Instruction (Historical) No. 2/2024

Instruction No. 2/2024
BO No. 1/2024 2nd Supplement • 2024/02/08
..................................................................................................................................................................................................
Topics
Payment Systems :: Clearing
Mod. 99999940/T – 01/14

Index
Text of the Instruction
«Annex IX - Terms and Conditions of the Account Derivation Identifier and Beneficiary/Payer Confirmation Service

Text of the Instruction
Subject: Amendment to the Regulation of the Interbank Clearing System – SICOI.

Pursuant to Article 14 of its Organic Law and Article 92 of the General Regime of Credit Institutions and Financial Companies (RGICSF), it is the responsibility of the Bank of Portugal to regulate, supervise, and promote the proper functioning of payment systems.

In this context, the Bank of Portugal is the regulator and manager of the Interbank Clearing System (SICOI), the retail payment system where payments made with cheques, commercial instruments, credit transfers, instant transfers, direct debits, and card-based operations are processed.

Considering that in recent years there has been a growing digitalization of the economy and profound changes in the behaviors and expectations of payment service users, and in order to ensure the proper functioning and security of payment systems, SICOI must evolve to allow its participants to use new functionalities:

The Account Derivation Identifier functionality - Proxy Lookup, which allows SICOI participants to provide payment service users with the possibility of initiating a payment operation by indicating a “user identifier,” from which the respective “payment account identifier” is obtained.
The Beneficiary/Payer Confirmation functionality - Confirmation of Payee/Payer, which allows SICOI participants to provide payment service users with the possibility of confirming the identity of the beneficiary or debtor of a payment operation before it is initiated.

These functionalities, on one hand, provide greater usability and convenience to payment service users and, on the other hand, contribute to greater security and prevention of fraud, scams, and errors.

Instruction No. 2/2024 BO No. 1/2024 2nd Supplement • 2024/02/08 Topics Payment Systems :: Clearing
..................................................................................................................................................................................................
Mod. 99999940/T – 01/14

To establish the conditions for making these functionalities available to SICOI participants, it is necessary to review the regulation of this system, contained in Instruction No. 8/2018 of March 22.

Additionally, the price list applicable to SICOI participants is amended, specifically the monthly participation fee per sub-system or sub-system branch, reflecting the regular exercise of updating based on the recovery of costs borne by the Bank of Portugal associated with the management of SICOI.

Thus, under the competence attributed to it by Article 14 of its Organic Law and Article 92 of the RGICSF, the Bank of Portugal amends the provisions of Instruction No. 8/2018 – SICOI Regulation –, determining the following:

A new Chapter III is added to Instruction No. 8/2018 of March 22, with the following title, proceeding to renumber the following Chapters and numbers:

«III - ACCOUNT DERIVATION IDENTIFIER AND BENEFICIARY/DEBTOR CONFIRMATION SERVICE.

Provision of the Account Derivation Identifier and Beneficiary/Payer Confirmation Service

9.1. The Bank of Portugal makes available, to participants in the immediate transfers sub-system and in the SEPA branch of the credit transfers sub-system in SICOI, established in Portugal, the Account Derivation Identifier functionality – Proxy Lookup (PL) and the Single Beneficiary Confirmation functionality – Confirmation of Payee Single (CoPS), as described in Annex IX.

9.2. The Bank of Portugal makes available, to participants in the immediate transfers sub-system, in the SEPA branch of the credit transfers sub-system, and in the direct debits sub-system in SICOI, established in Portugal, the Bulk Beneficiary/Payer Confirmation functionality – Confirmation of Payee/Payer Bulk (CoPB), as described in Annex IX.

9.3. The PL functionality allows SICOI participants, established in Portugal, to provide payment service users with the possibility of initiating a payment operation by indicating a “user identifier” of the beneficiary, from which the respective “payment account identifier” is obtained.

9.4. The CoPS and CoPB functionalities allow SICOI participants, established in Portugal, to provide payment service users with the possibility of confirming the identity of the beneficiary or debtor of a payment operation before it is initiated.

Provision of the Account Derivation Identifier and Beneficiary/Payer Confirmation Service to payment service users

10.1. Participants in the immediate transfers sub-system and in the SEPA branch of the credit transfers sub-system, established in Portugal, are obliged to make the PL and CoPS functionalities available to payment service users.

10.2. Participants in the immediate transfers sub-system, in the SEPA branch of the credit transfers sub-system, and in the direct debits sub-system, established in Portugal, are obliged to make the CoPB functionality available to payment service users.

Terms and conditions

Participation in the immediate transfers sub-system, in the SEPA branch of the credit transfers sub-system, and in the direct debits sub-system, by entities established in Portugal, implies acceptance of the Terms and Conditions defined in Annex IX of this Regulation.»

The letter i) of number 49.4 of Instruction No. 8/2018 of March 22 is amended to read as follows, with the following letter being renumbered:

« i) Annex IX – Terms and Conditions of the Account Derivation Identifier - Proxy Lookup and Beneficiary/Payer Confirmation - Confirmation of Payee/Payer Service»

A new Annex IX is added to Instruction No. 8/2018 of March 22, with the following wording, with the following Annexes being renumbered:

«Annex IX - Terms and Conditions of the Account Derivation Identifier and Beneficiary/Payer Confirmation Service

The Bank of Portugal makes the Account Derivation Identifier - Proxy Lookup and Beneficiary/Payer Confirmation - Confirmation of Payee/Payer service (hereinafter, “PLCP service”) available to SICOI participants established in Portugal.

With the provision of this service, the Bank of Portugal intends, on one hand, to reinforce security in the execution of payment operations and, on the other hand, to contribute to better usability and experience for payment service users.

The PLCP service is provided in accordance with the following Terms and Conditions:

I. OBJECT

Scope

1.1. The Bank of Portugal makes the PLCP service available to participants in the immediate transfers sub-system, in the SEPA branch of the credit transfers sub-system, and in the direct debits sub-system of SICOI, who are established in Portugal.

1.2. The PLCP service is composed of three functionalities:
a) The Account Derivation Identifier functionality - Proxy Lookup (PL); b) The Single Beneficiary Confirmation functionality - Confirmation of Payee single (CoPS); c) The Bulk Beneficiary/Payer Confirmation functionality - Confirmation of Payee/Payer bulk (CoPB).

II. ACCOUNT DERIVATION IDENTIFIER FUNCTIONALITY

Account Derivation Identifier Functionality

2.1. The PL functionality allows the initiation of payment operations by indicating a “user identifier” which, in the case of natural persons, is the mobile phone number and, in the case of legal entities, the Corporate Tax Identification Number (NIPC).

2.2. The provision of the PL functionality is based on a database, managed by the Bank of Portugal, which contains the association between the “user identifier” and the respective “payment account identifier” – the International Bank Account Number (IBAN).

2.3. Within the scope of the PL functionality, participants must communicate to the Bank of Portugal, upon the user’s request, the following information:
a) Regarding natural persons: the mobile phone number (“user identifier”), the Tax Identification Number (NIF), and the IBAN of the payment account (“payment account identifier”); b) Regarding legal entities: the NIPC (“user identifier”) and the IBAN of the payment account (“payment account identifier”).

2.4. The Bank of Portugal ensures the centralization and maintenance of the information transmitted to it by participants, as well as the response to consultation requests made by them.

2.5. The information to be transmitted by participants to the Bank of Portugal must comply with the technical specifications provided in the Operating Manual of the Account Derivation Identifier and Beneficiary/Payer Confirmation Service.

Association of the “user identifier” to the “payment account identifier”

3.1. Participants must communicate to the Bank of Portugal the association of a “user identifier” to the “payment account identifier” as soon as it is requested by the payment service user.

3.2. Participants must allow payment service users to associate their “user identifier” with their respective “payment account identifier” in at least the remote electronic channels where SEPA credit transfers or SEPA instant transfers are made available, excluding applications operated by third parties.

3.3. Participants must ensure that, in the same channels where association is permitted under point 3.2, payment service users can consult at any time whether their “user identifier” is associated with their respective “payment account identifier.”

3.4. The association between the “user identifier” and the “payment account identifier” and its consultation may only be requested by the participant where the payment account that the payment service user wishes to associate or consult is domiciled.

3.5. At any given time, a specific “user identifier” may only be associated with one “payment account identifier.”

Alteration or elimination of the association of the “user identifier” to the “payment account identifier”

4.1. Participants must, at all times, allow payment service users to alter or eliminate the association between their “user identifier” and the “payment account identifier.”

4.2. Participants must allow payment service users to request the alteration or elimination of the association of their “user identifier” to the “payment account identifier” in the channels where association is permitted, under point 3.2.

4.3. The alteration of the association of the “user identifier” to the “payment account identifier” may only be requested by the participant where the payment account that the payment service user wishes to associate is domiciled.

4.4. The elimination of the association between the “user identifier” and the “payment account identifier” may only be requested by the participant where the payment account that the payment service user wishes to dissociate is domiciled.

Initiation of payment operations using the Account Derivation Identifier functionality

5.1. Participants must allow payment service users to initiate payment operations using the PL functionality through the remote and in-person channels where SEPA credit transfers or SEPA instant transfers are made available in a non-bulk manner.

5.2. The PL functionality cannot be used by payment service users to create recurring transfer orders, nor for creating schedules.

5.3. Any use of the PL functionality is carried out by participants on behalf of payment service users, at their initiative, and as a preparatory step for a payment operation that is expected to be performed.

5.4. Participants must implement control mechanisms that prevent abusive use of the PL functionality by payment service users, notably the making of queries that do not result in the actual initiation of payment operations.

5.5. Participants may not charge any commission to payment service users for the use of the PL functionality.

Responsibility for transmitted information

6.1. The completeness, currency, and accuracy of the data submitted by the participant within the scope of the PL functionality is their exclusive responsibility.

6.2. The transmitted data must be duly verified and certified by participants, ensuring, notably, that the “user identifier” effectively belongs to the payment service user.

6.3. The “user identifier” of natural persons (mobile phone number) should be the same that is registered and certified with the participant for interaction with the payment service user, notably for the purposes of strong customer authentication, as provided for in the Legal Regime of Payment Services and Electronic Money (RJSPME), approved in annex to Decree-Law No. 91/2018 of November 12.

6.4. Whenever a participant, by their own initiative or at the initiative of the payment service user, verifies that there has been an omission or inaccuracy in the communication of data, they are obliged to proceed with its immediate rectification.

6.5. Requests made by payment service users, through electronic channels, aimed at associating a “user identifier” to the “payment account identifier,” as well as subsequent alterations or eliminations, must be validated by the participant through the application of strong customer authentication. When the request is made through non-electronic channels, the participant must ensure the collection of elements that allow proof that the instruction was effectively transmitted by the client.

6.6. The closure of a payment service user’s payment account implies that the participant must, by the end of the day the account is closed, communicate to the Bank of Portugal the elimination of associations that are active for the respective “payment account identifier.”

6.7. Participants must provide, notably in the framework contract with payment service users, that the participants or the Bank of Portugal may eliminate any association that is active, for objectively justified reasons related to the security of the PL functionality or suspicion of fraudulent use thereof. In this case, participants must inform payment service users of the elimination of the PL association, justifying the reason, if possible before such elimination or, at the latest, immediately after it.

6.8. Participants must transmit to the Bank of Portugal, as soon as they become aware of them, any anomalies, fraudulent actions by third parties, and/or attempts to manipulate data relating to the use of the PL functionality, in the manner provided for in point V of these Terms and Conditions.

III. BENEFICIARY/DEBTOR CONFIRMATION FUNCTIONALITIES

Single Beneficiary Confirmation Functionality

7.1. The CoPS functionality allows the payment service user to obtain information about the beneficiary of the SEPA credit transfer or SEPA instant transfer.

7.2. Within the scope of the CoPS functionality, the participant where the payment account of the originator of the SEPA credit transfer or SEPA instant transfer is domiciled must submit, to the participant where the payment account of the beneficiary is domiciled, via the Bank of Portugal, the “payment account identifier” (the IBAN) to which the payment operation is destined, receiving in response:
a) The first holder’s name, in the case of accounts held by natural persons;

b) The corporate name and, if it exists, the trade name, in the case of legal entities.

7.3. The SICOI participant is obliged to use the CoPS functionality when the SEPA credit transfer or SEPA instant transfer is initiated individually, or when creating a recurring transfer order or a schedule, and the user is in direct interaction with the participant.

7.4. By derogation from number 7.3, in the case of accounts domiciled with the same participant:
a) held by different payment service users, the participant may, alternatively, opt to obtain beneficiary confirmation directly in their internal systems, based on an autonomous legal basis, notably at the level of compliance with legislation relating to data protection. b) held by the same payment service user, the participant is not obliged to use the CoPS functionality.

7.5. In compliance with number 7.3, the participant where the payment account of the originator is domiciled must present to the payment service user, at a moment prior to the initiation of the SEPA credit transfer or SEPA instant transfer, the name or corporate name and, if it exists, the trade name of the first holder of the destination payment account, which was transmitted to them, via the Bank of Portugal, by the payment service provider of the beneficiary.

7.6. In the event that technical issues temporarily prevent the availability of the CoPS functionality and, consequently, the possibility of presenting to the originator the name or corporate name and, if it exists, the trade name of the first holder of the destination payment account, the participant must inform the originator of this fact. The originator must still have the possibility to proceed with the payment operation.

Bulk Beneficiary/Payer Confirmation Functionality

8.1. The CoPB functionality allows the payment service user to confirm that SEPA credit transfers, SEPA instant transfers, or SEPA direct debits are made/to the intended beneficiaries’ or debtors’ payment accounts.

8.2. Within the scope of the CoPB functionality, the participant where the payment account of the originator of the SEPA credit transfers or SEPA instant transfers or the creditor of the SEPA direct debits is domiciled must submit, via the Bank of Portugal, to the participants where the payment accounts of the beneficiaries of these transfers or the debtors of these direct debits are domiciled, the “payment account identifiers” to which the payment operations are destined, accompanied by the NIF or NIPC of the beneficiaries, receiving in response, for each beneficiary/debtor, information on whether the NIF/NIPC belongs, or not, to one of the holders of the payment account.

8.3. The SICOI participant is obliged to make the CoPB functionality available when SEPA credit transfers, SEPA instant transfers, or SEPA direct debits are initiated by the payment service user in a bulk manner.

8.4. By derogation from number 8.3, in the case of accounts domiciled with the same participant:
a) held by different payment service users, the participant may, alternatively, opt to obtain beneficiary/debtor confirmation directly in their internal systems, based on an autonomous legal basis, notably at the level of compliance with legislation relating to data protection. b) held by the same payment service user, the participant is not obliged to use the CoPB functionality.

8.5. In compliance with number 8.3:
a) The participant where the payment account of the originator is domiciled must allow the originator, at a moment prior to the initiation of SEPA credit transfers or SEPA instant transfers, to use the service to confirm the ownership of the beneficiary’s accounts, according to the information transmitted to them by the

Lineage: No known changes

Similar documents from other regulators