Instruction No. 13/2021: Amendment to TARGET2-PT Regulation

Instruction No. 13/2021 Official Bulletin No. 10/2021 • 2021/10/15
..................................................................................................................................................................................................
Topics
Payment Systems :: Large-Value Payment System
Mod. 99999940/T – 01/14
Index
Instruction Text
Instruction Text
Subject: Amendment to Instruction No. 54/2012 - TARGET2-PT Regulation The regulatory framework for TARGET2-PT – the Portuguese component of the Eurosystem's Real-Time Gross Settlement System (SLBTR) – is set out in Instruction No. 54/2012, of January 15, 2013 – TARGET2-PT Regulation, published in compliance with European Central Bank Guideline ECB/2012/27, which reformulated Guideline ECB/2007/2, establishing TARGET2. Following the publication of ECB Guideline BCE/2021/30, of July 20, 2021, it becomes necessary to amend Instruction No. 54/2012, of January 15, 2013. This amendment primarily aims to: (i) introduce changes to TARGET Instant Payment Settlement (TIPS) accessibility measures; (ii) strengthen data protection rules; (iii) alter the accessibility of payment module (MP) account holders, indirect participants, and addressable BICs in TIPS; and (iv) introduce new security requirements and control procedures that enable Banco de Portugal to impose a sanctioning regime allowing for the determination of remedial measures in case of non-compliance with the said requirements and procedures. Thus, in the exercise of the competence attributed to it by Article 14 of its Organic Law, which confers upon it powers to regulate, supervise, and promote the proper functioning of payment systems, namely within the scope of its participation in the European System of Central Banks (SEBC), and in order to regulate the functioning of the national component system of TARGET2 – TARGET2-PT –, Banco de Portugal determines the following:

Point 2.2. of the Instruction Text shall read as follows:
«2.2. TARGET2-PT is a Real-Time Gross Settlement System (SLBTR) operated by the Bank and integrated into TARGET2, a system that enables the real-time gross settlement of payments in euros, carried out in central bank money, between payment module (MP) accounts, between T2S dedicated cash accounts (CND T2S) for securities operations, and between TIPS dedicated cash accounts (CND TIPS) for instant payments. TARGET2 is established and operates based on the Single Shared Platform (PUP), through which the transmission and processing of payment orders and the final receipt of payments are carried out in a technically identical manner. Regarding the technical functioning of T2S DCAs, TARGET2 is technically established and operates based on the T2S platform. Regarding the technical functioning of TIPS DCAs and TIPS ancillary system technical accounts (TIPS AS technical account), TARGET2 is technically established and operates based on the TIPS platform.»
Points 18.3., 18.4, 18.5 and 18.6 of the Instruction Text shall read as follows:
«18.3. The Bank also guarantees that the following provisions of Annex II shall apply to the said bilateral agreements, with the necessary adaptations:

Article 8(1) (technical and legal requirements);
Article 8(2) to (5) (application procedure), except that, instead of being required to comply with the access criteria set out in Article 4, the ancillary system must meet the access criteria contained in the definition of “ancillary system” in Article 1 of Annex II;
Operating hours set out in Appendix V;
Article 11 (conditions for cooperation and information exchange), with the exception of paragraph 8;
Articles 27 and 28 (contingency and business continuity procedures and security requirements), under which the fee used as the basis for calculating monetary sanctions for non-compliance with the security requirements set out in Article 28 of Annex II is the fee referred to in Article 18, point 1), subparagraph a), of Annex IV;
Article 31 (liability);
Article 32 (means of proof);
Articles 33 and 34 (duration, cancellation and suspension of participation), with the exception of Article 34(1)(b);
Article 35, if applicable (closure of MP accounts);
Article 38 (confidentiality);
Article 39 (Union requirements regarding data protection, prevention of money laundering and related matters);
Article 40 (communication requirements);
Article 41 (contractual relationship with the TARGET2 network service provider);
Article 44 (applicable law, competent forum and place of performance);
Article 45-A(1) (transitional clause).
18.4. Bilateral agreements with ancillary systems using the participant interface must comply with:
a) Annex II, with the exception of Title V and Appendices VI and VII; and b) Article 18 of Annex IV.
For the purposes of subparagraph a), the fee used as the basis for calculating monetary sanctions for non-compliance with the security requirements set out in Article 28 of Annex II is the fee referred to in Article 18, point 1), subparagraph a), of Annex IV.
18.5. Notwithstanding the provisions of point 18.4, bilateral agreements with ancillary systems that use the participant interface but only settle payments on behalf of their respective clients must comply with the provisions of:
a) Annex II, with the exception of Title V, Article 36 and Appendices VI and VII; and b) Article 18 of Annex IV.
For the purposes of subparagraph a), the fee used as the basis for calculating monetary sanctions for non-compliance with the security requirements set out in Article 28 of Annex II is the fee referred to in Article 18, point 1), subparagraph a), of Annex IV.
18.6. The Bank provides central bank money fund transfer services to ancillary systems that settle instant payments in their own accounting records, in accordance with the SEPA instant transfer scheme only on the TIPS platform. Bilateral agreements for the provision of such fund transfer services must comply with Annex IV-A and must only allow the settlement of instant payments in accordance with the SEPA instant transfer scheme. In the said bilateral agreements, the following provisions of Annex II-B shall apply, with the necessary adaptations:
a) Appendices I, II and III; b) Article 4 (general description of TARGET2); c) Article 5 (access criteria), under which the ancillary system must meet the access criteria set out in the definition of “ancillary system” in Article 1 of Annex II-B; d) Article 6(1) (technical and legal requirements), except that the ancillary system must announce its compliance with the SEPA instant transfer scheme instead of being required to adhere to this scheme by subscribing to the SEPA Instant Credit Transfer Adherence Agreement; e) Article 6(2) to (5) (application procedure), except that i) the ancillary system must comply with the access criteria included in the definition of “ancillary system” in Article 1 of Annex II-B, instead of the access criteria in Article 5, and that ii) the ancillary system must provide evidence of its announcement of compliance with the SEPA instant transfer scheme, instead of evidence of its adherence to the SEPA instant transfer scheme; f) Article 7 (access to the TIPS platform); g) Article 8 (reachable parties); h) Article 9 (network service provider); i) Article 11 (TIPS directory); Instruction No. 13/2021 Official Bulletin No. 10/2021 • 2021/10/15 Topics Payment Systems :: Large-Value Payment System
..................................................................................................................................................................................................
Mod. 99999940/T – 01/14 j) Article 11-A (MPL repository); k) Article 12 (obligations of NCs and account holders), with the exception of paragraph 4; l) Article 14 (requirements for cooperation and information exchange); m) Article 16 (types of payment orders); n) Article 17 (acceptance and rejection of payment orders); o) Article 16 (processing of payment orders); p) Article 19 (revocation request); q) Article 20 (time of introduction and irrevocability); r) Article 21 (security and business continuity requirements); s) Article 23 (liability regime); t) Article 24 (means of proof); u) Articles 25 and 26 (duration, cancellation and suspension of participation), with the exception of Article 26(1)(b) and (4), second paragraph; v) Article 27, if applicable (closure of accounts); w) Article 29 (confidentiality); x) Article 30 (Union requirements regarding data protection, prevention of money laundering and related matters); y) Article 31 (communication requirements); z) Article 34 (applicable law, competent forum and place of performance); aa) Article 35-A (transitional clause).»

A new point 28 is included in the Instruction Text:
«28. Transitional rule
Banco de Portugal may provide central bank money fund transfer services to ancillary systems that settle instant payments in their own accounting records, under the SEPA instant transfer scheme using the ancillary system interface until February 25, 2022.»
Point 29. of the Instruction Text shall read as follows:
«29. Annexes and Appendices
The following annexes and appendices are an integral part of this Instruction:
Annex I: TARGET2-PT Participation Agreement (draft)
Annex II: Harmonised Conditions for Opening and Operating an MP Account in TARGET2-PT
Appendix I: Technical specifications for processing payment orders
Appendix II: TARGET2 compensation scheme
Appendix III: Terms of reference for national legal opinions and opinions regarding legal capacity
Appendix IV: Contingency and business continuity procedures
Appendix V: Operating hours
Appendix VI: Pricing and invoicing table
Appendix VII: Aggregate Liquidity Agreement
Appendix VIII: Requirements for information security management and business continuity management
Annex II-A: Harmonised Conditions for Opening and Operating a Dedicated Cash Account in TARGET2
Appendix I: Dedicated cash account parameters – Technical specifications
Appendix II: TARGET2 compensation regime regarding the opening and operation of DCAs
Appendix III: Terms of reference for national legal opinions and opinions regarding legal capacity
Appendix IV: Contingency and business continuity procedures
Appendix V: Operating hours
Appendix VI: Pricing table
Annex II-B: Harmonised Conditions for Opening and Operating a TIPS Dedicated Cash Account (TIPS DCA) in TARGET2
Appendix I: TIPS DCA parameters – Technical specifications
Appendix II: Terms of reference for national legal opinions and opinions regarding legal capacity and country
Appendix III: Operating hours
Appendix IV: Applicable fees
Annex III: Granting of Intraday Credit
Appendix I: Framework Agreement for Opening Intraday Credit with Collateral of Financial Instruments, Present and Future Credit Balances in the Participant Institution's Account and Credit Rights in the Form of Bank Loans
Appendix II: Agreement between Banco de Portugal and …. (CCP) for activating a Temporary and Emergency Overnight Credit Facility (draft)
Annex III-A: Conditions for Self-Collateralisation Operations
Instruction No. 13/2021 Official Bulletin No. 10/2021 • 2021/10/15 Topics Payment Systems :: Large-Value Payment System
..................................................................................................................................................................................................
Mod. 99999940/T – 01/14
Annex IV: Settlement Procedures for Ancillary Systems
Annex IV-A: TIPS Service for ancillary systems settling instant payments
Annex V: Supplementary and Adapted Harmonised Conditions for Opening and Operating an MP account in TARGET2 Using Internet Access
Appendix I-A: Technical specifications for processing payment orders for internet access
Appendix II-A: Pricing and Invoicing for internet access.»
In Annex II, Article 1 is amended as follows:
i. Definitions (35) and (36) are deleted, with subsequent renumbering;
ii. Definitions (26), (48), (62), (65), (68) are added, with subsequent renumbering:
«(26) “TIPS ancillary system technical account/TIPS AS technical account”, the account held by an ancillary system or by an NC on behalf of an ancillary system in the NC's TARGET2 component system for use by the ancillary system for the purpose of settling instant payments in its own accounting records; (48) “European Payments Council's SEPA Instant Credit Transfer (SCT Inst) scheme/SCT Inst scheme”, the automatic open standard scheme that provides a set of interbank rules to be complied with by its participants, allowing payment service providers in SEPA to offer an automatic SEPA-wide instant transfer product; (62) “TIPS DCA to TIPS AS technical account liquidity transfer order”, the instruction to transfer a certain amount of funds from a TIPS DCA to a TIPS AS technical account, to finance the position of the TIPS DCA holder (or the position of another ancillary system participant) in the ancillary system's accounting records; (65) “TIPS AS technical account to TIPS DCA liquidity transfer order”, the instruction to transfer a certain amount of funds from a TIPS AS technical account to a TIPS DCA, to reduce the financing of the position of the TIPS DCA holder (or the position of another ancillary system participant) in the ancillary system's accounting records; (68) “Reachable party”: an entity: a) holding a BIC; b) designated as a reachable party by a TIPS DCA holder or an ancillary system; c) a correspondent, client or branch of a TIPS DCA holder or an ancillary system participant, or a correspondent, client or branch of an ancillary system participant; and d) that can be contacted via the TIPS platform and is able to submit or receive instant payment orders, either through the TIPS DCA holder or the ancillary system, or directly if authorized by the TIPS DCA holder or the ancillary system.
iii. Definition (41), subparagraph a), formerly definition (42), subparagraph a), shall read as follows:
«(41) “Group”:
a) The set of credit institutions included in the consolidated financial statements of a parent undertaking that is required to present consolidated financial statements by virtue of International Accounting Standard No. 27 (IAS 27) adopted in accordance with Commission Regulation (EC) No 1126/2008(), and which may consist either: i) of a parent undertaking and one or more subsidiaries; or ii) of two or more subsidiaries of a parent undertaking; or () Commission Regulation (EC) No 1126/2008 of 3 November 2008 adopting certain international accounting standards in accordance with Regulation (EC) No 1606/2002 of the European Parliament and of the Council (OJ L 320, 29.11.2008, p. 1).»
iv. Definitions (54) and (55) shall read as follows:
«(54) “Payment order”: a credit transfer order, a liquidity transfer order, a direct debit instruction, an MP account to T2S DCA liquidity transfer order, a T2S DCA to MP account liquidity transfer order, a T2S DCA to T2S DCA liquidity transfer order, an MP account to TIPS DCA liquidity transfer order, a TIPS DCA to MP account liquidity transfer order, a TIPS AS technical account to TIPS DCA liquidity transfer order, a TIPS DCA to TIPS AS technical account liquidity transfer order, an instant payment order or a positive response to a revocation request; (55) “Instant payment order”, in the context of the European Payments Council's SEPA instant transfer scheme, a payment instruction that can be executed at any time of day, on any day of the year, with instant or near-instant processing and notification to the payer and which includes i) TIPS DCA to TIPS DCA instant payment orders, ii) TIPS DCA to TIPS AS technical account instant payment orders, iii) TIPS AS technical account to TIPS DCA instant payment orders and iv) TIPS AS technical account to TIPS AS technical account instant payment orders;»
In Annex II, Article 3 is amended as follows:
i. Paragraph 2, subparagraph f-C shall read as follows:
«f-C) TIPS DCA to MP account liquidity transfer orders, and MP account to TIPS DCA liquidity transfer orders;»
ii. Paragraph 2 is supplemented by subparagraph f-D:
«f-D) TIPS DCA to TIPS AS technical account liquidity transfer orders and TIPS AS technical account to TIPS DCA liquidity transfer orders; and»
iii. Paragraph 3 shall read as follows:

Instruction No. 13/2021 BO No. 10/2021 • 2021/10/15 Topics Payment Systems :: Large Value Payment System
..................................................................................................................................................................................................
Mod. 99999940/T – 01/14

«3. TARGET2 allows for gross real-time settlement of euro payments, carried out in central bank money between MP, CND T2S and CND TIPS accounts. TARGET2 is established and operates based on the PUP, through which the transmission and processing of payment orders and the final receipt of payments are carried out in a technically identical manner. Regarding the technical operation of CND T2S, TARGET2 is technically established and operates based on the T2S platform. Regarding the technical operation of CND TIPS and SP TIPS technical accounts, TARGET2 is technically established and operates based on the TIPS platform.»

In Annex II, Article 5 shall be amended to read as follows:

«Article 5
Direct Participants
1. MP account holders in TARGET2-PT are direct participants and must comply with the requirements set out in Article 8, paragraphs 1 and 2. They must hold at least one MP account at the Banco de Portugal. MP account holders who have joined the SEPA Instant Credit Transfer mechanism by subscribing to the SEPA Instant Credit Transfer Adherence Agreement must be contactable at all times on the TIPS Platform, whether as a holder of a CND TIPS or as a contactable party through a holder of a CND TIPS.
2. MP account holders may designate addressable BIC holders, regardless of where they are established. MP account holders may only designate addressable BIC holders who have joined the SEPA Instant Credit Transfer mechanism by subscribing to the SEPA Instant Credit Transfer Adherence Agreement if such entities are contactable on the TIPS Platform, whether as a holder of a CND TIPS or as a contactable party through a holder of a CND TIPS.
3. MP account holders may designate entities as indirect participants in the MP, provided that the conditions set out in Article 6 are observed. MP account holders may only designate as indirect participants entities that have joined the SEPA Instant Credit Transfer mechanism by subscribing to the SEPA Instant Credit Transfer Adherence Agreement if such entities are contactable on the TIPS Platform, whether as a holder of a CND TIPS or as a contactable party through a holder of a CND TIPS.
4. Access for multiple recipients through branches may be provided as follows:
a) A credit institution within the meaning of Article 4(1)(a) or (b) of this Annex that has been admitted as an MP account holder may grant access to its MP account to one or more of its branches established in the Union or in the EEA in order to allow them to directly submit payment orders and/or receive payments, provided that the Banco de Portugal has been informed of this fact; b) Whenever a branch of a credit institution has been admitted as an MP account holder, the other branches of the legal entity and/or its head office, in both cases provided they are established in the Union or in the EEA, may access the MP account of that branch, provided that this has informed the Banco de Portugal of the fact.»

8. In Annex II, Article 12, paragraph 3 shall be amended to read as follows:

«3. MP accounts and their sub-accounts shall be remunerated at a rate of zero percent or at the deposit facility rate, whichever is lower, except if they are used for the holding of mandatory minimum reserves or excess reserves.
In the case of minimum reserves, the calculation and payment of remuneration for held minimum reserves shall be governed by the provisions of Council Regulation (EC) No 2531/98() and European Central Bank Regulation (EU) 2021/378 (ECB/2021/1)().
In the case of excess reserves, the calculation and payment of remuneration for held reserves shall be governed by the provisions of Decision (EU) 2019/1743 (ECB/2019/31)().
() Council Regulation (EC) No 2531/98 of 23 November 1998 concerning the application of minimum reserves by the European Central Bank (OJ L 318 of 27.11.1998, p. 1).
() European Central Bank Regulation (EU) 2021/378 of 22 January 2021 on the application of minimum reserve requirements (ECB/2021/1) (OJ L 73 of 3.3.2003, p. 1).
(). European Central Bank Decision (EU) 2019/1743 of 15 October 2019 on the remuneration of excess reserves and certain deposits (ECB/2019/31) (OJ L 267 of 21.10.2019, p. 12.)»

In Annex II, Article 28 shall be amended to read as follows:

«Article 28
Security requirements and control procedures

Participants must implement appropriate security measures to protect their systems against unauthorized access and use. Participants are solely responsible for the proper protection of the confidentiality, integrity and availability of their systems.
Participants must inform the Banco de Portugal of any security incidents occurring in their technical infrastructures and also, if applicable, in the technical infrastructures of third-party suppliers. The Banco de Portugal may request additional information about the incident and, if necessary, ask the participant to take appropriate measures to prevent the recurrence of such a situation.
The Banco de Portugal may impose additional security requirements on all participants and/or on participants considered of paramount importance by the Banco de Portugal, especially regarding cybersecurity or fraud prevention.
Participants must provide the Banco de Portugal with i) permanent access to their declaration of adherence to the security requirements of the terminal of the chosen network service provider, and ii) annually, the TARGET2 self-certification declaration as published in English on the website of the Banco de Portugal and on the website of the ECB.

4-A. The Banco de Portugal evaluates the participant's self-certification declaration(s) based on the level of compliance with each of the requirements established in the TARGET2 self-certification requirements. These requirements are listed in Appendix VIII, which, in addition to the appendices listed in Article 2(1), constitutes an integral part of these conditions. 4-B. The participant's level of compliance with the TARGET2 self-certification requirements must be classified as follows, in increasing order of severity: "full compliance"; "minor non-compliance"; or, "major non-compliance". The following criteria apply: "full compliance" is achieved whenever participants satisfy 100% of the requirements; "minor non-compliance" occurs whenever the participant satisfies less than 100% but at least 66% of the requirements and "major non-compliance" occurs whenever the participant satisfies less than 66% of the requirements. If a participant demonstrates that a certain requirement is not applicable to them, they shall be considered in compliance with the requirement in question for classification purposes. A participant who fails to achieve "full compliance" must submit an action plan demonstrating how they intend to achieve full compliance. The Banco de Portugal must inform the competent supervisory authorities about the participant's compliance status. 4-C. If the participant refuses permanent access to their declaration of adherence to the security requirements of the terminals of the chosen network service providers or fails to provide the TARGET2 self-certification, the participant's level of compliance shall be classified as "major non-compliance". 4-D. The Banco de Portugal must re-evaluate the compliance of participants annually. 4-E. The Banco de Portugal may impose the following remedial measures on participants whose level of compliance has been assessed as minor or major non-compliance, in increasing order of severity:
i) enhanced monitoring: the participant must submit a monthly report to the Banco de Portugal, signed by a senior manager, on the progress made in resolving the non-compliance. In addition, the participant incurs a monthly penalty for each affected account equivalent to its respective monthly fee, as established in point 1 of Appendix VI, excluding transaction fees. This remedial measure may be imposed if the participant receives a second consecutive minor non-compliance assessment or a major non-compliance assessment; ii) suspension: participation in TARGET2-PT may be suspended under the circumstances described in Article 34(2)(b) and (c) of this Annex. In derogation of Article 34 of this Annex, the participant must be notified of the suspension three months in advance. The participant incurs a monthly penalty for each suspended account equivalent to double its respective monthly fee, as established in point 1 of Appendix VI, excluding transaction fees. This remedial measure may be imposed if the participant receives a second consecutive major non-compliance assessment; iii) termination: participation in TARGET2-PT may be terminated under the circumstances described in Article 34(2)(b) and (c) of this Annex. In derogation of the provisions of Article 34 of this Annex, the participant must be notified of the termination three months in

advance. The participant incurs an additional penalty of 1,000 EUR for each closed account. This remedial measure may be imposed if the participant has not corrected the major non-compliance to the satisfaction of the Banco de Portugal after three months of suspension.
5. Participants who allow third-party access to their MP account, as provided for in Article 5, paragraphs 2, 3 and 4, must treat the risk arising from such access in accordance with the security requirements defined in paragraphs 1 to 4-E of this Article. The self-certification referred to in paragraph 4 must specify that the participant imposes the TARGET2 network service provider terminal security requirements on third parties with access to their MP account.»

In Annex II, Article 34, paragraph 8 shall be amended to read as follows:

«8. The obligations of the Banco de Portugal established in paragraphs 1 to 7 above are equally applicable in the event of suspension or cessation of use of the Peripheral System Interface/Ancillary System Interface (ASI) or the TIPS platform by peripheral systems.»

In Annex II, Article 39, paragraph 1 shall be amended to read as follows:

«1. Participants are presumed to have knowledge of, comply with and be able to demonstrate to the competent authorities compliance with all obligations incumbent upon them under data protection legislation. Participants are presumed to know and comply with all obligations imposed on them under legislation on anti-money laundering and counter-terrorist financing, nuclear non-proliferation and the development of nuclear weapon vectors, especially regarding the adoption of appropriate measures regarding any payments debited or credited to their MP accounts. Participants must ensure that they are informed about the data recovery policy of the network service provider before establishing a contractual relationship with them.»

Article 45-A is added to Annex II:

«Article 45-A
Transitional Provisions

As soon as the TARGET system is operational and TARGET2 has ceased operations, the balances of MP accounts shall be transferred to the corresponding successor accounts of the account holder in the TARGET system.
The requirement that MP account holders, indirect participants and addressable BIC holders who join the SEPA Instant Credit Transfer mechanism be contactable on the TIPS Platform in accordance with Article 5 applies from 25 February 2022.»

In Annex II, Appendix I, paragraph 8, point 4(b) shall be amended to read as follows:

«b) User-to-Application (U2A) mode
The U2A mode allows direct communication between a participant and the MIC. The information is displayed in a browser program installed on a PC system (SWIFT Alliance WebStation or another interface possibly required by SWIFT). For U2A access, the IT infrastructure must be capable of supporting cookies. The MIC user manual contains more detailed information.»

In Annex II, Appendix IV, paragraph 6, point (g) shall be amended to read as follows:

«g) Participants must provide eligible assets as collateral assets for the processing of payment order contingencies. During contingency processing, received contingency payments may be used to finance paid contingency payments. The Banco de Portugal may not take into account the available liquidity of participants for the purposes of contingency processing.»

Appendix VIII is added to Annex II:

«Appendix VIII
Requirements relating to information security management and business continuity management Information Security Management These requirements are applicable to each participant, unless the participant demonstrates that a certain requirement is not applicable to them. In defining the scope of these requirements within their own infrastructure, the participant must identify the elements that are part of the Payment Transaction Chain (PTC). More precisely, the payment transaction chain starts at a Point of Entry (PoE), i.e., a system that participates in the creation of operations (for example, a workstation, a counter or backoffice application, or a middleware application), and ends at the system responsible for sending the message to SWIFT (for example the SWIFT VPN box) or to the Internet (this latter applies in the case of Internet access). Requirement 1.1: Information Security Policy Management must define a clear policy direction, in line with business objectives, and demonstrate support and commitment to information security through the issuance, approval and maintenance of an information security policy intended to manage information security and cyber-resilience across the organization in terms of identification, assessment and treatment of information security and cyber-resilience risks. The policy must contain, at a minimum,

the following sections: objectives, scope (including domains such as organization, human resources, asset management, etc.), principles and assignment of responsibilities.
Requirement 1.2: Internal Organization
An information security regime is established to implement the information security policy within the organization. Management must coordinate and review the creation of the information security framework to ensure the implementation of the information security policy (in accordance with Requirement 1.1) across the organization, including the allocation of sufficient resources and the assignment of security responsibilities for this purpose. Requirement 1.3: External Parties The information security of the organization and its information processing facilities must not be compromised by the use of one or more external parties or products/services provided by them or by dependence on them or their products/services. Any access to the organization's information processing facilities by external parties must be controlled. Whenever external parties or external party products/services must have access to the organization's information processing facilities, a risk assessment must be carried out to determine the implications for security and control requirements. Controls must be agreed and defined in an agreement with each external party concerned. Requirement 1.4: Asset Management All information assets, operational processes and underlying information systems, such as operating systems, infrastructures, operational applications, standard products, services and user-developed applications, covered by the payment transaction chain must be accounted for and have a designated owner. Responsibility must be assigned for the maintenance and operation of appropriate controls over operational processes and their IT components with a view to protecting information assets. Note: the owner may, if necessary, delegate the implementation of specific controls, but remains responsible for the proper protection of assets. Requirement 1.5: Information Asset Classification Information assets must be classified according to their critical importance for the proper provision of service by the participant. The classification must indicate the need, priorities and degree of protection required in the processing of the information asset in the relevant operational processes and must also take into account the underlying IT components. A management-approved information asset classification system must be used to define a suitable set of protection controls throughout the entire lifecycle of information assets (including the removal and destruction of information assets) and to communicate the need for specific treatment measures. Requirement 1.6: Human Resources Security Security responsibilities must be defined before recruitment, through adequate job descriptions and employment conditions. All job candidates, contractors and third-party users must be subject to adequate control, especially with regard to sensitive positions. Employees, contractors and third-party users of information processing facilities must sign an agreement regarding their functions and security
responsibilities. An adequate level of awareness must be ensured for all workers, contractors and third-party users, and teaching and training in security procedures and the correct use of information processing facilities must be provided to minimize possible security risks. A formal disciplinary process must be instituted for the handling of security violations by workers. Responsibilities must be defined to ensure the management of the exit from the organization or the transfer within the same of an employee, contractor or third-party user, as well as the return of all equipment and the revocation of all access rights. Requirement 1.7: Physical and Environmental Security Critical or sensitive information processing facilities must be located in secure zones, protected by defined security perimeters, with adequate barriers and entry controls. They must be physically protected against unauthorized access and damage and interference. Access is exclusively granted to persons covered by Requirement 1.6. Procedures and standards are established to protect physical media containing information assets during their transport. Equipment is protected against physical and environmental threats. Equipment protection (including equipment used off-site) and protection against removal of goods is necessary to reduce the risk of unauthorized access to information and to protect against loss or damage to equipment or information. Special safeguard and protection measures against physical threats to support facilities, such as power supply and cabling infrastructure, may be necessary. Requirement 1.8: Operations Management Responsibilities and procedures must be established for the management and operation of information processing facilities covering all underlying systems of the payment transaction chain, from end to end. Regarding operational procedures, including the technical administration of IT systems, separation of duties must be implemented whenever necessary, in order to reduce the risk of intentional or negligent misuse of the system. In case separation of duties is not

1 The 'need-to-know' principle refers to the identification of the set of information a person needs to access to perform their duties.
2 The principle of least privilege refers to adapting the subject's access profile to the IT system to match the corresponding professional function.

3 In the context of this exercise, 'supplier' means any third party (and its personnel) who has entered into a contract (agreement) with the institution to provide a service and who has access, under the service agreement, remotely or on-site, to information and/or IT systems and/or information processing facilities of the institution covered by or associated with the scope of the TARGET2 self-certification exercise.

T2S DCA holders must:
a) Have entered into a contract with an NSP within the scope of the concession contract with that NSP, in order to establish a technical connection to TARGET2- PT; b) Connect through another entity that has entered into a contract with an NSP within the scope of the concession contract with that NSP.
The legal relationship between a T2S DCA holder and the NSP is governed exclusively by the terms and conditions of the separate contract entered into with an NSP, as referred to in paragraph 1, subparagraph a).
The services to be provided by the NSP are not part of the services to be performed by Banco de Portugal in relation to TARGET2.
Banco de Portugal is not responsible for any acts, errors or omissions of the NSP (including its directors, personnel and subcontractors), nor for any acts, errors or omissions of third parties selected by participants to access the NSP's network."

Instruction No. 13/2021 Official Gazette No. 10/2021 • 2021/10/15 Topics Payment Systems :: Large-Value Payment System
..................................................................................................................................................................................................
Mod. 99999940/T – 01/14
22. Article 34-A is added to Annex II-A:
«Article 34-A
Transitional provisions
As soon as the TARGET system is operational and TARGET2 has ceased its activity, T2S CND holders will become T2S CND holders in the TARGET system.»
23. In Annex II-A, Appendix I, number 7, point 1, subparagraph b) is amended as follows:
«b) User-to-application (U2A) mode
The U2A mode allows direct communication between a T2S CND holder and the T2S GUI module. Information is displayed in a browser program installed on a PC system. For U2A access, the IT infrastructure must be capable of supporting cookies. The T2S user manual contains more detailed information.»
24. In Annex II-B, the references to «TIPS network service provider» (in the singular or plural) in Article 17, number 1, subparagraph a), in Article 24, numbers 1 and 2, in Article 26, number 2, subparagraph d), in Article 29, number 6 are replaced by references to «NSP».
25. In Annex II-B, Article 1 is amended as follows:
i. The definitions of “Reachable party”, “Payment order”, and "Instant payment order" are amended as follows:
«- "Reachable party": an entity: a) holding a BIC; b) designated as a reachable party by a TIPS CND holder or an ancillary system; c) correspondent, client or branch of a TIPS CND holder or participant of an ancillary system, or correspondent, client or branch of the participant of an ancillary system; and d) that can be contacted via the TIPS platform and is able to submit or receive instant payment orders, either through the TIPS CND holder or the ancillary system, or directly if authorized by the TIPS CND holder or the ancillary system.» «- "Payment order": except when the term is used in Articles 16 to 18 of this annex, an instant payment order, a positive revocation response, a liquidity transfer order from an MP account to a TIPS CND, a liquidity transfer order from a TIPS CND to an MP account, a TIPS AS technical account to a TIPS CND liquidity transfer order or a TIPS CND to TIPS AS liquidity transfer order.» «- "Instant payment order": in the context of the European Payments Council's SEPA Instant Credit Transfer scheme, the payment instruction that can be executed at any time of the day, on any day of the year, with instant or near-instant processing and notification to the payer and which includes i) instant payment orders from TIPS CND to TIPS CND, ii) instant payment orders from TIPS CND to TIPS AS technical account, iii) instant payment orders from TIPS AS technical account to TIPS CND and iv) instant payment orders from TIPS AS technical account to TIPS AS technical account.»
ii. The following definitions are added:
«- “TIPS ancillary system technical account (TIPS AS technical account)”: the account held by an ancillary system or by the CB on behalf of an ancillary system in the CB's TARGET2 component system for use by that ancillary system for the purpose of settling instant payments in its own accounting records;

“TIPS CND to TIPS AS technical account liquidity transfer order”: the instruction to transfer a certain amount of funds from a TIPS CND to a TIPS AS technical account, to finance the position of the TIPS CND holder (or the position of another participant of the ancillary system) in the accounting records of the ancillary system;
“TIPS AS technical account to TIPS CND liquidity transfer order”: the instruction to transfer a certain amount of funds from a TIPS AS technical account to a TIPS CND, to reduce the financing of the position of the TIPS CND holder (or the position of another participant of the ancillary system) in the accounting records of the ancillary system;
“European Payments Council's SEPA Instant Credit Transfer (SCT Inst) scheme” or “SCT Inst scheme”: the automatic open standards scheme that provides a set of interbank rules to be complied with by its participants, which allows payment service providers in SEPA to offer an automatic euro instant credit transfer product at SEPA level;
“Mobile proxy look-up (MPL) service” or “MPL service”: a service that allows TIPS CND holders, ancillary systems using TIPS AS technical accounts and reachable parties, who receive from their clients a request to execute an instant payment order in favour of a beneficiary identified by a proxy (for example, a mobile phone number), to obtain from the central MPL repository the corresponding beneficiary IBAN and BIC to be used to credit the relevant account in TIPS;
“Network Service Provider (NSP)”: a company that has obtained a concession from the Eurosystem to provide connectivity services through the Eurosystem Single Market Infrastructure Gateway;
“IBAN”: the international bank account number that uniquely identifies an individual account at a specific financial institution in a given country.»
iii. The definition of “TIPS network service provider” is eliminated.

In Annex II-B, Article 3, number 1, the reference to “Appendix V: TIPS technical connectivity requirements” is eliminated.
In Annex II-B, Article 4 is amended as follows:
i. Subparagraph i-A is added to number 2:
«i-A) Liquidity transfer orders from TIPS CND to TIPS AS technical account and liquidity transfer orders from TIPS AS technical account to TIPS CND; and»;
ii. Number 3 is amended as follows:
«3. TARGET2 allows for the real-time gross settlement of euro payments, made in central bank money between MP accounts, T2S CNDs and TIPS CNDs. TARGET2 is established and operates based on the PUP, through which the transmission and processing of payment orders and the final receipt of payments are carried out in a technically identical manner. With regard to the technical operation of TIPS CNDs and TIPS AS technical accounts, TARGET2 is technically established and operates based on the TIPS platform. With regard to the technical operation of T2S CNDs, TARGET2 is technically established and operates based on the T2S platform.»
In Annex II-B, Article 6, number 1, subparagraph a), sub-subparagraph i) is amended as follows:
«a) Fulfill the following technical requirements:
i) install, manage, operate, control and ensure the security of the IT infrastructure necessary to connect to the TIPS platform and submit payment orders to it. Applicants for TIPS CND holders may involve third parties in this process, but the responsibility will be solely and exclusively theirs. In particular, unless resorting to a party responsible for instructing payment orders, applicants for TIPS CND holders must enter into a contract with one or more NSPs in order to obtain the necessary connection and permissions, in accordance with the technical specifications of Appendix I; and»

Instruction No. 13/2021 Official Gazette No. 10/2021 • 2021/10/15 Topics Payment Systems :: Large-Value Payment System
..................................................................................................................................................................................................
Mod. 99999940/T – 01/14
29. In Annex II-B, Article 9 is amended as follows:
«Article 9
Contractual relationship with an NSP
1. Participants must:
a) Enter into a contract with an NSP within the scope of the concession contract with that NSP, in order to establish a technical connection to TARGET2-PT; b) Establish a connection through another entity that has entered into a contract with an NSP within the scope of the concession contract with that NSP.
2. The legal relationship between a participant and the NSP is governed exclusively by the terms and conditions of their separate contract, as referred to in paragraph 1, subparagraph a).
3. The services to be provided by the NSP are not part of the services to be performed by Banco de Portugal in relation to TARGET2.
4. Banco de Portugal is not responsible for any acts, errors or omissions of the NSP (including its directors, staff and subcontractors), nor for any acts, errors or omissions of third parties selected by participants to access the NSP's network.»
30. In Annex II-B, Article 10 is eliminated.
31. In Annex II-B, Article 11-A is added:
«Article 11-A
MPL Repository
1. The central MPL repository contains the proxy — IBAN mapping table for the purposes of the MPL service.
2. Each proxy can only be linked to a single IBAN. An IBAN can be linked to one or more proxies.
3. Article 29 is applicable to the data contained in the MPL repository.»
32. In Annex II-B, Article 12, number 9 is eliminated.
33. In Annex II-B, Article 15, number 5 is amended as follows:
«5. TIPS CNDs will be remunerated at zero percent or at the deposit facility rate, whichever is lower, unless they are used for holding minimum reserves or excess reserves.
In the case of minimum reserves, the calculation and payment of remuneration for minimum reserves held will be governed by Council Regulation (EC) No 2531/98() and European Central Bank Regulation (EU) 2021/378 (ECB/2021/1)().
In the case of excess reserves, the calculation and payment of remuneration for reserves held will be governed by Decision (EU) 2019/1743 (ECB/2019/31) ().
() Council Regulation (EC) No 2531/98 of 23 November 1988 on the application of minimum reserves by the European Central Bank (OJ L 318 of 27.11.1998, p. 1).
() European Central Bank Regulation (EU) 2021/378 of 22 January 2021 on the application of minimum reserve requirements (ECB/2021/1) (OJ L 73 of 3.3.2003, p. 1).
() European Central Bank Decision (EU) 2019/1743 of 15 October 2019 on the remuneration of excess reserves and certain deposits (ECB/2019/31) (OJ L 267 of 21.10.2019, p. 12.).»
34. In Annex II-B, Article 16 is amended as follows:
«Article 16
Types of payment orders in TIPS CNDs
The following are considered payment orders for the purposes of the TIPS service:
a) Instant payment orders; b) Positive responses to revocation requests; c) Liquidity transfer orders from TIPS CND to MP account; d) Liquidity transfer orders from TIPS CND to TIPS AS technical account; and e) Liquidity transfer orders from TIPS AS technical account to TIPS CND.»
35. In Annex II-B, Article 18, number 6 is amended as follows:
«6. After the acceptance of a liquidity transfer order from TIPS CND to MP account, from TIPS CND to TIPS AS technical account, or from TIPS AS technical account to TIPS CND, as referred to in Article 17, TARGET2-PT will verify if sufficient funds are available in the originator's account. If sufficient funds are not available, the liquidity transfer order is rejected. If sufficient funds are available, the liquidity transfer order is immediately executed.»
36. In Annex II-B, Article 20, number 1, subparagraph b) is amended as follows:
«b) Liquidity transfer orders from TIPS CND to MP account, positive responses to revocation requests, and liquidity transfer orders from TIPS CND to TIPS AS technical account are considered entered into TARGET2-PT and irrevocable at the moment the respective TIPS CND is debited. Liquidity transfer orders from TIPS AS technical account to TIPS CND are considered entered into TARGET2-PT and irrevocable at the moment the respective TIPS AS technical account is debited.»

Definitions
For the purposes of this annex and in addition to the definitions contained in Article 1 of Annex II-B, the following terms mean:
1) “Ancillary system central bank (ASCB)”: the Eurosystem CB with which the relevant ancillary system settling instant payments in its own accounting records has a bilateral contract for the settlement of instant payments of the ancillary system;
2) “Underlying gross volume”, the number of instant payments settled in the ancillary system's own accounting records and activated by funds held in the TIPS AS technical account. It does not include instant payments from or to TIPS CNDs or other TIPS AS technical accounts;
3) “Instructing party”, an entity designated as such by an ancillary system and which is permitted to submit payment orders to the TIPS platform and/or receive payment orders from that platform, on behalf of that ancillary system or a reachable party thereof.
Entry of payment orders into the system and their irrevocability
The application of Article 20 of Annex II-B, regarding the moment of entry of instant payment orders, positive responses to revocation requests and liquidity transfer orders from TIPS CND to TIPS AS technical account and from TIPS AS technical account to TIPS CND into the relevant TARGET2 component system will not prejudice any rules of the ancillary systems that determine the moment of registration in the ancillary system and/or the irrevocability of transfer orders submitted to that ancillary system at a moment prior to the moment of registration of the payment order in question in the relevant TARGET2 component system.
Accounts supporting the settlement of instant payments in the ancillary systems' own accounting records
1) To support the settlement of instant payments related to ancillary systems in TIPS, a TIPS AS technical account is opened.

Instruction No. 13/2021: Amendment to TARGET2-PT Regulation

Lineage: In force

Similar documents from other regulators