order to comply, where applicable, with those obligations should contain the following information:
a) the applicant’s assessment of the money laundering and terrorist financing risks associated with its business, including the risks associated with the applicant’s customer base, the products and services provided, the distribution channels used and the geographic areas of operation; b) the measures the applicant has or will put in place to mitigate the risks and comply with applicable anti-money laundering and counter terrorist financing obligations, including the applicant’s risk assessment process, the policies and procedures to comply with customer due diligence requirements, and the policies and procedures to detect and report suspicious transactions or activities; c) the systems and controls the applicant has or will put in place to ensure that its branches, agents and distributors comply with applicable anti-money laundering and terrorist financing requirements, including, in cases where the agent, distributor or branch is located in another Member State; d) arrangements the applicant has or will put in place to ensure that staff, agents and distributors are appropriately trained in anti-money laundering and counter terrorist financing matters; e) the identity of the person in charge of ensuring the applicant’s compliance with anti￾money laundering and counter-terrorism obligations, and evidence that their anti￾money laundering and counter-terrorism expertise is sufficient to enable them to fulfil this role effectively; f) the systems and controls the applicant has or will put in place to ensure their anti￾money laundering and counter terrorist financing policies and procedures remain up to date, effective and relevant;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 g) the systems and controls the applicant has or will put in place to ensure that the agents and distributors do not expose the applicant to increased money laundering and terrorist financing risk; h) the anti-money laundering and counter-terrorism manual for the staff of the applicant. Guideline 15: Identity and suitability assessment of persons with qualified holdings in the applicant
15.1 For the purposes of the identity and evidence of the suitability of persons with qualifying
holdings in the applicant electronic money institution, without prejudice to the assessment in accordance with the criteria, as relevant, introduced with Directive 2007/44/EC and specified in the joint guidelines for the prudential assessment of acquisitions of qualifying holdings (JC/GL/2016/01), the applicant should submit the following information:
a) a description of the group to which the applicant belongs and an indication of the parent undertaking, where applicable; b) a chart setting out the shareholder structure of the applicant, including:
i. the name and the percentage holding (capital/voting right) of each person
that has or will have a direct holding in the share capital of the applicant, identifying those that are considered as qualifying holders and the reason for such qualifications;
ii. the name and the percentage holding (capital/voting rights) of each person
that has or will have an indirect holding in the share capital of the applicant, identifying those that are considered as indirect qualifying holders and the reason for such qualification; c) a list of the names of all persons and other entities that have or, in the case of authorisation, will have qualifying holdings in the applicant’s capital, indicating for each such person or entity:
i. the number and type of shares or other holdings subscribed or to be
subscribed;
ii. the nominal value of such shares or other holdings.
15.2 Where a person who has or, in the case of authorisation, will have a qualifying holding in
the applicant’s capital is a natural person, the application should set out all of the following information relating to the identity and suitability of that person:

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 a) the person’s name and name at birth, date and place of birth, citizenship (current and previous), identification number (where available) or passport number, address and a copy of an official identity document; b) a detailed curriculum vitae stating the education and training, previous professional experience and any professional activities or other functions currently performed; c) a statement, accompanied by supporting documents, containing the following information concerning the person:
i. subject to national legislative requirements concerning the disclosure of
spent convictions, any criminal conviction or proceedings where the person has been found against and which were not set aside;
ii. any civil or administrative decisions in matters of relevance to the assessment
or authorisation process where the person has been found against and any administrative sanctions or measures imposed as a consequence of a breach of laws or regulations (including disqualification as a company director), in each case which were not set aside and against which no appeal is pending or may be filed;
iii. any bankruptcy, insolvency or similar procedures;
iv. any pending criminal investigations;
v. any civil or administrative investigations, enforcement proceedings, sanctions
or other enforcement decisions against the person concerning matters that may be considered to be relevant to the authorisation to commence the activity of an electronic money institution or to the sound and prudent management of an electronic money institution;
vi. where such documents can be obtained, an official certificate or any other
equivalent document evidencing whether any of the events set out in sub￾paragraphs (i)-(v) has occurred in respect of the relevant person;
vii. any refusal of registration, authorisation, membership or licence to carry out
trade, business or a profession;
viii. any withdrawal, revocation or termination of a registration, authorisation,
membership or licence to carry out trade, business or a profession;
ix. any expulsion by an authority or public sector entity in the financial services
sector or by a professional body or association;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
x. any position of responsibility with an entity subject to any criminal conviction
or proceedings, administrative investigations, sanctions or other enforcement decisions for conduct failings, including in respect of fraud, dishonesty, corruption, money laundering, terrorist financing or other financial crime, or of failure to put in place adequate policies and procedures to prevent such events, held at the time when the alleged conduct occurred, together with details of such occurrences and of the person’s involvement, if any, in them;
xi. any dismissal from employment or a position of trust, any removal from a
fiduciary relationship (other than as a result of the relevant relationship coming to an end by passage of time) and any similar situation; d) a list of undertakings that the person directs or controls and of which the applicant is aware of after due and careful enquiry; the percentage of control either direct or indirect in these companies; their status (whether or not they are active, dissolved, etc.); and a description of insolvency or similar procedures; e) where an assessment of reputation of the person has already been conducted by a competent authority in the financial services sector, the identity of that authority and the outcome of the assessment; f) the current financial position of the person, including details concerning sources of revenues, assets and liabilities, security interests and guarantees, whether granted or received; g) a description of any links to politically exposed persons, as defined in Article 3(9) of Directive (EU) 2015/8495 .
15.3 Where a person or entity who has or, in the case of authorisation, will have a qualifying
holding in the applicant’s capital (including entities that are not a legal person and which hold or should hold the participation in their own name), the application should contain the following information relating to the identity and suitability of that legal person or entity:
a) name; b) where the legal person or entity is registered in a central register, commercial register, companies register or similar register that has the same purposes of those aforementioned, a copy of the good standing, if possible, or otherwise a registration certificate;

5 Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (OJ L 141, 5.6.2015, p. 73).

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 c) the addresses of its registered office and, where different, of its head office, and principal place of business; d) contact details; e) corporate documents or, where the person or entity is registered in another Member State, a summary explanation of the main legal features of the legal form or the entity; f) whether or not the legal person or entity has ever been or is regulated by a competent authority in the financial services sector or other government body; g) where such documents can be obtained, an official certificate or any other equivalent document evidencing the information set out in paragraphs (a) to (e) issued by the relevant competent authority; h) the information referred to in Guideline 15(2)(c), 15(2)(d), 15(2)(e),15(2)(f) and 15(2)(g) a in relation to the legal person or entity; i) a list containing details of each person who effectively directs the business of the legal person or entity, including their name, date and place of birth, address, their national identification number, where available, and detailed curriculum vitae (stating relevant education and training, previous professional experience, any professional activities or other relevant functions currently performed), together with the information referred to in Guideline 15(2)(c) and 15(2)(d) in respect of each such person; j) the shareholding structure of the legal person, including at least their name, date and place of birth, address and, where available, personal identification number or registration number and the respective share of capital and voting rights of direct or indirect shareholders or members and beneficial owners, as defined in Article 3(6) of Directive (EU) 2015/849; k) a description of the regulated financial group of which applicant is a part, or may become a part, indicating the parent undertaking and the credit, insurance and security entities within the group; the name of their competent authorities (on an individual or consolidated basis); and l) annual financial statements, at the individual and, where applicable, the consolidated and sub-consolidated group levels, for the last three financial years, where the legal person or entity has been in operation for that period (or, if less than three years, the period for which the legal person or entity has been in operation and financial statements were prepared), approved by the statutory auditor or audit firm within the

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 meaning of Directive 2006/43/EC6 , where applicable, including each of the following items:
i. the balance sheet;
ii. the profit-and-loss accounts or income statement;
iii. the annual reports and financial annexes and any other documents registered
with the relevant registry or competent authority of the legal person; m) where the legal person has not been operating for a sufficient period to be required to prepare financial statements for the three financial years immediately prior to the date of the application, the application shall set out the existing financial statements (if any); n) where the legal person or entity has its head office in a third country, general information on the regulatory regime of that third country as applicable to the legal person or entity, including information on the extent to which the third country’s anti￾money laundering and counter-terrorist financing regime is consistent with the Financial Action Task Force Recommendations; o) for entities that do not have legal personality such as a collective investment undertaking, a sovereign wealth fund or a trust, the application shall set out the following information:
i. the identity of the persons who manage assets and of the persons who are
beneficiaries or subscribers, unit holders controlling the collective investment undertaking or having a holding enabling them to prevent the taking of decisions by the collective investment undertaking;
ii. a copy of the document establishing and governing the entity including the
investment policy and any restrictions on investment applicable to the entity.
15.4 The application shall set out all of the following information for each natural or legal person
or entity who has or, in the case of authorisation, will have a qualifying holding in the capital of the applicant should contain the following:
a) details of that person’s or entity’s financial or business reasons for owning that holding and the person’s or the entity’s strategy regarding the holding, including the period for which the person or the entity intends to hold the holding and any intention to increase, reduce or maintain the level of the holding in the foreseeable future; 6 Directive 2006/43/EC of the European Parliament and of the Council of 17 May 2006 on statutory audits of annual accounts and consolidated accounts, amending Council Directives 78/660/EEC and 83/349/EEC and repealing Council Directive 84/253/EEC (OJ L 157, 9.6.2006, p. 87-107).

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 b) details of the person’s or entity’s intentions in respect of the applicant and of the influence the person or the entity intends to exercise over the applicant, including in respect of the dividend policy, the strategic development and the allocation of resources of the applicant, whether or not it intends to act as an active minority shareholder and the rationale for such intention; c) information on the person’s or the entity’s willingness to support the applicant with additional own funds if needed for the development of its activities or in the case of financial difficulties; d) the content of any intended shareholder’s or member’s agreements with other shareholders or members in relation to the applicant; e) an analysis as to whether or not the qualifying holding will impact in any way, including as a result of the person’s close links to the applicant, on the ability of the applicant to provide timely and accurate information to the competent authorities; f) the identity of each member of the management body or of senior management who will direct the business of the applicant and will have been appointed by, or following a nomination from, such shareholders or members, together with, to the extent not already provided, the information set out in Guideline 16 below.
15.5 The application should set out a detailed explanation of the specific sources of funding for
the participation of each person or entity having a qualifying holding in the applicant’s capital, which should include:
a) details on the use of private financial resources, including their availability and (so as to ensure that the competent authority is satisfied that the activity that generated the funds is legitimate) source; b) details on access to financial markets, including details of financial instruments to be issued; c) information on the use of borrowed funds, including the name of the lenders and details of the facilities granted, such as maturities, terms, security interests and guarantees, as well as information on the source of revenue to be used to repay such borrowings; where the lender is not a credit institution or a financial institution authorised to grant credit, the applicant should provide to the competent authorities information on the origin of the borrowed funds; d) information on any financial arrangement with other persons who are shareholders or members of the applicant.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Guideline 16: Identity and suitability assessment of directors and persons responsible for the management of the electronic money institution
16.1 For the purposes of the identity and suitability assessment of directors and persons
responsible for the management of the electronic money institution, the applicant should provide the following information:
a) Personal details including:
i. their full name, gender, place and date of birth, address and nationality, and
personal identification number or copy of ID card or equivalent.
ii. details of the position for which the assessment is sought, whether or not the
management body position is executive or non-executive. This should also include the following details:

• the letter of appointment, contract, offer of employment or relevant
  drafts, as applicable;
• the planned start date and duration of the mandate;
• a description of the individual’s key duties and responsibilities.
  b) where applicable, information on the suitability assessment carried out by the applicant which should include details of the result of any assessment of the suitability of the individual performed by the institution, such as relevant board minutes or suitability assessment reports or other documents; c) evidence of knowledge, skills and experience, which should include a curriculum vitae containing details of education and professional experience, including academic qualifications, other relevant training, the name and nature of all organisations for which the individual works or has worked, and the nature and duration of the functions performed, in particular highlighting any activities within the scope of the position sought; d) evidence of reputation, honesty and integrity, which should include:
  i. criminal records and relevant information on criminal investigations and
  proceedings, relevant civil and administrative cases, and disciplinary actions, including disqualification as a company director, bankruptcy, insolvency and similar procedures, notably through an official certificate or any objectively reliable source of information concerning the absence of criminal conviction, investigations and proceedings, such as third-party investigations, testimonies made by a lawyer or a notary established in the European Union;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
ii. a statement as to whether criminal proceedings are pending or the person or
any organisation managed by him or her has been involved as a debtor in insolvency proceedings or comparable proceedings;
iii. information concerning the following :

• investigations, enforcement proceedings or sanctions by a supervisory
  authority that the individual has been directly or indirectly involved in;
• refusal of registration, authorisation, membership or licence to carry out a
  trade, business or profession; the withdrawal, revocation or termination of registration, authorisation, membership or licence; or expulsion by a regulatory or government body or by a professional body or association;
• dismissal from employment or a position of trust, fiduciary relationship or
  similar situation, or having been asked to resign from employment in such a position, excluding redundancies;
• whether or not an assessment of reputation of the individual as an
  acquirer or a person who directs the business of an institution has already been conducted by another competent authority, including the identity of that authority, the date of the assessment and evidence of the outcome of this assessment, and the consent of the individual where required to seek such information to be able to process and use the provided information for the suitability assessment;
• whether or not any previous assessment of the individual, on authority
  from another, non-financial sector, has already been conducted, including the identity of that authority and evidence of the outcome of such an assessment. Guideline 17: Identity of statutory auditors and audit firms The identity of statutory auditors and audit firms as defined in Directive 2006/43/EC to be provided by the applicant, where relevant, should contain the names, addresses and contact details of auditors. Guideline 18: Professional indemnity insurance or a comparable guarantee for payment initiation services and account information services As evidence of a professional indemnity insurance or comparable guarantee that is compliant with EBA Guidelines on the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantee (EBA/GL/2017/08) and Article 5(2) and

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 5(3) of PSD2, the applicant for authorisation as electronic money institutions that, in addition to e-money services, intends to provide PIS or AIS, should provide the following information:
a) an insurance contract or other equivalent document confirming the existence of the professional indemnity insurance or comparable guarantee, with a cover amount that is compliant with the referred EBA Guidelines, showing the coverage of the respective liabilities; b) documentation of how the applicant has calculated the minimum amount in a way that is compliant with the referred EBA Guidelines (EBA/GL/2017/08), including all applicable components of the formula specified therein.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
4.4. Guidelines regarding the
assessment of completeness of the application Guideline 1: Assessment of the completeness of the application
1.1. An application should be deemed to be complete for the purpose of Article 12 of Directive
(EU) 2015/2366 if it contains all the information needed by the competent authorities in order to assess the application in accordance with these guidelines and with Article 5 of Directive (EU) 2015/2366.
1.2. Where the information provided in the application is assessed to be incomplete, the
competent authority should send, in paper format or by electronic means, a request to the applicant, indicating in a clear way what information is missing, and should provide to the applicant the opportunity to submit the missing information.
1.3. Upon an application being assessed as complete, the competent authority should inform
the applicant of that fact, together with the date of receipt of the complete application or, as the case may be, the date of receipt of the information that completed the application.
1.4. In any case, the competent authority may require the applicant to provide clarification on
the information for the purposes of assessing the application.
1.5. Where an application contains information, or relies on information held by the competent
authorities, which is no longer true, accurate or complete, an update to the application should be provided to the competent authorities without delay. The update should identify the information concerned, its location within the original application, the reason for the information no longer being true, accurate or complete, the updated information and confirmation that the rest of the information in the application remains true, accurate and complete.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
4. Accompanying documents
4.1 Draft cost-benefit analysis/impact assessment
Article 5(5) of Directive (EU) 2015/2366 (PSD2) mandates the EBA to develop guidelines on the
information to be provided to CASs in the application for the authorisation of PIs. Article 33 of PSD2 and the mutatis mutandi clause for EMIs expand the mandate to AISPs and EMIs.
Article 16(2) of the EBA Regulation ((EU) No 1093/2010)provides that the EBA should carry out an
analysis of ‘the potential related costs and benefits’ of any guidelines it develops. This analysis should provide an overview of the findings regarding the problem to be dealt with, the solutions proposed and the potential impact of these options. This chapter contains an assessment of the impact on PIs, AISPs, EMIs and CAs arising from adopting the GLs on authorisation for PIs, under Article 5(5) of PSD2 (services 1-8 of Annex I to PSD2), AISPs and EMIs. A. Identification of the problem and baseline scenario7 The market for payment services in the EU is developing very dynamically, with the number of users and providers of innovative payment services rising continuously, increasing the need for an adequate regulatory and governance framework. PSD2 provides the legal foundation for the creation of an EU-wide single market for payments. Article 5 of this Directive specifies the application requirements for authorisation of PIs. It creates a legal basis for entry into the payment service market and thereby ensures that the objectives set by the Directive are pursued from the start of market creation. From feedback on the authorisation process under the previous payment service regulation framework (PSD1) from relevant payment providers and CAs, the EBA identified several problems in the authorisation application process, such as incompleteness of information, the low quality of the information received, long delays in providing requested information and the incorrect identification of the payment service intended to be provided by the applicant8 . The problems in the quality of the provided information and the information submission process lead to inefficiencies, misunderstandings, delays, a lack of transparency and regulatory arbitrage.

7 See also EBA consumer trends report 2016, available at:
http://www.eba.europa.eu/documents/10180/1360107/Consumer+Trends+Report+2016.pdf 8 Based on EBA questionnaire issued to CAs in preparation of EBA guidelines on the authorisation of payment institutions under Article 5(5) of PSD2, 2016.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 To address these issues, the GLs on authorisation of PIs provide a common list of information to be submitted by the applicant when applying for authorisation. They provide three sets of GLs separately for PIs (offering services as defined under 1-8 of Annex I PSD2), AISPs and EMIs, as well as a fourth regarding the assessment of the completeness of the application. The baseline scenario, the status quo, is the authorisation approach under PSD2. The PIs submit authorisation information based on the requirements set by each Member State and on the requirements outlined in Article 5 of PSD2. Without the use of GLs on the authorisation, CAs might decide to apply different standards to the entry requirements for applications, allowing different administrative obligations for applicants from different Member States and thereby hampering the establishment of a level playing field. Further, GLs can increase the efficiency of the authorisation process, thereby encouraging new entrants and supporting the creation of a competitive market for payment services. B. Policy objectives9 This CP introduces three distinct sets of draft GLs for PIs under Article 5(5) of PSD2 (services 1-8 of
Annex I to PSD2), AISPs (point 8 of Annex I PSD2) and EMIs. Further, it provides GLs on the
assessment of the completeness of the application.
In general, the objectives of the EBA are to improve the functioning of the internal market, including, in particular, the soundness, effectiveness and consistency of regulation and supervision. The EBA also aims to ensure the integrity, transparency, efficiency and orderly functioning of financial markets, prevent regulatory arbitrage and promote equal conditions for competition. More specifically, the GLs contribute to the general objectives by providing a set of document requirements for PSPs in order to facilitate the authorisation process. The guidelines that have been developed clarify which information is required to be provided by applicants to CAs. Each set of GLs is adapted to the nature of the service provided by the PSP. The specific objectives of the GLs for the applicants, the CAs and Member States, the payment service users and the EBA are stated in paragraph 10 of this CP. These GLs were drafted to bring the following benefits to the stakeholders concerned:
for applicants: greater transparency and clarity, level playing field;

9 See also EBA, Annual Report 2016 (http://www.eba.europa.eu/documents/10180/1879387/DZAB17001ENN+- +EBA+Annual+Report+2016.pdf/4c08e80f-ea87-4643-90cb-a2a02230c0a2); and The EBA 2016 Annual Work Programme (http://www.eba.europa.eu/documents/10180/1232192/EBA+Work+Programme+2016.pdf/870adf40- a595-49c3-b937-680cb1135a30).

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 for CAs and Member States: increased quality in the information provided by applicants, indirect contribution to harmonised supervision; for payment services users: transparency and safety. Operationally, the GLs were drafted considering several options with a view to ensuring transparency for the different types of service providers and to ensure that applications can be effectively supervised by CAs.
C. Options considered and preferred options
This section of the cost-benefit analysis aims at comparing the alternative options for developing and fulfilling the mandate, and provides the rationale behind the preferred options, assuming the full adoption, national implementation and compliance with the GLs by CASs. During the drafting of the GLs, the EBA considered different scenarios. A questionnaire conducted in the first half of 2016 served as the basis for the work. Twenty-four CASs and the members of two relevant European trade associations gave detailed feedback on the current status of the authorisation process for PIs under the existing PSD1. The questionnaire identified that the payment service identification process, the information submission process and the number of documents to be provided are issues that need to be addressed by the EBA. Payment service(s) identification process The applicant is required to identify the payment service it provides. In order to facilitate this payment service(s) identification process during the authorisation, the EBA considered that the applicant can:
Option 1.1: self-identify the payment service it intends to provide; Option 1.2: choose from a non-exhaustive list of examples in the GLs; or Option 1.3: choose from a non-exhaustive list of examples in the background and rationale section of the CP. For the payment service(s) identification process, it was decided that option 1.1 is preferred, i.e. that the applicant provides its own description of the provided payment service. This will help the applicant to provide CAs with complete and accurate information, to smoothen the assessment stage and speed up the authorisation procedure. To achieve the objective, it helps to establish an efficient authorisation process for PIs and CAs. Further, allowing the applicants to submit their own description of the type of payment service avoids the exclusion of certain business models

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 and thus strengthens innovation, supporting the objective to create a competitive market in payment services. Information submission process The authorisation process is facilitated when CAs receive from applicants information with a high degree of granularity. In order to improve the submission process of such detailed information, the EBA considered that applicants could use the following submission formats:
Option 2.1: templates;
Option 2.2: a list of information; or
Option 2.3: a combined format10.
For the information submission process, the EBA considers that option 2.2 is preferable, as it facilitates the alignment of the authorisation processes carried out by CAs 11 that do not use any templates for the submission process. In addition, an alignment with related regulatory standards developed by the EBA for other EU directives allows CAs to create a harmonised execution of application processing, leading to further efficiency gains. Further, the EBA considered:
Option 3.1: providing one set of GLs for all payment services; Option 3.2: providing three separate sets of GLs for services 1-8 of Annex I to PSD2, for PIS only and for AIS only; and Option 3.3: providing a joint set of GLs for services 1-8 of Annex I to PSD2 and for PIS, and a set of GLs for AIS. In addition, the CP addresses EBA mandates to cover EMIs as set out in Article 3.1 of Directive 2009/110/EC (EMD), which is why the EBA considered:
Option 4.1: developing a joint set of GLs for EMIs and other PIs; and Option 4.2: developing a specific set of GLs for EMIs. The EBA considered the significance of the introduction of new payment services in PSD2 and the legal nature of the service provider during the drafting of the GLs and concluded that option 3.3 in

10 A combined option includes a list of information and the provision of templates for two requirements. 11 EBA, 2016, Consultation Paper – Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 combination with option 4.2 would be preferable, i.e. to provide three distinct sets of GLs: one set for PIs offering services 1-8 of Annex I to PSD2, one set for AISPs and one set for EMIs. The preference for these two options is based on the legal nature of the service providers. For providers of AIS, different legal requirements under PSD2 result in different information being required for the application process. A distinct set of GLs for providers of AIS and EMIs ensures transparency for the applicant, which in turn should enhance information quality. It clarifies the GLs, which facilitates the information submission process and thereby reduces the administrative burden for the applicant and the CAs. D. Cost-benefit analysis12 The preferred options developed in the GLs set important standards for the structure and content of the requested information for the authorisation of PIs. The implementation of the preferred options is expected to have a low impact on the administrative costs for CAs and limited additional costs for PIs, AISPs and EMIs. The adoption of the three different GLs results in a one￾off administrative alignment of the already established requirements in each jurisdiction, limiting the change required from the current use of templates for the submission of some information items. Several CAs are already using templates for the suitability of members of the management body and key function holders. In the long term, the benefits will outweigh the initial costs, as the alignment within and among CAs in different jurisdictions will benefit the exchange of information and facilitate comparison between PIs, establishing a competitive market. Given the alternative options outlined above, the options chosen for the GLs will benefit CAs and PIs, AISPs and EMIs. The harmonisation of submitted information through the adoption of a list of information is expected to introduce transient administrative implementation costs for CAs. It will permanently benefit CAs and PIs by ensuring that CAs receive the information they require, and reduce the likelihood of requests for further information. It will also improve consistency in the formats used by PIs and will facilitate their compliance with the notification requirements set by the GLs. Clear and detailed instructions and definitions facilitate the reporting process, and will therefore reduce administrative costs and increase the quality and accountability of reported data. This approach improves the exchange of information within and between CAs, which will improve the functioning of the internal market, including, in particular, the soundness, effectiveness and consistency of regulation and supervision.

12 For further reference, see also COM, ‘Impact assessment accompanying the PSD2 proposal’ (2014).

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
4.2 Feedback table
Feedback on responses to Question 1

1. General responses One respondent pointed out that the GLs should
   use the PDS2 terminology or define other terms used throughout its provisions (e.g. ‘key systems’, ‘key data’, ‘key persons’). The GLs should be read in line with the terminology and definitions provided in PSD2. In addition, the EBA clarifies that what is ‘key’ needs to be decided by the applicant and assessed by the CAS on the basis of the proportionality principle. None.
2. Background and
   rationale
   Several respondents, while agreeing with the objectives of the GLs identified by the EBA in general, raised concerns as regards the proportionality principle and recommended that the level playing field objective should be clarified in order to confirm that the level and detail of the information expected is proportionate. The EBA, while acknowledging that the proportionality principle is a general rule of law and that it has already been covered in GL 1 of all three sets of GLs, the EBA acknowledges that further clarification is required and has therefore amended GL 1.1 for this purpose. A new point 1 has been added to GL 1 that reads:
   1.1 This set of guidelines applies to applicants for authorisation as
   payment institutions. This includes applicants that intend to provide any service(s) referred to in points 1-7 of Annex I to PSD2 or service 8 in combination with other payment services. Applicants that intend to provide only the service referred to in point 8 of Annex I to PSD2 are subject to the specific set of guidelines for account information service providers set out in section 4.2 Amendments have been made to points 2, 3 and 4 of GL 1 which read:
   1.12 The information provided by applicants should be true, complete,
   accurate and up to date. All applicants should comply with all the provisions in the set of guidelines that applies to them. The level of detail should be proportionate, and to the applicant’s size and internal organisation, and to the nature, scope, complexity and riskiness of the particular service (s) that the applicant intends to provide. In any event, in accordance with Directive (EU) 2015/2366, the directors and the persons responsible for the management of the payment institution are of good repute and possess appropriate knowledge and experience to perform payment services, regardless of the institution’s size, internal organisation and the nature, scope and complexity of its activities and the duties and responsibilities of the specific position.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
1.23 When submitting the information required, the applicant should
avoid making references to specific sections of internal procedures/documents. Instead, the applicant should extract the relevant sections and provide these to the competent authority (CA).
1.34 Should the competent authorities require clarifications on the
information that has been submitted, the applicant should provide such clarification without delay.
1.4 Institutions should take into account their size, internal
organisation and the nature, scale, and complexity of their activities when developing and implementing policies and processes. In any event, in accordance with Directive (EU) 2015/2366, the directors and the persons responsible for the management of the account information service provider are of good repute and possess appropriate knowledge and experience to perform account information services, regardless of the institution’s size, internal organisation and the nature, scope and the complexity of its activities and the duties and responsibilities of the specific position.
1.5 All personal data requested under these guidelines for registration
as account information service providers (AISPs) are needed for the assessment of the application and will be treated by the competent authority in accordance with the professional secrecy obligations set out in PSD2, without prejudice to applicable Union law and rational requirements and procedures on the exercise of the right to access, rectify, cancel or oppose.
3. Background and
rationale
Several respondents consider the required level of information (long list of requirements) detrimental to PIS and AIS entities. They stress that the level of information required is disproportionate to the objective of security and customer protection, leading to a heavy burden especially for small entities that could be discouraged from entering the market even The EBA considers that the scope of requirements for PISPs and AISPs is proportionate to the issues of security and a supervision expectation. Only providers ensured to provide services in a safe and secure way can be powered to conduct an activity as a PISP or an AISP. Furthermore, the EBA clarifies that the structure of the GLs already provides proportionality, as required by the Level 1 text. AISPs are exempted from some of the requirements as

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 though they would otherwise provide useful services to their clients. per Article 33 of PSD2 and this is reflected in the GLs, as there is a different set of GLs for these providers.
4. Background and
rationale
One respondent is in favour of subjecting small service providers to the same application procedure as applies to larger service providers. They are of the opinion that, especially in the case of providers of new services like PIS, the trust element in the PIS needs to be established towards consumers, which will then provide a level playing field once the small service providers grow progressively. The trust element needs to be taken into account for any PSP. None.
5. Background and
rationale
Pursuant to another respondent, the objectives for ASPSPs are missing in the current draft. Cooperative banks would like to see explicitly mentioned that the GLs seek to strengthen the liability regime governing the interactions between the different actors involved in electronic payment transactions. From the perspective of ASPSPs, the GLs should contain clear and precise rules to increase the certainty with which ASPSPs can take their decisions. Ultimately, the GLs will strengthen the principle of legal certainty. The EBA agrees with this proposal and adds this objective to the objectives of the GLs that were already set out in the CP. However, the EBA clarifies that the rules on rights, obligations and liability regime between PSPs are set out in Title IV of PSD2, whereas the GLs that the EBA has been mandated to develop under Article 5 merely specify the information to be submitted in the application for authorisation as PIs. The GLs therefore contribute to providing certainty to market participants only indirectly. Paragraphs 5 and 6 have been added to the rationale section of the Guidelines:
5.Overall, the respondents agreed with the objectives of the GLs set out by the EBA in the CP (for applicants; for CAs and Member States; for payment service users; and for the EBA). In addition, a few respondents requested that a further objective for account information service providers should be added, specifically that the GLs seek to strengthen the liability regime governing the interactions between the different actors involved in electronic payment transactions. In the respondents’ view, from the perspective of account servicing payment service providers (ASPSPs), the GLs should contain clear and precise rules to increase the certainty with which ASPSPs can make decisions and, ultimately, the GLs should strengthen the principle of legal certainty. 6.The EBA agrees with this proposal and to add this objective to those that the EBA had set out in the CP. However, the EBA clarifies that the rules on rights, obligations and the liability regime among PSPs are set out in Title IV of PSD2 itself, whereas the GLs that the EBA has been mandated to develop under Article 5 merely specify the information to be submitted in the application for authorisation as PIs. The GLs therefore contribute to providing certainty to market participants only indirectly.
6. Background and One respondent pointed out that supervision The EBA shares this point of view. None.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 rationale across the EU is extremely important.
7. Background and
rationale
From the perspective of one respondent, the CP only gives examples for entities acting exclusively as AISPs or exclusively as PISPs, but lacks examples for combined AISP and PISP entities. The heading of Chapter 4.1 implies that it also includes AISPs providing services 1-8 as specified in Annex I to PSD2, but the exemptions specified in Chapter 4.1 refer to only providers of PIS. The respondent inquires whether a combined provider is to apply as a full PI and whether it should prepare two different applications. Having two completely separate applications seems inefficient as some of the information will be the same for both applications. The respondent has asked for clearer guidelines on how to treat combined entities. The EBA clarifies that the entities that are going to provide a combination of PIS and AIS are subject to the first set of guidelines, i.e. they are PIs, they should submit only one application for authorisation as a PI and, when doing so, they should submit the information set out in Chapter 4.1. The GLs contained herein concern the information required from applicants for authorisation as PIs for the provision of services 1-8 of Annex I to PSD2, i.e. these GLs apply to applicants that will provide both PIS and AIS. The EBA further clarifies this by the introduction of a new point to GL 1. The exemptions referred to by the respondent specified in
Chapter 4.1 are not, as such, exemptions. Instead, these are
provisions that are not applicable to providers of only PIS, specifically providers of only PIS do not have own funds requirements, and hence those provisions are not applicable to them. New GL 1.1. A new point 1 has been added to GL 1 that reads:
1.1 This set of guidelines applies to applicants for authorisation as
payment institutions. This includes applicants that intend to provide any service(s) referred to in points 1-7 of Annex I to PSD2 or service 8 in combination with other payment services. Applicants that intend to provide only the service referred to in point 8 of Annex I to PSD2 are subject to the specific set of guidelines for account information service providers set out in section 4.2..
8. Background and
rationale
Another respondent considers the third country access to EU payment services and related platforms important and would like to make sure that the principle of proportionality as set out in the GLs applies, so that that appropriate requirements are imposed during the authorisation/registration procedure. A robust and proportionate authorisation/registration regime under PSD2 is essential to ensure that the EU market for payment services does not present a competitive disadvantage to providers from third countries. This factor is becoming more important in light of the UK´s impending exit from the EU. The respondent notes that PSD2 does not capture third country providers, but captures transactions with an EU institution and payment in third country currencies and they would like to ensure that third country organisations are obliged to meet the same Any third country provider can submit an application for authorisation as PI in accordance with Article 5 of PSD2 (that where successful will determine exercise of supervision by EU competent authorities and in accordance with EU law). The requirements are those applicable to any applicant located within the EU (this includes assessment of close links that may prevent exercise of effective supervision and of the risk, or significant increase of the risk, of money-laundering and terrorist financing). In accordance with the principle of the level playing field and single access to the internal market of the EU, Member States cannot introduce conditions of authorisation for applicants from third countries that are more favourable than conditions applying to applicants within the EU. At the same time, in the perspective of competitiveness, applicants from third countries, with no prejudice to relevant provisions of national law in the jurisdictions of the Member States also have knowledge of the harmonised set of information necessary for submitting an application None.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 minimum levels of requirements while accessing EU payment services and platforms, especially with AISPs providing services on the same basis as EU domiciled obligated entities. as a PI in any of the Member States of the EU, as specified in these guidelines .
9. Background and
rationale
One respondent has noted that a further principle or objective needs to be considered to protect the information provided by applicants and to ensure that the type of information and the level of detail sought does not introduce a security risk. The EBA had already contemplated the need for protection of personal data under GL 1.4. To reinforce this, the EBA amends this provision by deleting ‘personal’ and hence extends the protection to all data requested in the process. GL 1.5 (former GL 1.4: has been amended and reads:
1.4 All personal data requested under these guidelines for registration
as account information service providers (AISPs) are needed for the assessment of the application and will be treated by the competent authority in accordance with the professional secrecy obligations set out in PSD2, without prejudice to applicable Union law and rational requirements and procedures on the exercise of the right to access, rectify, cancel or oppose.
10. Background and
rationale
One respondent indicates that there is a lack of clarification as regards the requirements applicable to already registered PIs or EMIs. They are of the opinion that an existing PI should not be forced to provide the full set of verifications, as some of these have already been provided as part of the authorisation. In their opinion, a statement to the CA confirming that nothing has fundamentally changed should be sufficient. They suggest that in the case that a new service, such as PIS or AIS, is to be added to the existing PI/EMI services, only a review of specific technical aspects of such a new service is to be submitted. This is dealt with in PSD2, specifically in Articles 109 and 115.5.
Article 109 of PSD2 states:
‘1. Member States shall allow payment institutions that have taken up activities in accordance with the national law transposing Directive 2007/64/EC by 13 January 2018, to continue those activities in accordance with the requirements provided for in Directive 2007/64/EC without being required to seek authorisation in accordance with
Article 5 of this Directive or to comply with the other
provisions laid down or referred to in Title II of this Directive until 13 July 2018. Member States shall require such payment institutions to submit all relevant information to the competent authorities in order to allow the latter to assess, by 13 July 2018, whether those payment institutions comply with the requirements laid down in Title II and, if not, which measures need to be taken in order to ensure compliance or whether a withdrawal of authorisation is appropriate. Payment institutions which upon verification by the competent authorities comply with the requirements laid None.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 down in Title II shall be granted authorisation and shall be entered in the registers referred to in Articles 14 and 15. Where those payment institutions do not comply with the requirements laid down in Title II by 13 July 2018, they shall be prohibited from providing payment services in accordance with Article 37.
2. Member States may provide for payment institutions
referred to in paragraph 1 of this Article to be automatically granted authorisation and entered in the registers referred to in Articles 14 and 15 if the competent authorities already have evidence that the requirements laid down in Articles 5 and 11 are complied with. The competent authorities shall inform the payment institutions concerned before the authorisation is granted 3….’
Article 115.5 indicates:
‘Member States shall not forbid legal persons that have performed in their territories, before 12 January 2016, activities of payment initiation service providers and account information service providers within the meaning of this Directive, to continue to perform the same activities in their territories during the transitional period referred to in paragraphs 2 and 4 in accordance with the currently applicable regulatory framework’.
11. Background and
rationale
Another respondent seeks clarification as to the applicability of the GLs, specifically as to whether the GLs would apply to applicants who have already submitted an application for authorisation but have not yet been authorised, at the time of coming into force of the GLs, or if they would only apply to applicants following their entry into force. Transitional provisions are dealt with in the Level 1 text, specifically in Articles 109 and 115.5 of PSD2. None.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
12. Background and
rationale
One respondent is of the opinion that there is clearly no distinction made between bank￾independent and bank-owned or bank￾controlled PISPs when achieving a level playing field and fair competition. PSD2 does not require different requirements based on control. The scope of the GLs is only about the information to be submitted to CASs when seeking authorisation. None
13. Background and
rationale
One respondent considers that the objectives for ASPSPs are missing in the current draft GLs. The respondent would like to see explicitly mentioned that the GLs seek to strengthen the liability regime governing the interactions between the different actors involved in electronic payment transactions. From the perspective of ASPSPs, the GLs should provide clear and precise rules to increase the certainty with which ASPSPs can take decisions. Ultimately, the GLs will contribute to ensuring that the principle of legal certainty is met. The EBA agrees and refers expressly to the referred objective in paragraph of the background and rationale of the Guidelines. The following sentence has been inserted in paragraph 5 of the background and rationale section of the Final Report:
5. Overall, the respondents agreed with the objectives of the GLs set
out by the EBA in the CP (for applicants; for CAs and Member States; for payment service users; and for the EBA). In addition, a few respondents requested that a further objective for account information service providers should be added, specifically that the GLs seek to strengthen the liability regime governing the interactions between the different actors involved in electronic payment transactions. In the respondents’ view, from the perspective of account servicing payment service providers (ASPSPs), the GLs should contain clear and precise rules to increase the certainty with which ASPSPs can make decisions and, ultimately, the GLs should strengthen the principle of legal certainty. The EBA agrees with this proposal and to add this objective to those that the EBA had set out in the CP. However, the EBA clarifies that the rules on rights, obligations and the liability regime among PSPs are set out in Title IV of PSD2 itself, whereas the GLs that the EBA has been mandated to develop under
Article 5 merely specify the information to be submitted in the
application for authorisation as PIs. The GLs therefore contribute to providing certainty to market participants only indirectly. When assessing the responses, the following four concerns emerged as particularly noteworthy: the scope of the GLs, the great level of detail of the information that is to be provided, the potentially disproportionate impact of the GLs on smaller and/or less complex applicants, and the transitional provisions.
14. Background and
rationale
One respondent considers that the GLs should have, as an additional objective, providing assistance for CAs to overcome any challenges arising from static requirements of PSD2 versus Out of the scope of the mandate. None.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 the meanwhile developing, innovative market needs. Reasoning: PSD2 and the business models under PSD2, show how demanding it is to regulate the innovative financial technology market. CAs should be provided with appropriate means and spheres of responsibility to react to new developments in an agile but still ‘level playing field’ way, e.g. processes for a necessary EU￾wide cooperation among CAs. Specifically the respondent suggests that the EBA determines requirements with regard to a regulated cooperation, i.e. an ongoing and – as far as possible – standardised exchange process between CAs regarding the identification and application of payment services. Feedback on responses to Question 2
15. Background and
rationale
Of the 24 respondents, 12 had no comment on this question. While four respondents agreed with the options chosen by the EBA, eight respondents did not agree in full with the options chosen by the EBA.
16. Background and
rationale
One respondent was of the view that guidance is needed for firms providing multiple services. The GLs are structured in a way that makes clear which sections are required for each payment service type. Applicants for payments services included in points 1-7 of
Annex I to PSD2 or the service included in point 8 of this
Annex in combination with any other payment service
should apply the first set of GLs: Guidelines on the information required from applicants for authorisation as payment institutions for the provision of services 1-8 of
Annex I to PSD2.
Applicants for only the payment service contained in A new point 1 has been added to GL 1 that reads:
1.1 This set of guidelines applies to applicants for authorisation as
payment institutions. This includes applicants that intend to provide any service(s) referred to in points 1-7 of Annex I to PSD2 or service 8 in combination with other payment services. Applicants that intend to provide only the service referred to in point 8 of Annex I to PSD2 are subject to the specific set of guidelines for account information service providers set out in
section 4.2.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 point 8 of Annex I to PSD2, i.e. AIS, are subject to the second set of GLs: Guidelines on the information required from applicants for registration for the provision of only service 8 of Annex I PSD2 (account information services). Applicants for e-money services and, if applicable, the payment services contained in points 1-8 of Annex I to PSD2 are subject to the third set of GLs: Guidelines on the information requirements for applicants for authorisation as electronic money institutions. For further clarity, the EBA has added a new point 1 to GL 1.
17. Guideline 3.1 Of the eight respondents, four felt that in
addition to requiring an applicant to identify the payment services that it proposes to provide, the EBA should also provide a non-exhaustive list of examples. Of those respondents, two preferred a mix of options 1.1 and 1.3 one preferred a mix of options 1.1 and 1.2, and one didn’t specify which option(s) they preferred. One respondent suggested that the inclusion of an explanatory note which advised that examples provided were for illustrative purposes only and were not exhaustive would help to eliminate any misinterpretation regarding their scope and standing. It was also mentioned that it would help the applicant to assess the payment service to be rendered and assess the information required in relation to the application process. There is a strong view (50% of respondents to Question 2) that that the EBA should provide examples of payment services as well as asking the applicant to identify the payment services they wish to provide. The EBA has assessed this request, but has come to the view that:

• definitions are provided by the Level 1 text;
• business models need to be assessed on a case-by-case
  basis;
• by providing examples, there is a danger of benefiting
  some business models more than others;
• providing some examples might mislead the applicant as
  to whether or not authorisation is needed.
  None.

18. Background and
    rationale
    In relation to the structure of the GLs, one respondent preferred option 3.1 i.e. to have one set of GLs, as they felt that it would reflect the reality of the market better. One respondent preferred option 3.2 Two respondents suggested that there should be four sets of GLs, one each for AIS, PIS, PIs and EMIs, with one suggesting The structure of the GLs is consistent with PSD2. Applicants need to use only one set of GLs as follows:
    Applicants for payment services included in points 1-7 of
    Annex I to PSD2 or the service included in point 8 of this
    Annex in combination with any other payment service
    should apply the first set of GLs: Guidelines on the A new point one has been added to GL 1 in section 4.1 that reads:
    This set of guidelines applies to applicants for authorisation as payment institutions. This includes applicants that intend to provide any service(s) referred to in points 1-7 of Annex I to PSD2 or service 8 in combination with other payment services. Applicants that intend to provide only the service referred to in point 8 of Annex I to PSD2 are

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 that the GLs should have a ‘Russian doll’ type effect, which would allow firms to increase the level of payment services they provide more easily. This comment, in conjunction with other comments received, implied that firms were finding it difficult to identify the differences between the three sets of GLs. Other respondents suggested including a fifth part to take into consideration small PIs, in line with the proportionality principle. information required from applicants for authorisation as payment institutions for the provision of services 1-8 of
Annex I to PSD2.
Applicants for only the payment service contained in point 8 of Annex I to PSD2, i.e. AIS, are subject to the second set of GLs: Guidelines on the information required from applicants for registration for the provision of only service 8 of Annex I PSD2 (account information services). Applicants for e-money services and, if applicable, the payment services contained in points 1-8 of Annex I to PSD2 are subject to the third set of GLs: Guidelines on the information requirements for applicants for authorisation as electronic money institutions. The application of each set of GLs has been further clarified by adding a new point 1 to GL 1 of each set of GLs. subject to the specific set of guidelines for account information service providers set out in section 4.2. A new point one has been added to GL1 in section 4.2 that reads:
This set of guidelines applies to applicants for registration as account information service providers. This refers to applicants that intend to provide only account information services. Should the applicant intend to provide additional services to those of account information services they should apply for authorisation and refer to the guidelines set out in section 4.1 for payment institutions. A new point one has been added to GLS in section 4.3 that reads:
This set of guidelines applies to applicants for authorisation as electronic money institutions. This refers to applicants that intend to provide e-money services and, if applicable, any payment service(s) referred to in points 1-8 of Annex I to PSD2. Applicants that intend to provide only payment services referred to in points 1-7 of Annex I to PSD2 or service 8 referred to in this Annex in combination with other service(s) referred to in points 1-7 without providing e-money services should refer to the specific set of guidelines on the information required from applicants for authorisation as payment institutions set out in section 4.1. Applicants that intend to provide only the payment service referred to in point 8 of Annex I to PSD2 without providing e￾money services should refer to the guidelines on the information required from applicants for registration for the provision of only service 8 of Annex I PSD2 set out in section 4.2.
19. Background and
rationale
One respondent was of the view that no specific set of GLs for EMIs was needed given that the GLs on PIs apply mutatis mutandi to these providers. While the application is indeed mutatis mutandi, the EBA is of the view that providing a specific set of GLs for these providers will help applicants to understand exactly what information is expected from them and how the mutatis mutandi application materialises. None.
20. Background and
rationale
In relation to the way the information is to be submitted, two respondents preferred the option of having templates, wherever feasible, rather than a list of requirements. In addition, one respondent felt that payment The level of detail required has the same practical effects as a template. CASs will provide the template with the content of the GLs. None.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 instrument issuing service providers should be included in the GLs.
21. Background and
rationale
One respondent is of the view that the GLs are too prescriptive.
The reason for detailing is to provide reassurance to the applicant as to information that is expected from them at the authorisation stage. In addition, this level of detail is in line with the objectives of both PSD2 and the GLs of harmonising and providing a level playing field. None.
22. Background and
rationale
One respondent also suggested that there should be a simplified application for small Fintech firms to make it easier for them to get authorised. Articles 32 of PSD2 and 9 of Directive 2009/110/EC (EMD) already provides a national option allowing Member States to exempt, in full or in part, smaller payment institutions from the procedure for authorisation to operate in their domestic market. The EBA GLs specifying the information to be submitted for authorisation already consider the proportionality stance, meaning that although applicants should comply with all the provisions of the guidelines applicable to them, the level of detail within the applicable set of guidelines should be proportionate to their size, their business model and the complexity of their activities. The EBA has reworded the provision on proportionality to provide further clarity. GL 1.2 (former GL 1.1) has been reworded and reads:
1.12 The information provided by applicants should be true, complete,
accurate and up to date. All applicants should comply with all the provisions in the set of guidelines that applies to them. The level of detail should be proportionate, and to the applicant’s size and internal organisation, and to the nature, scope, complexity and riskiness of the particular service (s) that the applicant intends to provide. In any event, in accordance with Directive (EU) 2015/2366, the directors and the persons responsible for the management of the payment institution are of good repute and possess appropriate knowledge and experience to perform payment services, regardless of the institution’s size, internal organisation and the nature, scope and complexity of its activities and the duties and responsibilities of the specific position.
23. Background and
rationale
One respondent suggested including payment instrument issuing service providers in the GLs. PSPs that issue payment instruments are not separate PSPs as per PSD2. They are PIs providing the payment service contained in point 5 of Annex I to PSD2 (5. Issuing of payment instruments and/or acquiring of payment transactions) and are subject to the first set of GLs. None. Feedback on responses to Question 3
24. General responses Six respondents explicitly support/recommend
the use of the proportionality principle in order to avoid heavy authorisation procedures and The EBA shares this point of view. n/a

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 workloads, and to reduce costs for new applicants, maintaining up-to-date information.
25. Guideline 1.4 Of the 24 respondents, three considered it
helpful that the EBA has incorporated proportionality measures in the GLs. Seventeen respondents had no comment. This means that only 16.6% disagree with the EBA’s approach. n/a n/a
26. General response One respondent answered ‘yes’ with no
comments n/a n/a
27. General response One respondent agrees with the EBA’s approach,
but suggests that the EBA allows ASPSPs to access the information provided by third parties to the CA. The suggestion is out of the scope of the mandate and the CASs cannot share with AISPS information provided by the applicants for confidentiality reasons. However, the concern is addressed indirectly since GL 9.1 provides for a contact point for customers in relation to security incidents. None.
28. General response One respondent encouraged the use of the
proportionality principle as stated in the general responses (line 1) n/a None.
29. General response Four respondents replied ‘no’ : n/a n/a
30. General response One respondent referred to Article 32 of PSD2
(exemption). There is no need for proportionality, as PSD2 already foresees, in
Article 32, an exemption.
The EBA partially agrees. Proportionality for small PIs is already set out in Article 32 of the Level 1 text. However, given the exemption is a national option and therefore does not apply consistently across Member States, the EBA has further explored potential ways of applying further proportionality to small PIs; however, it has become apparent that this could undermine the objective of PSD2 and of the GLs of providing a level playing field: setting thresholds to lower information requirements could lead to applicants applying for this lighter regime and surpassing the threshold very quickly. In addition, once the authorisation is granted, PSD2 does not allow for another subsequent authorisation once this threshold is surpassed. In any case, proportionality applies per se when the applicant is a small institution, in the sense that much of GL 1.2 (former GL 1.1) has been reworded and reads:
1.21 The information provided by applicants should be true, complete,
accurate and up to date. All applicants should comply with all the provisions in the set of guidelines that applies to them. The level of detail should be proportionate, and to the applicant’s size and internal organisation, and to the nature, scope, complexity and riskiness of the particular service (s) that the applicant intends to provide. In any event, in accordance with Directive (EU) 2015/2366, the directors and the persons responsible for the management of the payment institution are of good repute and possess appropriate knowledge and experience to perform payment services, regardless of the institution’s size, internal organisation and the nature, scope and complexity of its activities and the duties and responsibilities of the specific position.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 the information required may not be applicable and that the business being described is simpler; hence, the level of detail expected is lower as per the general proportionality principle. The EBA has reworded the provision on proportionality to provide further clarity.
31. Guideline 1.4 According to two respondents, GL 1.4 is too
vague and the GL should contain a ‘minimum set of compulsory information’ and ‘specific guidance’, and guidance to CAs on the ‘nature scale and complexity of the activities’. The complexity needs to be assessed on a case-by-case basis and it cannot be defined per se and upfront. Given the large heterogeneity of business models in the PI segment and the rapid change in technology, ‘complexity’ is an ever-changing concept that cannot be defined statically. None.
32. General response According to one respondent, the
proportionality should be a function of the risk posed by the business of the PI and not a function of the size. The EBA partially agrees. Both elements, size and risk, should be taken into account for the application of proportionality. GL 1.2 (former GL 1.1) has been reworded and reads:
1.21 The information provided by applicants should be true, complete,
accurate and up to date. All applicants should comply with all the provisions in the set of guidelines that applies to them. The level of detail should be proportionate, and to the applicant’s size and internal organisation, and to the nature, scope, complexity and riskiness of the particular service (s) that the applicant intends to provide. In any event, in accordance with Directive (EU) 2015/2366, the directors and the persons responsible for the management of the payment institution are of good repute and possess appropriate knowledge and experience to perform payment services, regardless of the institution’s size, internal organisation and the nature, scope and complexity of its activities and the duties and responsibilities of the specific position. Feedback on responses to Question 4
33. General responses One respondent considered that the objectives
for ASPSPs are missing in the current GLs.
The EBA agrees with this proposal and adds this objective to the objectives of the GLs that were already set out in the CP. However, the EBA clarifies that the rules on rights, obligations and liability regime between PSPs are set out in Title IV of PSD2, whereas the GLs that the EBA has been mandated to develop under Article 5 merely specify the information to be submitted in the application for Paragraphs 5 and 6 have been added to the rationale section of the Guidelines:
5.Overall, the respondents agreed with the objectives of the GLs set out by the EBA in the CP (for applicants; for CAs and Member States; for payment service users; and for the EBA). In addition, a few respondents requested that a further objective for account information service providers should be added, specifically that the GLs seek to strengthen the liability regime governing the interactions

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 authorisation as PIs. The GLs therefore contribute to providing certainty to market participants only indirectly. between the different actors involved in electronic payment transactions. In the respondents’ view, from the perspective of account servicing payment service providers (ASPSPs), the GLs should contain clear and precise rules to increase the certainty with which ASPSPs can make decisions and, ultimately, the GLs should strengthen the principle of legal certainty.
6. The EBA agrees with this proposal and to add this objective to those
that the EBA had set out in the CP. However, the EBA clarifies that the rules on rights, obligations and the liability regime among PSPs are set out in Title IV of PSD2 itself, whereas the GLs that the EBA has been mandated to develop under Article 5 merely specify the information to be submitted in the application for authorisation as PIs. The GLs therefore contribute to providing certainty to market participants only indirectly.
34. General responses One respondent underlined that GLs should
refer to only applicants already incorporated and not include those ‘in process of incorporation’ (not in line with PSD2).
Article 11.1 of PSD2 foresees that an authorisation shall
only be granted to a legal person established in a Member State. However, this does not prevent that an applicant that is not yet a legal person will comply with this condition by the end of the authorisation procedure. None.
35. General response One respondent suggested that the EBA
introduces a specific GL for PISPs, as provided for AISPs.
PISPs are PIs and are thus subject to authorisation in a similar way to those PIs that provide other payment services are. The requirements are almost identical. The reason why there is a specific set of GLs for AISPs is that these providers are a different type of PSPs from PIs: these are subject to registration instead of authorisation and have many exemptions on information requirements derived from Article 33 of PSD2. The GLs aim to be consistent with PSD2. None.
36. General response One respondent suggested that all references to
individuals, which may change over time, should be deleted; another respondent is instead of the opposite view. The reference to individuals always refers to those individuals in charge of a position in the moment the application for authorisation is handed in. If any changes occur, the institution should without undue delay communicate it, in accordance with Art. 16. However, the EBA partially agrees and has deleted the reference to individuals where appropriate and consistent with the Level 1 text, and has inserted a reference to the specific The following GL has been reworded and reads as follows:
GL 7.1(b) on safeguarding:
the number contact details of person(s) that have access to the safeguarding account and their functions.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 function. The EBA clarifies that changes to the information and evidence provided in accordance with Art. 5 PSD2 needs to be forwarded by the institution to the CAS; according to Art. 16 PSD2, this information would need to be updated by the institution anyway. In particular, amendments are proposed to:
GL 7.1(b) on safeguarding.
No changes are to be made to the reference to individuals in the following GLs :
GL 2.1(g) on the person(s) in charge of dealing with the application file and the authorisation procedure, and their contact details; GL 5.1(c) on the description of outsourcing arrangements; GL 9.1(b) on the contact point for customers; GL 10.1(h) on access to sensitive payment data; GL 14.1(e) on the identity of the person in charge of ensuring the applicant’s compliance with AML and CFT obligations, and evidence that their AML and counter￾terrorism expertise is sufficient to enable them to fulfil this role effectively; GL 15 on the identity and suitability assessment of persons with qualified holdings in the applicant; GL 16 on the identity and suitability assessment of directors and persons responsible for the management of the payment institution; GL 17 on the identity of statutory auditors. The reason for not making changes to the abovementioned GLs are that, for most, the Level 1 text already sets out provisions regarding identity of these and, for the others, the EBA understands that proof of the identity of the

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 individual is needed to assess the application.
37. General response According to one respondent, because of the
options available and the different approaches adopted across different Member States, the capital adequacy requirements can be unclear and the requirements applied by a CA may change as the applicant moves through the application process leading to uncertainty, which can have significant impacts on the applicant in terms of funding, financial planning, etc. On this basis, the respondent believes that very clear guidance on the capital requirements should be set out in the GLs and a consistent approach adopted by CAs across the EU. This is out of the scope of the GLs: the scope of the GLs is on the submission of information and not on its assessment. None.
38. General response One respondent stated that in order to ensure
that all legal requirements beyond PSD2 are met, the erasure procedure and on￾boarding/off-boarding procedures should be included. These procedures should follow General Data Protection Regulation (GDPR) requirements. The nature of the response is unclear to the EBA and therefore no specific answer can be provided. None.
39. According to one respondent, information on
the chosen ‘Qualified Trust Service Provider’ should be added to the application to provide PIS and AIS. The EBA does not agree. (According to regulatory technical standards (RTS) on strong customer authentication (SCA), the registration in the home CA register should occur before choosing the qualified trust service provider.) None.
40. General response One respondent suggests including details of a
contact person that the ASPSP can approach in cases of compensation for falsely executed payments, etc. It would not be helpful to add this reference to the GLs, since this information is available to CASs and not to banks; CASs would not be able to share this information for confidentiality reasons. None.
41. General response One respondent asked for more information on
how the assessment of the application documents is made by the CA and the level and type of analysis by the CA, in order to know whether or not this detailed information is really needed. The assessment of the information is out of the scope of the GLs. None.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
42. General response
and Guideline 13.1
One respondent remarked that in GL 13.1(b)(ii), 13.1(b)(iii), 13.1(d), 13.1(e)(i), 13.1(f) and 13.1(g)(ii) and throughout the GLs the EBA uses ‘such as’ to mean ‘as an example if applicable’. As an example, GL 13.1(b)(ii) refers to ‘wallets’ which would be relevant for e-money issuers. The EBA does not agree. From a general perspective, it is not excluded that ‘wallets’ are relevant for PIs: it depends on the type of wallet. In fact, in some cases, the management of the wallet is linked to the provision of payment services. Moreover, the EBA does not want to exclude any business model. The EBA gives examples in order to help applicants submit complete applications and speed up the authorisation process. None.
43. Background and
rationale
Several respondents, while agreeing that the objectives of the GLs identified by the EBA are generally plausible, raised concerns on proportionality and recommended that the level playing field objective should be clarified to confirm that the level and detail of the information expected is proportionate to the size and complexity of the applicant and the risk the applicant poses to consumers. The EBA agrees with regard to adding the notion of risk in order to apply the principle of proportionality. Therefore, in line also with the answer to Question 3 on GL 1.4, this reference could be added. GL 1.2 (former GL 1.1) has been reworded and reads:
1.21 The information provided by applicants should be true, complete,
accurate and up to date. All applicants should comply with all the provisions in the set of guidelines that applies to them. The level of detail should be proportionate, and to the applicant’s size and internal organisation, and to the nature, scope, complexity and riskiness of the particular service (s) that the applicant intends to provide. In any event, in accordance with Directive (EU) 2015/2366, the directors and the persons responsible for the management of the payment institution are of good repute and possess appropriate knowledge and experience to perform payment services, regardless of the institution’s size, internal organisation and the nature, scope and complexity of its activities and the duties and responsibilities of the specific position.
44. Guideline 1.4 One respondent was of the view that this GL is
an overstatement of the provisions of PSD2.
The EBA does not agree, since the Level 1 text does not specify how the principle of proportionality should be applied. The GLs reflect the requirements stated in Art. 5(1) PSD2 and try to clarify the expected documents and information for a smooth authorisation process. None.
45. Guideline 1.5 One respondent did not understand the
distinction between ‘personal data’ and ‘other data’ for confidentiality. The EBA agrees and deletes the reference to ‘personal’, so that all data are secure and considered confidential. The reference to ‘personal’ has been deleted from GL 1.4 (now GL 1.5):
All personal data requested under these guidelines for registration as account information service providers (AISPs) are needed for the assessment of the application and will be treated by the competent

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 authority in accordance with the professional secrecy obligations set out in PSD2, without prejudice to applicable Union law and rational requirements and procedures on the exercise of the right to access, rectify, cancel or oppose.
46. Guideline 2.1(h) and
(i)
One respondent asked for these requirements to be deleted because they deviate from the requirements for credit institutions, although they are not mandatory according to PSD2. Moreover, two respondents sought clarification of the meaning of ‘any other industry-specific regulatory body’. One respondent asked for clarification of ‘trade association’ (whether those outside payment services or electronic money are relevant). The information required in this GL seems to be in line with Art. 2(4a) of the draft RTS under Article 8(2) and 8(3) of Directive 2013/36/EU, which requires applicants that have previously carried out commercial or other activities to give ‘details of any membership of the applicant credit institution or of any of its subsidiaries to any industry association and of any licence, authorisation, registration or other permission to carry out activities in the financial services sector by an authority or other public sector entity in any Member State or third country’. For proportionality reasons, the EBA agrees to reword GL 2.1(h) and 2.1(i) by removing the reference to any other industry specific regulatory body and by limiting the information of trade associations to those in relation to the provision of payment or e-money services. GL 2.1(h) and (i) have been amended and read:
(h) an indication of whether or not the applicant has ever been, or is currently being, regulated by a competent authority in the financial services sector or by any other industry specific regulatory body; (i) any trade association(s) in relation to the provision of payment services that the applicant plans to join, where applicable.
47. Guideline 3.1(b) One respondent asked for clarification of the
definition of ‘possession of funds’ to avoid misinterpretation. Even a ‘temporary possession’ of funds should be in the scope of this requirement. The EBA clarifies that PIs can only hold funds temporarily, since these are limited to the execution of the specific payment service; moreover, it is clearly stated in the Level 1 text that PIs cannot take on deposits. However, the EBA will clarify in the GLs that the information to be provided needs to refer to any temporary possession of funds regardless of the length of such possession. The EBA is of the view that the required declaration would also have to consider all possessions of funds regardless of the timelines. The EBA therefore amends the requirement set out in GL 3.1(b). GL 3.1(b) has been amended and reads:
a declaration of whether the applicant will at any point enter or not into possession of funds.
48. Guideline 3.1 One respondent asked for clarification that PIS
are not allowed to enter into the possession of funds. In order to give the CA the possibility to check, the documents mentioned in GL 3.1(c)(i) and (ii) should also be provided by applicants for PIS (therefore, the sentence ‘unless the PSD2 does not allow applicants that provide only PIS to enter into possession of funds, hence the requirement on information of own funds is not applicable to PIS. The EBA believes that the rules and regulations set out in PSD2 make clear that PIS are not allowed to enter into GL 3.1(a) has been amended and reads:
a step-by-step description of the type of payment services envisaged, including an explanation of how the activities and the operations that will be provided are identified by the applicant as fitting into any of the legal categories of payment services listed in Annex I to PSD2.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 applicant intends to provide PIS only’ should be omitted). Further, the respondent suggests a clarification in GL 3.1(c)(iv) of ‘different ways’ and suggests instead ‘different channels’. The respondent raised the concern that the term ‘ways’ is not technical and hence not clear. possession of funds. The GLs should reflect the requirements set by Art. 5(1) PSD2. Indicating in the GLs that applicants for only PIS need to provide this information could be misleading, suggesting that PIS are allowed to enter into possession of funds. The EBA agrees to clarify what was intended by the use of the term ‘ways’, i.e. to provide a ‘step-by-step description’ of the execution of the different services. In addition, the EBA removes GL 3.1(c)(iv), as it overlaps with the information on distribution channels already required under GL 4.1(a). GL 3.1(c) has also been amended and reads:
a description of the execution of the different payment services, detailing all parties involved, and including for each payment service provided:
i. a diagram of flow of funds, unless the
applicant intends to provide payment initiation services (PIS) only;
ii. settlement arrangements, unless the
applicant intends to provide PIS only;
iii. draft contracts between all the parties
involved in the provision of payment services including those with payment card schemes, if applicable;
iv. a description of the different ways trough
which these services are provided
v. flows of data
iv. processing times.
49. Guideline 3.1(c)(ii),
(iii)-(vi)
One respondent asked to delete these requirements.
The EBA disagrees and considers that this information is relevant to correctly assessing the way the service is provided. Settlement and processing times are also relevant to assessing compliance with the safeguarding obligation under PSD2. The EBA clarifies in GL 3.1(c)(iii) that the information requested refers to draft contracts if they relate to only the provision of payment services including those with payment card schemes, if applicable. GL 3.1(c) has been amended and reads:
a description of the execution of the different payment services, detailing all parties involved, and including for each payment service provided:
i. a diagram of flow of funds, unless the
applicant intends to provide payment initiation services (PIS) only;
ii. settlement arrangements, unless the
applicant intends to provide PIS only;
iii. draft contracts between all the parties
involved in the provision of payment services including those with payment

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 card schemes, if applicable;
iv. a description of the different ways trough
which these services are provided
v. flows of data
vi. processing times.
50. Guideline 3.1(c)(iii) One respondent asked for clarification that draft
contracts can be submitted for any agent network, so that that not every single agent contract needs to be produced and submitted. Another respondent asked to replace draft contracts with a description of the business model. The EBA is of the view that the information related to draft contracts is relevant for assessing the application. The EBA clarifies in GL 3.1(c)(iii) that the information requested refers to draft contracts if they relate to only the provision of payment services including those with payment card schemes, if applicable. The guidelines do not provide for contracts of agents. GL 3.1(c)(iii) has been amended and reads:
a description of the execution of the different payment services, detailing all parties involved, and including for each payment service provided:
i. a diagram of flow of funds, unless the
applicant intends to provide payment initiation services (PIS) only;
ii. settlement arrangements, unless the
applicant intends to provide PIS only;
iii. draft contracts between all the parties
involved in the provision of payment services including those with payment card schemes, if applicable;
iv. a description of the different ways trough
which these services are provided
v. flows of data
iv. processing times.
51. Guideline 3.1(e) One respondent asked to add a list of relevant
Member States in which a business is or will be active with a list of locations (with a threshold of 100 employees). Moreover, it added that it is too burdensome to provide a list of all the premises from which the applicant intends to provide the payment services, and/or carry out activities related to the provision of payment services. Several The EBA agrees and amends the specific GLs to request only estimates. GL 3.1(e) has been amended and reads:
The estimated number of different premises from which the applicant intends to provide the payment services, and/or carry out activities related to the provision of payment services, if applicable.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 respondents were of the same view indicating that this requirement is too broad and ask the EBA to narrow it down to premises from which payment services would be offered, specifically by estimates.
52. Guideline 3.1(i) One respondent underlined that the
requirement should be accompanied by a time limit of a two- to three-year period, as further forecasts are not certain. The EBA agrees. This requirement should be consistent with GL 4.1(c): ‘a forecast budget calculation for the first three financial years …’ As the business plan and the forecasts need to cover three forecasted business years, the indication might be limited to a two- to three-year period for consistency reasons. GL 3.1(i) has been amended and reads:
an indication of whether or not the applicant intends, for the next three years, to provide/already provides other business activities as referred to in Article 11(5) of Directive 2015/2366, including a description of the type and expected volume nature of the activities. expected volume and business premises
53. Guideline 4 One respondent requested to delete the
reference to the analysis of the payments market; moreover, it underlined that an indication of the way the assessment is carried out by the CAs is missing. The EBA agrees and simplifies the information to be submitted. Moreover, the EBA limits the information on the analysis of the payments market to the specific payment segment concerned and changes the term ‘client’ to ‘payment service user’ for clarity and alignment with PSD2. There is no possibility to give information of the assessment of the application documents in general. This is out of the scope of the GLs and assessments are performed on a case-by-case basis. GL 4.1 has been amended and reads:
The business plan to be provided by the applicant should contain:
f) a marketing plan consisting of:
i. an analysis of the payments market;
ii. an analysis of the company’s competitive
position in the payment market segment concerned;
iii. a description of the payment service users
clients, marketing materials and distribution channels;
iv. the main conclusions of any marketing
research carried out
54. Guideline 4.1(a) Several respondents stated that the marketing
plan is irrelevant and burdensome, as only own capital projections matter, and out of scope. Another respondent asked for the deletion of highly sensitive commercial information, such as analysis of a company´s competitive position, and suggested removing items (ii) and (iv). Another respondent asked the EBA to provide a Please see the row above. The marketing plan might be relevant as regards the business model and the costs and expenses expected by the applicant, and the review of whether or not this information and these expectations are reliable and realistic. The EBA wants to stress that highly sensitive commercial information is made available to only the CA and not to See the amendments above.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 statement with regard to the rationale and purpose of the analysis of the applicant’s competitive position, considered hardly comprehensible for CAs when deciding over a license application. competitors. The CAs would need all information on the applicant to be able to assess the application for authorisation. Under ongoing supervision, the CA would also be able to ask for such information, if needed.
55. Guideline 4.1(a)(iii) One respondent asked for a clear definition of
‘client’ (terminology covers both originators and beneficiaries).
The EBA agrees. ‘Client’ could be changed to ‘payment service user’; this would enhance consistency with PSD2 wording. GL 4.1(a)(iii) has been amended and reads:
iii) a description of payment service users clients, marketing materials and distribution channels.
56. Guideline 4.1(c)(i),
(ii)-(iii)
One respondent asked for these requirements to be deleted, as considered not necessary. The EBA disagrees. The three-year forecast derives from a provision in the Level 1 text. With regard to the term ‘financial flows’, the EBA changes it to ‘cash flows’ to clarify what is meant. GL 4.1(c)(iii) has been amended and reads:
a diagram and detailed breakdown of the estimated cash financial flows for the next three years.
57. Guideline 4.1(e)(i)
and (ii)
One respondent asked for these requirements to be deleted, as considered not necessary. The EBA disagrees. In order to assess the method used, it needs the referred to information, None.
58. Guideline 5 One respondent asked for more proportionality
(especially for start-ups).
Proportionality for small PIs is already addressed in
Article 32 of PSD2. It is a national option that Member
States may or may not adopt.
Because of the maximum harmonised nature of the provision set out in Article 5 of PSD2, the GLs cannot introduce further exemptions to those already set out in the Level 1 text for small PIs (Article 32 of PSD2) and for AISPs (Article 33 of PSD2) However, what the EBA could legally do is set different levels of information for each of the information requirements under Article 5 of PSD2. The EBA has explored the abovementioned direction for applying further proportionality to small PIs; however, it has become apparent that this could undermine the GL 1.2 (former GL 1.1) has been reworded and reads:
1.12 The information provided by applicants should be true, complete,
accurate and up to date. All applicants should comply with all the provisions in the set of guidelines that applies to them. The level of detail should be proportionate, and to the applicant’s size and internal organisation, and to the nature, scope, complexity and riskiness of the particular service (s) that the applicant intends to provide. In any event, in accordance with Directive (EU) 2015/2366, the directors and the persons responsible for the management of the payment institution are of good repute and possess appropriate knowledge and experience to perform payment services, regardless of the institution’s size, internal organisation and the nature, scope and complexity of its activities and the duties and responsibilities of the specific position.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 objectives of PSD2 and of the GLs of providing a level playing field: setting thresholds to lower information requirements could lead to applicants applying for this lighter regime and surpassing the threshold very quickly. In addition, once the authorisation is granted, PSD2 does not allow for another subsequent authorisation once this threshold is surpassed. In any case, proportionality applies per se when the applicant is a small institution, in the sense that much of the information required may not be applicable and that the business being described is simpler; hence, the level of detail expected is lower as per the general proportionality principle. The EBA has reworded the provision on proportionality to provide further clarity.
59. Guideline 5.1(a) According to one respondent, the forecast per
division seems too detailed.
The EBA disagrees. There is no forecast for division, it is an overall forecast. Nevertheless, it clarifies this issue by adding the word ‘overall’. GL 5.1(a) has been amended and reads:
an overall forecast of the staff numbers for the next three years.
60. Guideline 5.1(c) According to one respondent, the GLs should not
address outsourcing arrangements generally but only where payment related. Moreover, there should not be a personalised approach but a departmental one. In accordance with Article 19(6) of PSD2, outsourcing agreements cannot impair materially the quality of the PI’s internal control and the ability of the CAs to monitor and retrace the PI’s compliance with all of the obligations laid down in PSD2. Furthermore, Article 20 provides that PIs remain fully liable for any acts of the entities to which activities are outsourced. An outsourced activity may not be payment services related, but it may affect the provision of payment services. None. None.
61. Guideline 5.1(e)(i)-
(iii)
One respondent asked for these requirements to be deleted, as considered not necessary. The EBA disagrees. Moreover, some of these requirements are mentioned in the Level 1 text, specifically the mapping of the offsite and onsite checks to be performed at least annually on branches and agents. The EBA agrees to simplify the provision for agents by removing the reference to key points of the mandate. GL 5.1(e)(iii) has been amended and reads:
in the case of agents, the main characteristics and key points of the mandate agreement containing the full terms of the mandate, the selection policy, monitoring procedures and agents’ training and, where available, the draft terms of engagement;
62. Guideline 5.1.g) One respondent asked for clarification of the The EBA disagrees; PSD2 refers to close links in its None.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 concept of ‘close links’. Another one asked for it to be removed because it is considered out of scope. Another one requests a statement by the EBA with regard to the rationale and purpose of this requirement, in order to demarcate the intended group of natural and legal persons.
Article 11.7:
‘Where close links as defined in point (38) of Article 4(1) of Regulation (EU) No 575/2013 exist between the payment institution and other natural or legal persons, the competent authorities shall grant an authorisation only if those links do not prevent the effective exercise of their supervisory functions’. Close links are an important element for a CA’s evaluation of the authorisation process. These close links are not out of scope.
63. Guideline 13 One respondent proposes to set an obligation
for third-party payment service providers (TPPs) in the security policy document under the Art. 5(1)(j) of PSD2 to store log files corresponding to log files allowing for effectively control the data accessed by the TPP. The EBA acknowledges the importance of this provision but it is out of the scope of the mandate. The issues referred to are dealt with in Article 26 of the RTS on SCA and common and secure communication (CSC). For the purpose of paragraph 1, PSPs shall ensure that any communication session established with the payment service user, other PSPs or other entities, including merchants, relies on each of the following:
a) a unique identifier for the session; b) security mechanisms for the detailed logging of the transaction, including a transaction number, timestamps and all relevant transaction data; c) timestamps which shall be based on a unified time-reference system and which shall be synchronised according to an official time signal. None.
64. Guideline 7 One respondent stated that details of people
with access to the safeguarding accounts is unnecessary, as the people may change. A description of safeguarding measures and controls would be more appropriate. The EBA agrees to this proposal. The GL is redrafted to refer to only the number and functions of the persons that have access to safeguarding accounts. GL 7.1(b) has been amended and reads:
the number contact details of persons that have access to the safeguarding account and their functions.
65. Guideline 7.1(b) One respondent asked for the addition of The EBA has redrafted this GL to refer only to the number GL 7.1(b) has been amended and reads:

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 contact details of the office, position and name of the person currently occupying that position (not only name). and functions of the persons that have access to safeguarding accounts. The EBA considers this information to be sufficient for assessing an application. the number contact details of persons that have access to the safeguarding account and their functions;
66. Guideline 7.1(d) One respondent stated that the required
declaration of compliance cannot be given by the credit institution and asked for clarification in the text. Another respondent asked for this requirement to be deleted, as the compliance with Art. 10 PSD2 is the responsibility of the PI and not the credit institution, and the compliance is not dependent on a particular type of contract. The EBA agrees to clarify. The wording in GL 7.1(d) might be misleading. The contract should give the CA the possibility to evaluate and assess whether or not compliance with Art. 10 PSD2 is regarded. The EBA clarifies that the responsibility of compliance with Art 10 of PSD2 is indeed of the PI and not of the CI. GL 7.1(d) has been amended and a new Gl 7.1 (e) has been introduced in order to separate the draft contract and the explicit declaration by the PI of compliance with Article 10 of PSD2. d) a copy of the draft contract with the credit institution, including an explicit declaration of compliance with Article 10 of PSD2. e)an explicit declaration by the payment institution of compliance with
Article 10 of PSD2.
67. Guideline 8 One respondent asked for more proportionality
and stated that several requirements only add administrative burden, such as accounting procedures, descriptions of monitoring and controlling of outsourcing and periodical control programmes, and suggested only describing the internal control procedure. The EBA cannot exclude these pieces of information. In the case of accounting procedures and outsourcing, this is explicitly required by the Level 1 text (Art. 5.1(e) and (l), respectively). As for the other information, the EBA is of the view that this is needed for the correct assessment of the application. Nevertheless, the EBA has streamlined the GL to make it more proportionate. In addition, the EBA wants to stress that the detail of the information provided by the GLs should reflect the size and complexity of the relevant business model of the applicant. For these purposes, the EBA has amended GL 1.1 (now Guideline 1.2) on proportionality. GL 1.2 (former GL 1.1) has been reworded and reads:
1.12 The information provided by applicants should be true, complete,
accurate and up to date. All applicants should comply with all the provisions in the set of guidelines that applies to them. The level of detail should be proportionate, and to the applicant’s size and internal organisation, and to the nature, scope, complexity and riskiness of the particular service (s) that the applicant intends to provide. In any event, in accordance with Directive (EU) 2015/2366, the directors and the persons responsible for the management of the payment institution are of good repute and possess appropriate knowledge and experience to perform payment services, regardless of the institution’s size, internal organisation and the nature, scope and complexity of its activities and the duties and responsibilities of the specific position. GL 8 has been streamlined and reads:
Guideline 8: Governance arrangements and internal control mechanisms
8.1. The applicant should provide a description of the governance
arrangement and the internal control mechanisms consisting of:
a) a mapping of the risks identified by the applicant, including the type of risks and the procedures the

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 applicant will put in place to assess and prevent such risks; b) the different procedures to carry out levels of periodical and permanent controls including the frequency with which they are applied, the administrative procedures used, and the human resources allocated; c) the accounting procedures by the which the applicant will record and report its financial information; d) a confirmation of the regulatory reporting requirements that apply to the applicant; d) the identity of the person(s) responsible for the internal control functions, including for periodic, permanent and compliance control, as well as an up-to-date curriculum vitae and criminal record where this person is responsible for the management of the payment service activities of the payment institution; e) the identity of any auditor that is not an statutory auditor pursuant to Directive 2006/43/EC; f) the identity and composition of the management body and, if applicable, of any other oversight body or committee; g) a description of the way outsourced functions are monitored and controlled so as to avoid an impairment in the quality of the payment institution’s internal controls; h) a description of the way any agents and branches are monitored and controlled within the framework of the applicant’s internal controls; i) the periodical control program, setting out the measures to be taken over the next three years to ensure a robust governance of the payment institution; and j) where the applicant is the subsidiary of a regulated

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 entity in another EU Member State, a description of the group governance procedures and the identity of the supervisory authority responsible for the consolidated supervision.
68. Guideline 8.1(b) According to one respondent, this GL is too
detailed.
The EBA has streamlined this requirement. GL 8.1(b) has been amended and reads:
the different procedures to carry out levels of periodical and permanent controls including the frequency with which they are applied, the administrative procedures used, and the human resources allocated;
69. Guideline 8.1(c) One respondent underlined that it is unclear
why the applicant would state the confirmation of the regulatory reporting requirements set by the CA. Others asked for ‘confirmation of the regulatory reporting requirements that apply to the applicant’ to be deleted or rephrased in order to avoid listing all the requirements and – as a consequence – avoid new notifications each time a change occurs. The EBA agrees and deletes the requirement. GL 8.1.c) has been deleted:
c) a confirmation of the regulatory reporting requirements that apply to the applicant;
70. Guideline 8.1(g) According to one respondent, it is already
covered in GL 5.1.
The EBA disagrees. GL 5.1 refers to a description of the outsourcing arrangements while GL 8.1(g) refers to the controls performed by the PI. None.
71. Guideline 8.1(i) and
(j)
According to one respondent, these requirements are too detailed.
The EBA agrees as regards GL 8.1(i) and deletes it, but not with regard to GL 8.1(j); this requirement is relevant to assessing the internal control structure of PIs that provide services in other Member States through branches. GL 8.1(i) has been removed:
i) the periodical control program, setting out the measures to be taken over the next three years to ensure a robust governance of the payment institution
72. Guideline 9 One respondent asked for contact points to be
added for ASPSPs in the internal organisation, to be used in the event of disputes or claims arising from payment transactions involving the PI in the application for PISPs and AISPs. The EBA disagrees. No change is needed because this information would not be available to credit institutions for confidentiality reasons. None.
73. Guideline 9.1(c) One respondent asked for this requirement to
be deleted because it deviates from the
The EBA disagrees. This requirement relates to another EBA mandate under PSD2 (GLs on incident reporting under None.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 requirements for credit institutions, although it is not mandatory according to PSD2.
Article 96.3 of PSD2).
74. Guideline 10 One respondent (ESBG) remarked that these
draft GLs should also apply for any data used and possibly held by institutions in this scope (not only ‘sensitive data’), as any data must be protected in line with the GDPR. Therefore, the institution should be required to appoint a data protection officer with public details. Data and security protection should also apply to outsourcing arrangements. Another respondent (EACB) asked for clarification regarding sensitive payment data and believed that the GLs should also refer to the use of non-sensitive data or non-statistical data. Another respondent (EMA) stated that the definition of ‘sensitive payment data’ set out in PSD2 is overly broad and that it will be almost impossible to collate a list of data. The GLs should refrain from seeking this information and leave the application to the institution. The EBA disagrees. Sensitive payment data are referred to in PSD2, Art. 5.1(g) and they are defined in Art. 4.32 PSD2. The EBA understands the concerns of the respondents asking for the broadening of the requirements to ‘any data used’, but would like to stress that the mandate covers only the application requirements set out in Art. 5(1) PSD2, in this case Art. 5(1)(g) PSD2, which refers to only ‘sensitive payment data’. As GL 10 constitutes the requirements set out in PSD2, there is no possibility to remove this information, as requested by another respondent. None.
75. Guideline 10.1(c) One respondent asks for clarification on what is
meant by ‘monitoring tool’.
The EBA clarifies that a monitoring tool is any tool used to track access; an example could be a tool for an application that uses software to create log files. None.
76. Guideline 10.1(e)-(f) One respondent asks for clarification on what is
expected, and believes that the extension to the relationship with counterparties goes too far. The EBA clarifies that in order to comply with the Level 1 text, it needs to include the information related to counterparties. The EBA clarifies that these provisions aim to request from the applicant a description of how these data will be filed and how they will be used by the applicant and counterparties. GL 10.1(e) has been amended and reads:
unless the applicant intends to provide PIS only, a description of how the collected data are filed. registered
77. Guideline 11.1(e) According to one respondent, this requirement The EBA partially agrees and redrafts accordingly. GL 11(e) has been amended and reads:

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 requests too many details; it should be asked of only systemic actors otherwise it is unreasonable. a description of the mitigation measures to be adopted by the applicant, in cases of the termination of its payment services, to avoid adverse effects on payment systems and on payments services users ensuring the execution of pending payment transactions and the termination of existing contracts.
78. Guideline 12 One respondent suggests a new wording:
‘The applicant should provide a description of the principles and definitions applicable to the collection of the statistical data on performance, transaction and fraud consisting of the following information:
a) the type of data that is collected, in relation to type of payment service, channel, instrument, jurisdictions and currencies;’. Another respondent stated that the level of detail is too burdensome. The EBA disagrees; it is unclear why data in relation to ‘customers’ should be excluded from the draft. The EBA is of the view that this information is needed for the assessment of this requirement. None.
79. Guideline 12. 1(b),
(c), (d), (e), (f) and
(g)
One respondent asks for these requirements to be deleted: too detailed to assess the frauds and the type of statistics collected; moreover, references to draft contracts should also be deleted. In the EBA’s view, this information is necessary in order to fulfil the requirement of the Level 1 text. However GL 12.1(g) is removed since this information is already covered by GL 5.1(d) Guideline 12.1(g) has been deleted:
g)service level agreements with outsourcing partner(s) if the outsourcing partner is in charge of the collection of the statistical data;
80. Guideline 13 The respondent is of the view that the
information required is too granular. In particular, PIs with cloud-based systems could have difficulties in notifying CAs of each change that occurs (the respondent does not specify which changes it is referring to). The respondent asks if notification of every change will be required. The respondent asks why there is no reference to ISO 27001, which has been indicated in RTS on strong customer authentication. The EBA does not agree. It depends on the type of cloud￾based system: in some instances the PI is the owner of the software while in other cases the PI does not manage it. Only in this latter case there could be difficulties for the PI in notifying changes to the CAs. Regarding the request for including the reference to ISO 27001, the EBA is of the view that regulation should be neutral from a technological point of view. None

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Another respondent asks the EBA to give binding guidance on what extent CAs can rely on industry standard certifications, such as ISO 27001, since CAs across Europe have quite different approaches in that regard.
81. Guideline 13.1(c)
and (d)
Two respondents stated that this information is excessive and unlikely to have any value for the CA. Another two respondents asked for ‘an exhaustive list of authorised connections from outside with partners, service providers, entities of the group and employees of the applicant working remotely, including the rationale for such connection’ to be deleted given that it does not take into account the practicality of fulfilling this requirement, which is overly onerous. One of those respondents (Paysage Group PLC) proposed replacing it by a description of controls and an explanation of differences or tolerances where standard policy is not followed. According to one respondent, from a commercial perspective, applicants will not be able to finalise contracts with third parties until they have a reasonable expectation that they will be granted the required license. Therefore it should be clarified that GL 13.1(c) does not require third party partners, service providers, etc., to be named in the application documentation in these types of circumstances. According to another respondent, GL 13.1(d) is considered as referring to information unavailable if the applicant relies on a third party; the third party should therefore certify the compliance with this requirement (as provided for in the GDPR). This information is fundamental in order to assess the structure of the security measures adopted. A mapping of connections is needed to properly understand issues such as the single point of failure and disaster recovery. Without this information and these specifications, no assessment of the security policy document would be possible for the CA. The EBA agrees to simplify GL 13.1(c) and to apply proportionality instead of requiring an exhaustive list requiring the type of authorised connections GL 13.1(c) has been amended and reads:
the type an exhaustive list of authorised connections from outside, such as with partners, service providers, entities of the group and employees of the applicant working remotely, including the rationale for such connections.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
82. Guideline 13.1(i)
and (j)
According to one respondent, these requirements should be deleted because they are redundant with the rest of the information already requested in 13.1(g). The EBA agrees with respect to the deletion of GL 13(j). GL 13.1(j) has been deleted:
j) any other information relevant to the risks arising from the specific activities of the applicant.
83. Guideline 14 One respondent stated that these provisions
(AML/CFT) are irrelevant for PIS, as they do not enter into possession of funds. Another respondent underlined the need to ensure proportionality on AML-related requirements for AISPs/PISPs: in particular, the need to avoid double checks on transactions and payment accounts (performed also by ASPSPs). The respondent suggests an AML prevention programme for AISPs based on specific monitoring indicators, adapted to the activity performed. PSD2 does not provide for any exemption for PISPs in relation to AML. It might be the case that they are obliged entities under national law: there are other entities that do not enter into possession of funds and are subject to AML regulation. None.
84. Guideline 14.1(c) One respondent stated that the wording
suggests that all agents will comprise establishments and will have to comply with host AML obligations and refers to Art. 29 PSD2. One respondent asked for the deletion of the wording ‘including … requirements of that Member State.’ This issue should not be dealt with in these GLs, since it is out of their scope. There is Joint Comitee work ongoing in this direction. AML requirements of the host Member State are relevant for establishments. GL 14.1(c) refers to Art. 5(1)(k) PSD2 and needs to be as open as possible. As there might be cases where agents in a host Member State constitute a kind of ‘establishment’ and for national AML provisions are obliged entities, this information should be made clear in the GLs without prejudice to further notification processes. As institutions willing to passport into other Member States need to provide the information about manuals for agent business in relation to AML provisions, applicants should provide this information if already available. The last sentence of GL 14.1(c) is removed only because it is repetition. The EBA underlines that applicants must comply with AML regulation wherever they are based. GL 14.1(c) has been amended and reads:
the systems and controls the applicant has or will put in place to ensure that its branches and agents comply with applicable anti￾money laundering and terrorist financing requirements, including, in cases where the agent or branch is located in another Member State, the anti-money laundering and counter terrorist financing requirements of that Member State;

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
85. Guideline 14.1(g) One respondent suggested replacing the
wording ‘do not expose the applicant to increased money laundering and terrorist financing risk’ by ‘are monitored to address money laundering and terrorist financing risk’. The EBA disagrees. In the EBA’s view, this change would result in the same outcome, as the systems and controls the applicant has in place to ensure that agents do not expose the applicant to increased money laundering and terrorist financing risk might result in monitoring measures by the applicant. None.
86. Guideline 15 One respondent stated that these provisions are
irrelevant for PIS.
Another respondent asked for the difference to be clarified between ‘qualified holdings’ and ‘shareholders and qualified holdings’ as mentioned in the Guidelines for credit institutions. Another respondent asked for a definition of ‘qualified holdings’. The EBA disagrees because this information seems necessary in order to fulfil the requirement of the Level 1 text, which does not provide exemptions for PIS on this point. The wording ‘shareholders and members with qualifying holdings’ referred to in the RTS on authorisation of credit institutions is the wording used in Directive 2013/36/UE (CRD IV). The PDS2 already defines ‘qualifying holdings’ in
Article 5.1(m).
Qualifying holdings relates to the requirement set out in Art. 5(1)(m) PSD2 in conjunction with Art. 4(1)(36) of Regulation (EU) No 575/2013. It is not clear why this information requirement will be irrelevant for PIS. The term ‘Qualified holdings’ has been amended to ‘qualifying holdings’ throughout the GLs, in line with PSD2.
87. Guideline 15.1(c)(iii)-
(v)
One respondent stated that these pieces of information are excessive and appear to be disproportionate. Another respondent considers the following request to be too detailed: ‘a list of the names of all persons and other entities that have or will, in case of authorisation have qualifying holdings in the applicant’s capital, indicating in respect of each such person or entity: ...’. This respondent would prefer to ask the question directly rather than asking for a detailed list of shares, security interests, premiums, etc. The EBA agrees and removes for proportionality reasons. GL 15.1(c)(iii)-(v) have been deleted:
iii. any premium paid or to be paid;
iv. any security interests or encumbrances created over such
shares or other holdings, including the identity of the secured parties; and

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
88. Guideline 15.2(e)
Guideline 15.2(e)-(g)
Two respondents indicated that the requirement for a detailed account of the controller’s financial position including assets, liabilities, security interests and guarantees, is disproportionate. One of them stated that details concerning the financial position of the person holding control should be replaced by an overview of income and interests. Another two respondents consider these requirements overly invasive and beyond the requirements of PSD2 and would make any investor pause before investing in a PI start-up. In the case of a venture capital fund, there would be an long list of ‘undertakings directed or owned by the person’ and it would be unfair for the other companies who are in a given fund’s portfolio to be required to share their financial information for the licensing application of a completely unrelated company. The EBA disagrees because this information is relevant to correctly assessing persons holding qualifying holdings and their capacity to ensure sound and prudent management of a PI. The EBA agrees with regard to point (g) and removes accordingly, the reason being that this information is publicly available and hence it is considered disproportionate to ask for it. In addition, the EBA has removed all information set out in GL 15.2(c)(i)-(xi) for undertakings that the person directs or controls and of which the applicant is aware after due and careful enquiry, and instead has introduced a new point (d) with the streamlined information that should be submitted as regards these entities. GL 15.2(g) has been deleted:
g) financial information, including credit ratings and publicly available reports on any undertakings directed or owned by the person; GL 15.2(c) has been amended and reads:
a statement, accompanied by supporting documents, containing the following information concerning the person: and any undertaking which the person directs or controls and of which the applicant is aware after due and careful enquiry:
A new point (d) has been added to GL 15.2 and reads:
a list of undertakings that the person directs or controls and of which the applicant is aware of after due and careful enquiry; the percentage of control either direct or indirect in these companies; their status (whether or not they are active, dissolved, etc.); and a description of insolvency or similar procedures;
89. Guideline 15.2(f)
and (g)
One respondent stated that this information might be provided in broader terms and would like to draw a distinction between PI and EMI activity. Comfort letters do not seem to be appropriate. The EBA agrees with regard to GL 15.2(g), as per the above comment, since asking for credit ratings and publicly available reports for any undertaking directed or owned by the person seems too burdensome. A distinction between PIs and EMIs with regard to persons with qualifying holdings does not seem appropriate and could be in contrast with the Level 1 text. Comfort letters are not mentioned in GL 15. The EBA wants to clarify that this information is needed for the assessment of the persons holding a qualifying holding in the applicant as regards the suitability of them (see Art. 11(6) PSD2). GL 15.2(g) has been deleted:
g) financial information, including credit ratings and g)publicly available reports on any undertakings directed or owned by the person;
90. Guideline 15.3 (j)-(o) One respondent considers this information too
detailed and not proportionate to the risk posed The EBA partially agrees. The assessment of indirect shareholders should be limited to those who have control of the direct shareholder (GL 15.3(j)(i)). The information set GL 15.3(n),(j)-(o) have been amended, spefically points (k) (l) (m) and (n) have been removed.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 by the services provided by a PI. out in 15.3(n) seems to be too detailed. Points (k), (l), (m) and (n) have been removed. K) in the case of an entity which is not a legal person and which holds or should hold the participation in its own name, the identity of all members of the entity, together with the information set out in Guideline 15(2) if such members are natural persons, or, as the case may be, in Guideline 15(3) if such members are legal persons; l) if the legal person or entity is part of a group (which, for the purpose of this paragraph, should, in the case of such entities, include the members of the entity and the subsidiaries of such members), a detailed organisational chart of the structure of the group and information on the share of capital and voting rights of shareholders with significant influence over the entities of the group and on the activities currently performed by the entities of the group; m) if the legal person or entity is part of a group, information on the relationships between any credit institution, insurance or re-insurance undertaking or investment firm within the group and any other group entities; n) if the legal person or entity is part of a group, identification of any credit institution, insurance or re-insurance undertaking or investment firm within the group, the names of the relevant competent authorities, as well as an analysis of the perimeter of consolidated supervision of the credit institution and the group, including information about which group entities would be included in the scope of consolidated supervision requirements and at which levels within the group these requirements would apply on a full or sub-consolidated basis;
91. Guideline 15.5 One respondent considers this information not
risk based, particularly where the funding may come from an authorised entity (such as a fund). Given that through other requirements set out in this section it is possible to understand the activities (i.e. through a curriculum vitae or description of business activities) of each natural The EBA disagrees because this information is relevant to correctly assessing persons holding qualifying holdings and their capacity to ensure sound and prudent management of a PI. It is also relevant for the assessment of AML risk. Points (b) and (f) of GL 15.5 have been deleted:
b) details on the means of payment of the intended participation, of the payment service provider used to transfer funds and, where the head office of the payment service provider is not established in a Member State, evidence that the funds used for the participation are

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 or legal person with qualifying holdings, this should be sufficient to establish source of funds. channelled through payment service providers that are subject to anti-money laundering and terrorist financing legislative requirements consistent with those set out in Directive (EU) 2015/849, and are supervised effectively for compliance with these requirements; f) information on any assets of the person who is a shareholder or member of the applicant which are to be sold in order to help finance the proposed participation, such as conditions of sale, price, appraisal, and details regarding their characteristics, including information on when and how the assets were acquired.
92. Guideline 16 One respondent asked for more proportionality
for PIS.
The EBA disagrees to make a different treatment for those payment institutions that provide payment initiation services and those that provide other services in respect of the information to be provided on identity and suitability assessment of directors and persons responsible for the management of payment institutions. This is because this information seems necessary in order to fulfil the requirement of the Level 1 text, which does not provide for exemptions for PIS on this point. Specifically, PSD2 mandates each applicant to provide the information stated in Art. 5(1)(n) PSD2. Therefore, exempting PISPs from these requirements would not be in line with the Directive. However, the EBA has streamlined Guidelines 16 for all Payment Institutions, including those that provide payment initiation services. GL 16.1(a)(i) has been amended and reads:
personal details, including:
i. the full name, gender, place and date of
birth, address and contact details, nationality, and personal identification number or copy of ID card or equivalent; Guidelines 16.1 (e) and (f) have been removed:
(e) Information on financial and non-financial interests, which should include:
i. a description of any financial and non￾financial interests, such as loans and
shareholdings, and relationships and his/her close relatives, such as a spouse, registered partner, cohabite, child, parent or other relation with whom the person shares living accommodations, between the individual and his/her close relatives, or any company that the individual is closely connected with, and the institution, its parent or subsidiaries, or any person holding a qualifying holding in such an institution, including any members of those institutions or key

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 function holders;
ii. whether or not the individual conducts,
or has conducted in the past two years, any business or has any commercial relationship with any of the above listed institutions or persons or is involved in any legal proceedings with those institutions or persons;
iii. whether or not the individual and his/her
close relatives have any competing interests with the institution , its parent or subsidiaries;
iv. whether or not the individual is being
proposed on behalf of any one substantial shareholder;
v. any financial obligations to the
institution, its parent or its subsidiaries
vi. any national or local position of political
influence held over the past 2 years, and
vii. if a material conflict of interest is
identified, a statement as to how this conflict has been satisfactorily mitigated or remedied including a reference to the f) information on any other professional activities carried out.
93. Guideline 16 One respondent stated that 16.1(c)(ii) makes
reference to joint EBA-ESMA GLs that are yet to be published and suggested that the application should be subject to separate consultation before inclusion in these GLs the EBA clarifies the Final Report has been published (JC/GL.2016/01) GL 16.1(c)(ii) has been deleted but this reference has been now made in GL 15.1 for the purpose of greater clarity.
ii. a statement from the applicant in relation to the
individual’s requisite experience as enumerated, as appropriate, in the Joint ESMA and EBA Guidelines on the assessment of the suitability of

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 members of the management body [Reference to future Guidelines to be inserted here after consultation]. The first paragraph of Guideline 15.1 has been amended as follows:
For the purposes of the identity and suitability assessment of persons with qualified holdings in the applicant payment institution, without prejudice to the assessment in accordance with the criteria, as relevant, introduced with Directive 2007/44/EC and specified in the joint guidelines for the prudential assessment of acquisitions of qualifying holding (JC/GL/2016/01),the applicant should submit the following information:
94. Guideline 16(e) One respondent asks for a reduction of the
requirements on information on financial and non-financial interests for PISPs. The EBA agrees. As regards the activity carried out by PIs (which cannot grant credit unless in connection with the payment services provided), the risk of financial conflicts of interest are not relevant. Moreover, if such a conflict arises, it could be coped with by the CA for the ongoing supervision. The EBA removes this requirement not only for PISPs, but also for all PIs, AISPs and EMIs. GL 16.1(e) has been deleted:
e) Information on financial and non-financial interests, which should include:
i. A description of any financial and non-financial interests,
such as loans and shareholdings, and relationships and his/her close relatives, such as a spouse, registered partner, cohabite, child, parent or other relation with whom the person shares living accommodations, between the individual and his/her close relatives, or any company that the individual is closely connected with, and the institution, its parent or subsidiaries, or any person holding a qualifying holding in such an institution, including any members of those institutions or key function holders;
ii. whether or not the individual conducts, or has conducted
in the past two years, any business or has any commercial relationship with any of the above listed institutions or persons or is involved in any legal proceedings with those institutions or persons;
iii. whether or not the individual and his/her close relatives
have any competing interests with the institution , its parent or subsidiaries;
iv. whether or not the individual is being proposed on behalf
of any one substantial shareholder;
v. any financial obligations to the institution, its parent or its

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 subsidiaries
vi. any national or local position of political influence held over
the past 2 years, and
vii. if a material conflict of interest is identified, a statement as
to how this conflict has been satisfactorily mitigated or remedied.
95. Guideline 18 One respondent underlined that professional
indemnity insurance may turn into a market barrier and that the consultation of guidelines for professional indemnity insurance should be taken into account before finalising GL 18 and that the EBA should actively seek input from European and international insurers. Another respondent asks for clarification of whether professional indemnity insurance is mandatory for a company that is already a PI and that is willing to offer PIS or AIS, even if the company is largely meeting the minimum own fund obligations. According to PSD2, this requirement is a condition for authorisation and so it cannot be disregarded in these GLs. The EBA understands that a PI has to hold, in any case, a professional indemnity insurance or comparable guarantee if it decides to provide PIS/AIS. The EBA guidelines on the criteria for calculating a minimum monetary amount of professional indemnity insurance or comparable guarantee provide that where an undertaking provides any other payment service from points 1 to 6, as referred to in Annex I to PSD2, in parallel with either PIS or AIS, or both, CAs should calculate the minimum monetary amount of the professional indemnity insurance or comparable guarantee for providing PIS or AIS, or both, without prejudice to requirements related to the calculation of initial capital according to Article 7 of PSD2 and/or own funds according to Article 9 of PSD2. GL 18 has been amended and reads:
b) an insurance contract or other equivalent document confirming the existence of professional indemnity insurance or a comparable guarantee, with a cover amount that is compliant with EBA Guidelines CP/2016/12, showing the coverage of the respective liabilities; c) documentation a record of how the applicant has calculated the minimum amount in a way that is compliant with EBA Guidelines CP/2016/12, including all applicable components of the formula specified therein. A new point (j) has been added to GL 3 that reads:
the information specified in ‘EBA Guidelines on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantee under Article 5(4) of Directive (EU) 2015/2366’ where the applicant intends to provide services 7 and 8 (PIS and account information services (AIS)). Feedback responses to Question 5
96. General responses Several respondents are of the opinion that the
information required from applicants is overly detailed considering the PSD2 wording and spirit. In their opinion, the EBA requests a significant amount of information that puts an unnecessary administrative burden on both the AIS and the CAs which goes beyond the mandates of PSD2. They ask for more See above Question 1. The structure of the GLs already provides proportionality as required by the Level 1 text, considering all the exemptions provided to AISPs from the application of several requirements, despite the fact that they are treated as PIs, for instance by benefiting from the ‘passporting’ rules. Moreover, the list is detailed because CA’s don’t have the

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 proportionality. One respondent's key concern is the potential stifling of innovation which would result from barriers to entry for early-stage applicants. One respondent suggests that GL 17 of section
4.1. (first set of Guidelines applicable to Payment
institutions) should also apply to AIS.
One respondent asks for clarification of whether or not notification of every change would be required. power to request further information as per the maximum harmonised nature of Article 5 of PSD2, and hence of the GLs. Moreover, the detail helps applicants to understand what is expected from them when applying for authorisation. The EBA does not agree that GL 17 should also apply to AIS. The application of Article 5 information requirements to AISPs is set out in Article 33 of PSD2. This Article exempts AISPs from the referred to requirement.
97. Background and
rationale
One respondent asks the EBA to clarify why
ISO 270001 has not been recommended as a standard to apply, having been mentioned in the RTS and recommended by the UK’s Open Banking Standard. The EBA is of the view that regulation should be neutral technologically. None.
98. Background and
rationale
One respondent is of the opinion that the modalities and delay of response in relation with complaints of customers should be specified. The modalities and delay of response are not applicable. The CA is not competent regarding the relations with the client. Moreover, this is out of the scope of the mandate. No None ne
99. Background and
rationale
One respondent thinks that the requirements for the ‘Business plan’ exceed what is necessary for a sound registration and it is not clear how the analysis of the payments market and globally the marketing plan will help the CA to assess an application. This will limit the market to the largest entities which have the internal resources to elaborate those documents. See above Question 4, GL 4.1(a) The EBA has streamlined GL 4 for proportionality reasons. The EBA stresses that the complexity of those documents should be proportional to the size, complexity and risk of the entity. Guideline 4 has been amended and reads:
4.1. The business plan to be provided by the applicant should
contain:
a) a marketing plan consisting of:
i. an analysis of the payments market;
ii. an analysis of the company’s competitive
position in the payment market segment concerned;
iii. a description of payment service users clients,

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 marketing materials and distribution channels;
iv. the main conclusions of any marketing
research carried out b) where available for existing companies, certified annual accounts of the previous three years, or a summary of the financial situation for those companies that have not yet produced annual accounts; c) a forecast budget calculation for the first three financial years that demonstrates that the applicant is able to employ appropriate and proportionate systems, resources and procedures that allow the applicant to operate soundly. It should include:
i. an income statement and balance-sheet
forecast, including target scenarios and stress scenarios as well as their base assumptions, such as volume and value of transactions, number of clients, pricing, average amount per transaction, expected increase in profitability threshold;
ii. explanations of the main lines of income and
expenses, the financial debts and the capital assets;
iii. a diagram and detailed breakdown of the
estimated cashfinancial flows for the next three years. d) information on own funds, including the amount and detailed breakdown breakdown of the composition of initial capital as set out in Article 7 of PSD2. e) information on, and calculation of, minimum own funds requirements in accordance with the method(s) referred

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 to in Article 9 of Directive (EU) 2015/2366 (PSD2) as determined by the competent authority, unless the applicant intends to provide PIS only, including:
i. An annual projection of the breakdown of the
own funds for three years according to the method used, monthly for the first year, and annually for the subsequent two years; and
ii. An annual projection of the own funds for
three years according to the other methods, monthly for the first year, and annually for the subsequent two years.
100. Guideline 1.4 One respondent is of the opinion that this is an
overstatement of the provision in PSD2, which does not mention the impact of size, complexity, etc. The proportionality principle applies as a general principle of law, and it is undisputed that the risk posed by an institution may depend on its size, the complexity of its activities and its organisation. The GLs simply specify the principle.
101. Guideline 1.5 Two respondents criticise the fact that it is not
clear why ‘personal data’ are distinguished from other types of data for confidentiality. The GL should also refer to the use of non-sensitive data. The EBA agrees and deletes ‘personal’. GL 1.4 has been amended and now reads:
All personal data requested under these guidelines for registration as account information service providers (AISPs) are needed for the assessment of the application and will be treated by the competent authority in accordance with the professional secrecy obligations set out in PSD2, without prejudice to applicable Union law and rational requirements and procedures on the exercise of the right to access, rectify, cancel or oppose.
102. Guideline 2.2(h) and
(i)
One respondent asks for clarification of what ‘other industry-specific regulatory body’ means. Besides, these requirements should be deleted. The EBA agrees and deletes the requirement.
103. Guideline 2.2(j) One respondent is of the opinion that the
register certificate of incorporation is costly for a company and it is irrelevant for the registration. The register certificate of incorporation is a proof of existence and therefore is essential. Besides, normally the fees are low. In addition, a certificate is delivered by the None.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Besides, the respondent fears that fees applicable under national law could impede the level playing field across Europe, if fees are applicable in some countries and not in others. companies register when performing the registration.
104. Guideline 3.1(c)(i),
(ii) and (iv)
One respondent thinks that this requirement is far too detailed for the application. Another respondent does not understand the relevance of providing draft contacts between all the parties involved. Besides, this requirement is unclear. One respondent thinks that ‘… different ways through which these services are provided’ is unclear. Two respondents are of the opinion that the information of ‘processing time’ is very complex to provide and find the notion ‘processing time’ very vague. See above Question 4, GL 3.1(c)(ii)-(vi)
105. Guideline 3.1(e) Two respondents are of the opinion that this
requirement seems very difficult to accomplish considering cloud-based solutions for online￾based solutions. Another respondent suggests narrowing this down to premises from which the payment service would be offered. See above Question 4, GL 3.1(e). This is information is relevant to assessing the size and complexity of the AIS.
106. Guideline 3.1(h) One respondent suggests implementing a time
limit. Applicants would rarely know future business plans with any certainty beyond two years. See above Question 4, GL 3.1(i).
107. Guideline 4.1(a) One respondent thinks that there is no relevance
for a ‘marketing plan’.
See above Question 4, GL 4.1(a).

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
108. Guideline 4.1(c)(i)-
(iii)
One respondent thinks that sub bullets (i), (ii) and (iii) are not necessary. See above Question 4, 4.1(c)(i)-(iii).
109. Guideline 5.1(b) and
(c)
One respondent asked this description to be limited to only key outsourcing activities. A personalised approach is not helpful. Another respondent wishes a clarification of what outsourcing arrangements are targeted. The provisions on outsourcing should be clearly limited to banking connection and transfer of funds. Art. 5.1(l) and Art. 19 of PSD2 mentions outsourcing arrangements in general and there is no limitation to banking connections and transfer of funds. The clarification requested is addressed in the Level 1 text. None.
110. Guideline 5.1(d)(i) One respondent apparently wants the following
amendment: ‘a mapping of the on site and off￾site checked on the branches/agent and frequency’. Changes shall be notified pursuant to PSD2. The frequency applicable to PIs is at least yearly, as per the Level 1 text. None.
111. Guideline 5.1(d)(ii) One respondent apparently wants the following
amendment: ‘IT systems, processes, and infrastructure used by applicant`s agent to perform activity’. The EBA does not understand the difference, as GL 5.1(d)(ii) states: the IT systems, the processes and the infrastructure that are used by the applicant’s agents to perform activities on behalf of the applicant. In the EBA’s view, the amendment suggested by the respondent does not change the meaning, since agents always work on behalf of the PI. The provision is useful since it clarifies that the information related to agents’ self-activity is not needed. None.
112. Guideline 5.1(d)(iii) One respondent asked for this information to be
deleted.
See above Question 4, GL 5.1(e)(i)-(iii).
113. Guideline 5.2(e) One respondent criticises the fact that the
guideline suggests that a summary of the mandate is required, but then requests the full mandate. See above Question 4, GL 5.1(e)(i)-(iii).

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
114. Guideline 5.2(f) One respondent does not understand why AIS
should have a possibility to link to payment systems if they are not intended to handle money. The applicant shall indicate if they have the possibility to link to payment systems, so the application regarding this requirement should be a ‘yes’ or ‘no’ answer. None.
115. Guideline 6.1(b)(j)
and (k)
One respondent is of the opinion that the level of requested information is far too detailed. See above Question 4, GL 8.1(b).
116. Guideline 6.1(c) One respondent criticises the fact that, given
that regulatory requirements are set by the CA, it is not clear why the applicant would state these in the application. See above Question 4, GL 8.1(i) and (j).
117. Guideline 7.1(a) One respondent recommended that the
reference to individuals be removed.
See above Question 4, General response.
118. Guideline 8.1(c) One respondent asked for clarification of what
‘monitoring tool’ means.
See above Question 4, GL 10.1(c).
119. Guideline 8.1(e) and
(f)
One respondent asks for clarification of what is expected and believes that the extension to the relationship with counterparties goes too far. See above Question 4, GL 10.1(e) and (f).
120. Guideline 8.1(h) One respondent is of the opinion that the list of
individuals is going into too much detail to assess the AIS application. This is a requirement pursuant to Art. 5.1(n) PSD2 and the GL should be detailed because CA’s do not have the power to request further information. The EBA underlines that the core function of AISPs is access to data. None.
121. Guideline 9.1(a) One respondent sees this requirement as useless
for AIS.
This is necessary regarding the analysis of the operational risk.
None.
122. Guideline 9.1(e) One respondent is of the opinion that this
information should be requested of only systemic actors.
GL 9.1(e) has been removed:
(e)description of the mitigation measures to be adopted by the applicant, in case of termination of its payment services activities, to

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 Another respondent finds this information irrelevant for AIS. avoid adverse effects on payment systems and on the payments services users, ensuring execution of pending payment transactions and termination of existing contracts.
123. Guideline 10.1(c) One respondent thinks that the request for an
‘exhaustive list of authorized connections’ including all employees is excessive. See above Question 4, GL 13.1(c) and (d).
124. Guideline 10.1(d),
(g), (h), (l) and (j)
Two respondents are of the opinion that (d) is too detailed and redundant with (e) and (g). The information requested in (l) and (j) is redundant with the rest of the information already requested in (g). GL 10 should generally be simplified, as it relates to very sensitive information. Another respondent is of the opinion that, regarding GL 10, too many details are requested. Requirements (g) and (h) are applicable to only PIS and not to AIS. The detail is necessary to state the necessary information regarding the registration. Without this itemisation, it would not be clear for the applicant which documents are required. Those requirements are fundamental to assessing the structure of the security measures adopted. The use of data is the core business of AIS and therefore these requirements should not be streamlined. None.
125. Guideline 11 One respondent calls for more proportionality,
as several AIS have been developed by young professionals or students who do not comply with the typical profile described in the GLs. The itemisation should ensure a harmonisation with PSD2. The principle of proportionality is introduced in GL 1.4. and allows the CA and the applicant to take into account their size, internal organisation and the nature, scale and complexity of their activities when developing and implementing policies and processes. This allows a proportionate treatment of smaller applicants. Moreover, the consumers should be protected from the inexperience of the applicants who should comply with the requirements, given the fact that they shall be treated as PIs, in accordance with Article 33(2) of PSD2. None.
126. Guideline 11.1(b)(ii) One respondent criticises the reference to EBA￾ESMA GLs that are yet to be published. Their
See above Question 4, GL 16.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 application should be subject to a separate consultation before they are incorporated into the present GLs. Feedback on responses to Question 6
127. General responses Sixteen respondents answered ‘yes’.
Eleven of these respondents agree, some of which requested additional information or documents. Five respondents do not expressly agree or disagree, but request clarifications or minor amendments. Three respondents answered ‘no’. Two of these respondents do not expressly agree or disagree but request such significant amendments that they can be considered to disagree. One respondent expressly disagrees and requested amendments. The answers of five respondents were n/a. four of these respondents are not concerned. The contribution of one respondent (a national bank) is not relevant. The respondents mostly agreed with the draft GLs.
128. General responses Several respondents consider that the level of
detail and volume of information required is excessive and overly granular. Several respondents believe that CAs have the power to request additional information. CAs do not have the power to request additional information as per the full harmonisation nature of the Level 1 text and of the GLs. This is why the list has to be as exhaustive and detailed as possible. n/a
129. General responses Two respondents request that the draft GLs
expressly provide that they do not apply to credit institutions providing payment services or This is derived from the CRD IV provisions and should not give rise to an explicit mention in the GLs. None.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 electronic money services.
130. General responses Three respondents ask for more consistency
between the draft guidelines and (i) the RTS on SCA and CSC and (ii) the GLs on professional indemnity insurance. All the information needed to calculate professional indemnity insurance has now been inserted into the GLs by cross referencing to the referred GLs. A new letter (j) has been added to Guideline 3.1
3.1 The programme of operations to be provided by the applicant
should contain the following information:(…) j) the information specified in the EBA Guidelines on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantee under Article 5(4) of Directive (EU) 2015/2366 where the applicant intends to provide services 7 and 8 (PIS and account information services (AIS)). Guideline 18 has been amended as follows:
As evidence of a professional indemnity insurance or comparable guarantee that is compliant with EBA Guidelines on the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantee (EBA/gl/2017/08) [which at time of publishing this document is under separate consultation as EBA-CP-2016-12],and Article 5 (2) and 5 (3) of PSD2, the applicant for the provision of payment initiation services or account information services should provide the following information:
a) an insurance contract or other equivalent document confirming the existence of the professional indemnity insurance or comparable guarantee, with a cover amount that is compliant with the EBA Guidelines (EBA/gl/2017/08), showing the coverage of the relevant liabilities; CP/2016/12; and b) documentation a record of how the applicant has calculated the minimum amount in a way that is compliant with EBA Guidelines (EBA/gl/2017/08) CP/2016/12, including all applicable components of the formula specified therein.
131. General response One respondent asks for additional information
relating to (i) the erase procedure and (ii) symmetrical on-boarding and off-boarding procedures in accordance with GDPR requirements. The nature of the response is unclear to the EBA and therefore no specific answer can be provided.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
132. General responses Two respondents ask for additional information
relating to the quality of the applicant’s information security management system, in particular by adding references to ISO standards. The EBA is of the view that regulation should be neutral. None.
133. General response One respondent suggests specifying the
notification requirements in case of changes to the information provided by applicants. The EBA mandate as per Article 5 of PSD2 relates to the information to be provided to CAs in the application for the authorisation. It does not relate to the notification requirement set out in Article 16 in cases of changes to the information and evidence provided in accordance with
Article 5, which are governed by national law.
None.
134. Guideline 1.4 One respondent considers that the GL should
specify that experience and knowledge would be expected to vary with the type of firm. GL 1.4 relating to (i) the elements to be taken into account by institutions when developing and implementing policies and processes, and (ii) the suitability of their managers falls outside the EBA mandate as per Article 5 of PSD2. The assessment is out of the scope of PSD2. However, the EBA clarifies that the level of information expected depends on the size, complexity and risk of the firm. GL 1.4 has been removed and merged with GL 1.1. A new GL 1.2 deals with proportionality. GLs 1.1 and 1.4 have been merged into a new GL 1.2 that reads:
.21 The information provided by applicants should be true, complete, accurate and up to date. All applicants should comply with all the provisions in the set of guidelines that applies to them. The level of detail should be proportionate, and to the applicant’s size and internal organisation, and to the nature, scope, complexity and riskiness of the particular service (s) that the applicant intends to provide. In any event, in accordance with Directive (EU) 2015/2366, the directors and the persons responsible for the management of the payment institution are of good repute and possess appropriate knowledge and experience to perform payment services, regardless of the institution’s size, internal organisation and the nature, scope and complexity of its activities and the duties and responsibilities of the specific position.
135. Guideline 1.5 One respondent considers that all should be
subject to professional secrecy obligations as set out under PSD2 Article 24(1). Comment already addressed in relation to Question 4.
136. Guideline 2.1(h) One respondent considers as unclear what is
meant by ‘other industry-specific regulatory body’. In its view, an applicant is either regulated or has been regulated by a CA or is not and has not been. Comment already addressed in relation to Question 4. GL 2.1(h) has been amended and reads:
an indication of whether or not the applicant has ever been, or is currently being regulated, by a competent authority in the financial services sector or by any other industry specific regulatory body;
137. Guideline 2.1(i) One respondent considers as unclear what is Comment already addressed in relation to Question 4.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 expected in relation to trade associations.
138. Guideline 3.1(b) One respondent suggests adding a definition of
‘possession of funds’.
Comment already addressed in relation to Questions 1 and
4. Definitions are those of the Level 1 text. Terms included
in the provisions of the Level 1 text should retain their meaning, also when used in the GLs, for reasons of legal certainty. For that matter, GLs should, in principle, not provide definitions for these terms. None.
139. Guideline 3.1(c) One respondent considers as unclear what is
meant by ‘a description of the procedures and mechanisms taken in place for the issuance, redemption and distribution of e-money’ This is indeed redundant with GL 3.1(e) and should be removed. GL 3.1(c) has been removed:
3.1 c) a description of the procedures and mechanisms taken in place
for the issuance, redemption and distribution of e-money;
140. Guideline 3.1(e)(iii) Several respondents ask for the removal of the
provision of draft contracts agreed with all the parties involved.
One respondent considers that finalised contracts should be provided. Comment already addressed in relation to Question 4.
141. Guideline 3.1(g) Several respondents consider that the number
of premises is likely to become quickly obsolete.
One suggests indicating a range rather a precise
figure.
Comment already addressed in relation to Question 4.
142. Guideline 3.1(k) One respondent considers that the indication of
other business activities in the future should be accompanied by a time limit. Comment already addressed in relation to Question 4.
143. Guideline 4.1(a) One respondent considers that requesting a
marketing plan constitutes a barrier for small entities.
Several respondents consider that competitive analysis and main conclusions of the marketing research are too subjective and is sensitive information. Several respondents consider that the scope of the marketing plan should be specified. Comment already addressed in relation to Question 4.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
144. Guideline 4.1(a) One respondent suggests adding a definition of
‘client’.
Comment already addressed in relation to Questions 1 and 4.
145. Guideline 5.1(c) Several respondents request the specification of
the information relating to outsourcing as relating to only outsourcing of e-money service functions. One respondent considers that an outsourcing agreement should cover security and data protection dispositions in great detail. Comment already addressed in relation to Question 4.
146. Guideline 5.1(e)(i) One respondent considers that the meaning of
this paragraph requires clarification.
Clarification can be added on the basis of the wording set out in the GL applicable to PIs. There is alignment between the set of GLs for EMIs and that for PIs on this point. GL 5.1(e)(i) has been amended and reads:
a mapping of the off-site and on-site checks that the applicant intends to be performed, at least annually, of on branches, agents and distributors and their frequency.
147. Guideline 5.1(e)(iii) One respondent considers as unclear that a
summary of the mandate is required, but then requests the full mandate. One respondent understands that the provision of the mandate agreement is required. Comment already addressed in relation to Question 4.
148. Guideline 5.1(g) Several respondents request the specification of
the concept of ‘close links’.
Comment already addressed in relation to Question 4.
149. Guideline 7.1(b) Several respondents consider that the contact
details of the persons with access to safeguarding accounts are likely to become quickly obsolete. Comment already addressed in relation to Question 4.
150. Guideline 7.1(d) Several respondents consider that credit
institutions will refuse to provide in the safeguarding account agreement that the functioning modalities of this account comply with the requirements of Article 10 of PSD2. The contractual functioning modalities of the safeguarding account shall comply with the requirements of Article 10 of PSD2. It is therefore not so onerous to provide explicitly a compliance statement in the safeguarding account agreement. CAs may thus rely on such a statement and avoid an extensive analysis of the full agreement. None.
151. Guideline 8.1(c) Several respondents wonder why they should The EBA agrees and removes the referred requirement GL 8.1(c) has been removed:

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 confirm the regulatory reporting requirements applicable to them, whereas it is supposed to be known by the CAs. ‘a confirmation of the regulatory reporting requirements that apply to the applicant;’
152. General response One respondent believes that an internal contact
point should also be indicated to facilitate contact with the ASPSP as well as information on the chosen ‘Qualified Trust Service Provider’. This respondent also believes that this should be a prerequisite for filing on national and EBA registers. Comment already addressed in relation to Question 4.
153. Guideline 10 Several respondents request the specification of
the concept of ‘sensitive payment data’.
Comment already addressed in relation to Question 1.
154. Guideline 12.1(f) One respondent considers that GL 10 should
apply to not only ‘sensitive data’, but any data used and possibly held by the institutions in this scope and that institutions should be required to appoint a data protection officer. This proposal goes beyond the PSD2 requirement. None.
155. Guidelines 13.1 (c)
and (d)
Several respondents consider that providing supporting documents to illustrate the principles and definitions applicable to the collection of statistical data on performance, transactions and fraud, such as manuals, is premature at the authorisation stage. The provision of this information is a PSD2 requirement for authorisation purposes set out in Article 5(1)(i). The provision of ‘a supporting documents such as manual that describes how the system works’ is not unreasonable from this perspective. None.
156. Guideline 14.1(c) Several respondents consider that providing the
detailed list of all authorised connections from outside is too onerous. External access to institutions’ data may give rise to significant risks, in particular in relation to sensitive payment data. It is therefore necessary to ensure that such external access be subject to appropriate logical security measures and mechanisms. Whereas CAs indeed do not need to know each particular external connection, they need to be provided with the list of each kind of external connection. Clarification can be brought. GL 13.1(c) has been amended and reads:
an exhaustive list the type of authorised connections from outside, such as with partners, service providers, entities of the group and employees of the applicant working remotely, including the rationale for such connection; (…)
157. Guideline 14.1(g) One respondent considers that the GL goes
beyond what is required for banks and would introduce a non-level playing field for PIs. Credit institutions are subject to requirements similar to those applicable to payment institutions; there is no non￾level playing field. None.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 However, the GLs are subject to PSD2 and there are some requirements that differ from those of CRD IV that need to be taken into account.
158. Guideline 14.1(g) One respondent suggests replacing the wording:
‘do not expose the applicant to increased money laundering and terrorist financing risk’ by ‘are monitored to address money laundering and terrorist financing risk’. The EBA disagrees. None.
159. Guidelines 15.1(a)
;15.2 and
16.1(a)(i)(e)(f)
Several respondents consider that business and financial information requested in relation to natural persons with qualifying holdings is excessive and likely to dissuade potential investors. The same applies to the information requested for persons responsible for the management of the payment institutions. The EBA has streamlined GLs 15 (1) and (2) and 16.1(a)(i). Specifically in Guideline 15.2 (c) the EBA has removed all the information relating to the undertakings that the person directs or controls contained in points i-xi and added a new point (d) with significantly less information. GL 15.1 has been amended and reads:
c) a list of the names of all persons and other entities that have or, in the case of authorisation, will have qualifying holdings in the applicant’s capital, indicating for each such person or entity:
i. the number and type of shares or other holdings
subscribed or to be subscribed;
ii. the nominal value of such shares or other
holdings;
iii. any premium paid or to be paid;
iv. any security interests or encumbrances created
over such shares or other holdings, including the identity of the secured parties; and
v. where applicable, any commitments made by such
persons or entities aimed at ensuring that the applicant will comply with applicable prudential requirements. Guideline 15.2 has been amended and reads:
15.2 Where a person who has or, in case of authorisation, will have a
qualifying holding in the applicant’s capital is a natural person, the application should set out all of the following information relating to the identity and suitability of that person:
a) personal details including the person’s name and name at

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 birth, date and place of birth, citizenship, personal national identification number (where available), address, contact details and a copy of an official identity document; b) a detailed curriculum vitae, stating the education and training, previous professional experience and any professional activities or other functions currently performed; c) a statement, accompanied by supporting documents, containing the following information concerning the person and any undertaking which the person directs or controls and of which the applicant is aware after due and careful enquiry:
d) a list of undertakings that the person directs or controls and of which the applicant is aware of after due careful enquiry, the percentage of control either direct or indirect in these companies; their status (whether or not they are active, dissolved, etc); and a description of insolvency or similar procedures; GL 16.1(a)(i) has been amended and reads:
personal details, including:
ii. the full name, gender, place and date of birth, address and
contact details, nationality, and personal identification number or copy of ID card or equivalent; Guidelines 16.1 (e) and (f) have been removed:
(e) Information on financial and non-financial interests, which should include:
i. a description of any financial and non-financial interests, such
as loans and shareholdings, and relationships and his/her close relatives, such as a spouse, registered partner, cohabite, child, parent or other relation with whom the person shares living accommodations, between the individual

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 and his/her close relatives, or any company that the individual is closely connected with, and the institution, its parent or subsidiaries, or any person holding a qualifying holding in such an institution, including any members of those institutions or key function holders;
ii. whether or not the individual conducts, or has conducted in
the past two years, any business or has any commercial relationship with any of the above listed institutions or persons or is involved in any legal proceedings with those institutions or persons;
iii. whether or not the individual and his/her close relatives have
any competing interests with the institution , its parent or subsidiaries;
iv. whether or not the individual is being proposed on behalf of
any one substantial shareholder;
v. any financial obligations to the institution, its parent or its
subsidiaries
vi. any national or local position of political influence held over
the past 2 years, and
vii. if a material conflict of interest is identified, a statement as to
how this conflict has been satisfactorily mitigated or remedied including a reference to the f) information on any other professional activities carried out.
160. Guidelines 15.2(a)
and 16.1( a)(i)
One respondent challenges the fact that the GLs require a copy of an ID card. It is crucial for persons of qualified holding and managers to provide this information. The Level 1 text requires proof of identity and assessment of suitability for both. None. Feedback on responses to Question 7
161. General responses Five respondents agree that the GLs are helpful, n/a n/a

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 without further comments. Five respondents indicated that the GLs are non applicable. Four respondents did not have any comments. Ten respondents expressed the specific comments on the GLs outlined below.
162. General responses One respondent suggested adding a provision on
how long an incomplete application can be pending before it is invalidated, after which a new application would be required. This is not provided for in PSD2. As a consequence, it is not included in the mandate given to the EBA by PSD2 and therefore not something that the EBA can address in these GLs. None.
163. General responses Two respondents raised a question regarding the
treatment of existing market players. One of these two respondents proposed that priority treatment should be granted to existing market players in order to not penalise the final customers by depriving them of the services provided during the assessment period by the CA. The other respondent wanted to know what kind of information will be required by already licensed PIs/EMIs which intend to expand their licenses. The treatment of existing PIs and EMIs licensed under Directive 2007/64/EC (PSD1) is regulated by Article 109 of PSD2 and Article 115(5) of PSD2 for existing AISPs and PISPs. Regarding the expansion of the license, Article 16 of PSD2 obliges licensed entities to inform the CA of any changes to their business model. It is up to the CA to specify which information has to be provided by already licensed PIs and EMIs. This issue should be dealt with in the transposition groups organised by the European Commission. The national law transposing PSD2 should provide clarity on the issue. None.
164. General responses One respondent suggested introducing a shorter
procedure for AISPs turning into PISPs, so that only the additional items will have to be provided instead of submitting a completely new application file. The rationale would be to speed up the process, meet clients’ expectations and allow a level playing field among start-ups and traditional players. The treatment of existing AISPs and PISPs is regulated by
Article 115(5) of PSD2.
Regarding the changes in the activities, Article 16 of PSD2 obliges licensed entities to inform the s of any changes to their business model. It is up to the CAs to specify which information has to be provided by AISPs turning into PISPs. This issue should be dealt with in the transposition groups None.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 organised by the European Commission. The national law transposing PSD2 should provide clarity on the issue.
165. Guideline 1.1 Three respondents considered that the GLs
should set out the obligations of the CAs regarding the evaluation of the completeness of the application. In particular, the three-month timeline for granting an authorisation according to Article 12 of PSD2 should be contained in the GLs. Two of these three respondents also pointed out that CAs have an obligation to justify refusals of authorisations, which should also be mentioned in the GLs. The three-month deadline runs from completion of the application file and there is no requirement under PSD2 to confirm the date of completion within a certain timeframe. Regarding the request relating to the obligation to justify a refusal of authorisation, the EBA considers that this is not included in the mandate given to the EBA by PSD2 and therefore not something that the EBA can address in these GLs. In addition, the wording used in the present GLs is the same wording as that used in the RTS on the authorisation of credit institutions. None.
166. Guideline 1.1 One respondent considered that the reference
to ‘all the information needed’ should be clarified, by referring to ‘all the information set out in the Guidelines’. This is stated in GL 1.1: ‘all the information needed by the competent authorities in order to assess the application in accordance with these Guidelines’. The EBA agrees to further clarify this in the same provision. GL 1 has been amended and reads:
1.1 An application should be deemed to be complete for the
purpose of Article 12 of Directive (EU) 2015/2366 if it contains all the information needed by the competent authorities in order to assess the application in accordance with these guidelines and with Article 5 of Directive (EU) 2015/2366.
167. Guideline 1.1 According to two respondents, proportionality
should be applied. Indeed, the information requested should depend on the size and complexity of the applicant’s business. The consequence of requesting too broad information is that application procedures will be long and costly and the AIS/PIS business risks to develop first outside of Europe. One of these two respondents advised the EBA to compare the documents requested in the GLs with those requested for insurance providers and credit institutions, in order to get a real understanding of the mandatory documentation to be The rationale for the detailed nature of the GLs is the maximum harmonisation nature of PSD2 (Article 107) and to provide a level playing field. Another reason for the amount of detail is to provide reassurance to the applicant as to the information that is expected during the authorisation procedure. In order to ensure a proportionate treatment of smaller and less complex applicants, compared with large-scale and complex applicants, the principle of proportionality has been introduced in the GLs (GL 1.4 of each of the guidelines relating to payment services 1-8, only payment service 8 and electronic money). Pursuant to this principle, None.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 provided. institutions should take into account their size, internal organisation and the nature, scale and complexity of their activities when developing and implementing policies and processes.
168. Guideline 1.1 As opposed to the previous two respondents,
one respondent considered that detailed GLs have merits for applicants and for CAs, as they will help to reduce delays. The GLs should contribute to a consistent approach between CAs in terms of the level of detail, information and supporting documentation required by CAs prior to the submission of a formal application, as well as following the submission of a formal application. The EBA agrees that detailed GLs contribute to a more harmonised approach among CAs and to a better preparation of the application files by applicants, which may reduce delays. None.
169. Guideline 1.1 Regarding the completeness of information, one
respondent pleaded in favour of a regulated cooperation and, as far as possible, a standardised exchange process between competent authorities regarding the identification and application of payment services. This would enhance the level playing field and the efficiency of the authorisation procedure. The exchange process among CAs is not included in the present mandate given to the EBA by PSD2. It is outside the scope of the mandate. It will however be dealt with under the mandate given to the EBA by Article 29(6) of PSD2, to be developed by another EBA workstream ‘ACBPS – Cross￾border supervision’. None.
170. Guideline 1.1 One respondent noted that, in terms of a level
playing field, it may be useful to ask CAs to maintain records of timelines for the completion of applications for authorisation and registration, so that any deficiencies and/or inconsistencies between Member States may be reported to the EBA. This is not provided for in PSD2. As a consequence, it is not included in the mandate given to the EBA by PSD2 and is therefore not something that the EBA can address in these GLs. Each CA may, however, on a voluntary basis, maintain records of timelines. None.
171. Guideline 1.2 One respondent asked for the GLs to contain
clear deadlines for the submission of missing information by the applicant. This is not provided for in PSD2. As a consequence, it is not included in the mandate given to the EBA by PSD2 and therefore not something that the EBA can address in these GLs. However the EBA rewords the GLs in order to clarify that GL 1.2 has been amended and reads:
Where the information provided in the application is deemed to be incomplete, the competent authority should send, in paper format or by electronic means, a request to the applicant, indicating in a clear way information is missing, and should provide to the applicant the

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2 the missing information should be requested in a clear and detailed way. opportunity to submit the missing information.
172. Guideline 1.2 One respondent also considered that CAs should
communicate in a clear and transparent way with applicants during the application process, in order to clearly express their expectations. This is covered by GL 1.2, which asks CAs to exactly indicate what information is missing to the applicant. None.
173. Guideline 1.2 One respondent requested that the GLs require
CAs to provide a shorter path for the submission of missing information for an application that was refused because it was incomplete or mistaken. It might be particularly difficult for AISPs/PISPs to start the whole process anew. This is not provided for in PSD2. As a consequence, it is not included in the mandate given to the EBA by PSD2 and therefore not something that the EBA can address in these GLS. It should therefore be up to CAs to decide according to which path missing information has to be submitted. None.
174. Guideline 1.3 n/a
175. Guideline 1.4 One respondent asked that the GLs contain clear
deadlines for the submission of information by the applicant (same comment as that related to point 1 under GL 1.2 above). This is not provided for in PSD2. As a consequence, it is not included in the mandate given to the EBA by PSD2 and therefore not something that the EBA can address in these GLs. None.
176. One respondent noted that the applicant may
not be aware of the ‘information held by the competent authorities’. The respondent therefore suggests that reference should be made to ‘information held by the competent authorities of which the applicant is aware and which is relevant to the application’. The EBA agrees that only information that is relevant to the application should be taken into account by the CAs in their assessment of the application file. This is addressed in GL 1.1, which refers to ‘all the information needed … in order to assess the application in accordance with these Guidelines’. However, this information is not necessarily known by the applicant, as CAs may have different sources of information of which the applicant may not be aware, i.e. exchanges among CAs, information received by the FIU, internal databases, research, etc. None.
177. Guideline 1.5 One respondent was of the view that updating
the application is a reasonable request, but that updates should be subject to proportionality, so that only information relevant to the authorisation request should have to be communicated to the CAs. The EBA agrees that updates of information should only be provided if relevant to the application file. The EBA considers that this is addressed in GL 1.5, which refers to ‘an update to the application’. The EBA clarifies that these updates would be covered by the proportionality provisions set out in the GLs. None.

FINAL REPORT ON GUIDELINES ON AUTHORISATION AND REGISTRATION UNDER PSD2
178. Guideline 1.5 One respondent considered that, given the
amount of information to be provided to CAs, the request for updates of this information will lead to very regular updates. As a consequence, the costs incumbent on the entities will be significant. As mentioned under the previous point, the updates of information to be provided are those relating to the application file. The costs incumbent on the entities should therefore not be too significant. The EBA clarifies that these updates would be covered by the proportionality provisions set out in the GLs. None.
179. Guideline 1.5 One respondent noted that the GLs should
provide for criteria and processes to revoke an authorisation/registration if the authorisation/registration criteria are no longer fulfilled or if the institution becomes ‘fraudulent’ or insolvent.
Article 13 of PSD2 determines the situations in which an
authorisation can be withdrawn. The specification of criteria or of the process of withdrawal is not included in the mandate given to the EBA by PSD2 and is therefore not something that the EBA can address in these GLs. None.