Region

Jurisdiction

Regulator

2021-10-15

Added 2026-08-29

Instruction No. 13/2021: Amendment to TARGET2-PT Regulation

This instruction amends Instruction No. 54/2012, which governs TARGET2-PT, in response to ECB Guideline BCE/2021/30. The changes primarily introduce modifications to TARGET Instant Payment Settlement (TIPS) accessibility measures and strengthen data protection rules. It also alters accessibility for payment module account holders, indirect participants, and addressable BICs in TIPS, and establishes new security requirements and control procedures allowing Banco de Portugal to impose sanctions for non-compliance. A transitional provision permits Banco de Portugal to provide fund transfer services to ancillary systems settling instant payments via the ancillary system interface until February 25, 2022.

Portugal

Banco de Portugal

Instruction No. 13/2021 Official Bulletin No. 10/2021 • 2021/10/15 .................................................................................................................................................................................................. Topics Payment Systems :: Large-Value Payment System Mod. 99999940/T – 01/14 Index Instruction Text Instruction Text Subject: Amendment to Instruction No. 54/2012 - TARGET2-PT Regulation The regulatory framework for TARGET2-PT – the Portuguese component of the Eurosystem's Real-Time Gross Settlement System (SLBTR) – is set out in Instruction No. 54/2012, of January 15, 2013 – TARGET2-PT Regulation, published in compliance with European Central Bank Guideline ECB/2012/27, which reformulated Guideline ECB/2007/2, establishing TARGET2. Following the publication of ECB Guideline BCE/2021/30, of July 20, 2021, it becomes necessary to amend Instruction No. 54/2012, of January 15, 2013. This amendment primarily aims to: (i) introduce changes to TARGET Instant Payment Settlement (TIPS) accessibility measures; (ii) strengthen data protection rules; (iii) alter the accessibility of payment module (MP) account holders, indirect participants, and addressable BICs in TIPS; and (iv) introduce new security requirements and control procedures that enable Banco de Portugal to impose a sanctioning regime allowing for the determination of remedial measures in case of non-compliance with the said requirements and procedures. Thus, in the exercise of the competence attributed to it by Article 14 of its Organic Law, which confers upon it powers to regulate, supervise, and promote the proper functioning of payment systems, namely within the scope of its participation in the European System of Central Banks (SEBC), and in order to regulate the functioning of the national component system of TARGET2 – TARGET2-PT –, Banco de Portugal determines the following:

Point 2.2. of the Instruction Text shall read as follows: «2.2. TARGET2-PT is a Real-Time Gross Settlement System (SLBTR) operated by the Bank and integrated into TARGET2, a system that enables the real-time gross settlement of payments in euros, carried out in central bank money, between payment module (MP) accounts, between T2S dedicated cash accounts (CND T2S) for securities operations, and between TIPS dedicated cash accounts (CND TIPS) for instant payments. TARGET2 is established and operates based on the Single Shared Platform (PUP), through which the transmission and processing of payment orders and the final receipt of payments are carried out in a technically identical manner. Regarding the technical functioning of T2S DCAs, TARGET2 is technically established and operates based on the T2S platform. Regarding the technical functioning of TIPS DCAs and TIPS ancillary system technical accounts (TIPS AS technical account), TARGET2 is technically established and operates based on the TIPS platform.»
Points 18.3., 18.4, 18.5 and 18.6 of the Instruction Text shall read as follows: «18.3. The Bank also guarantees that the following provisions of Annex II shall apply to the said bilateral agreements, with the necessary adaptations: • Article 8(1) (technical and legal requirements); • Article 8(2) to (5) (application procedure), except that, instead of being required to comply with the access criteria set out in Article 4, the ancillary system must meet the access criteria contained in the definition of “ancillary system” in Article 1 of Annex II; • Operating hours set out in Appendix V; • Article 11 (conditions for cooperation and information exchange), with the exception of paragraph 8; • Articles 27 and 28 (contingency and business continuity procedures and security requirements), under which the fee used as the basis for calculating monetary sanctions for non-compliance with the security requirements set out in Article 28 of Annex II is the fee referred to in Article 18, point 1), subparagraph a), of Annex IV; • Article 31 (liability); • Article 32 (means of proof); • Articles 33 and 34 (duration, cancellation and suspension of participation), with the exception of Article 34(1)(b); • Article 35, if applicable (closure of MP accounts); • Article 38 (confidentiality); • Article 39 (Union requirements regarding data protection, prevention of money laundering and related matters); • Article 40 (communication requirements); • Article 41 (contractual relationship with the TARGET2 network service provider); • Article 44 (applicable law, competent forum and place of performance); • Article 45-A(1) (transitional clause). 18.4. Bilateral agreements with ancillary systems using the participant interface must comply with: a) Annex II, with the exception of Title V and Appendices VI and VII; and b) Article 18 of Annex IV. For the purposes of subparagraph a), the fee used as the basis for calculating monetary sanctions for non-compliance with the security requirements set out in Article 28 of Annex II is the fee referred to in Article 18, point 1), subparagraph a), of Annex IV. 18.5. Notwithstanding the provisions of point 18.4, bilateral agreements with ancillary systems that use the participant interface but only settle payments on behalf of their respective clients must comply with the provisions of: a) Annex II, with the exception of Title V, Article 36 and Appendices VI and VII; and b) Article 18 of Annex IV. For the purposes of subparagraph a), the fee used as the basis for calculating monetary sanctions for non-compliance with the security requirements set out in Article 28 of Annex II is the fee referred to in Article 18, point 1), subparagraph a), of Annex IV. 18.6. The Bank provides central bank money fund transfer services to ancillary systems that settle instant payments in their own accounting records, in accordance with the SEPA instant transfer scheme only on the TIPS platform. Bilateral agreements for the provision of such fund transfer services must comply with Annex IV-A and must only allow the settlement of instant payments in accordance with the SEPA instant transfer scheme. In the said bilateral agreements, the following provisions of Annex II-B shall apply, with the necessary adaptations: a) Appendices I, II and III; b) Article 4 (general description of TARGET2); c) Article 5 (access criteria), under which the ancillary system must meet the access criteria set out in the definition of “ancillary system” in Article 1 of Annex II-B; d) Article 6(1) (technical and legal requirements), except that the ancillary system must announce its compliance with the SEPA instant transfer scheme instead of being required to adhere to this scheme by subscribing to the SEPA Instant Credit Transfer Adherence Agreement; e) Article 6(2) to (5) (application procedure), except that i) the ancillary system must comply with the access criteria included in the definition of “ancillary system” in Article 1 of Annex II-B, instead of the access criteria in Article 5, and that ii) the ancillary system must provide evidence of its announcement of compliance with the SEPA instant transfer scheme, instead of evidence of its adherence to the SEPA instant transfer scheme; f) Article 7 (access to the TIPS platform); g) Article 8 (reachable parties); h) Article 9 (network service provider); i) Article 11 (TIPS directory); Instruction No. 13/2021 Official Bulletin No. 10/2021 • 2021/10/15 Topics Payment Systems :: Large-Value Payment System .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 j) Article 11-A (MPL repository); k) Article 12 (obligations of NCs and account holders), with the exception of paragraph 4; l) Article 14 (requirements for cooperation and information exchange); m) Article 16 (types of payment orders); n) Article 17 (acceptance and rejection of payment orders); o) Article 16 (processing of payment orders); p) Article 19 (revocation request); q) Article 20 (time of introduction and irrevocability); r) Article 21 (security and business continuity requirements); s) Article 23 (liability regime); t) Article 24 (means of proof); u) Articles 25 and 26 (duration, cancellation and suspension of participation), with the exception of Article 26(1)(b) and (4), second paragraph; v) Article 27, if applicable (closure of accounts); w) Article 29 (confidentiality); x) Article 30 (Union requirements regarding data protection, prevention of money laundering and related matters); y) Article 31 (communication requirements); z) Article 34 (applicable law, competent forum and place of performance); aa) Article 35-A (transitional clause).»
A new point 28 is included in the Instruction Text: «28. Transitional rule Banco de Portugal may provide central bank money fund transfer services to ancillary systems that settle instant payments in their own accounting records, under the SEPA instant transfer scheme using the ancillary system interface until February 25, 2022.»
Point 29. of the Instruction Text shall read as follows: «29. Annexes and Appendices The following annexes and appendices are an integral part of this Instruction: Annex I: TARGET2-PT Participation Agreement (draft) Annex II: Harmonised Conditions for Opening and Operating an MP Account in TARGET2-PT Appendix I: Technical specifications for processing payment orders Appendix II: TARGET2 compensation scheme Appendix III: Terms of reference for national legal opinions and opinions regarding legal capacity Appendix IV: Contingency and business continuity procedures Appendix V: Operating hours Appendix VI: Pricing and invoicing table Appendix VII: Aggregate Liquidity Agreement Appendix VIII: Requirements for information security management and business continuity management Annex II-A: Harmonised Conditions for Opening and Operating a Dedicated Cash Account in TARGET2 Appendix I: Dedicated cash account parameters – Technical specifications Appendix II: TARGET2 compensation regime regarding the opening and operation of DCAs Appendix III: Terms of reference for national legal opinions and opinions regarding legal capacity Appendix IV: Contingency and business continuity procedures Appendix V: Operating hours Appendix VI: Pricing table Annex II-B: Harmonised Conditions for Opening and Operating a TIPS Dedicated Cash Account (TIPS DCA) in TARGET2 Appendix I: TIPS DCA parameters – Technical specifications Appendix II: Terms of reference for national legal opinions and opinions regarding legal capacity and country Appendix III: Operating hours Appendix IV: Applicable fees Annex III: Granting of Intraday Credit Appendix I: Framework Agreement for Opening Intraday Credit with Collateral of Financial Instruments, Present and Future Credit Balances in the Participant Institution's Account and Credit Rights in the Form of Bank Loans Appendix II: Agreement between Banco de Portugal and …. (CCP) for activating a Temporary and Emergency Overnight Credit Facility (draft) Annex III-A: Conditions for Self-Collateralisation Operations Instruction No. 13/2021 Official Bulletin No. 10/2021 • 2021/10/15 Topics Payment Systems :: Large-Value Payment System .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 Annex IV: Settlement Procedures for Ancillary Systems Annex IV-A: TIPS Service for ancillary systems settling instant payments Annex V: Supplementary and Adapted Harmonised Conditions for Opening and Operating an MP account in TARGET2 Using Internet Access Appendix I-A: Technical specifications for processing payment orders for internet access Appendix II-A: Pricing and Invoicing for internet access.»
In Annex II, Article 1 is amended as follows: i. Definitions (35) and (36) are deleted, with subsequent renumbering; ii. Definitions (26), (48), (62), (65), (68) are added, with subsequent renumbering: «(26) “TIPS ancillary system technical account/TIPS AS technical account”, the account held by an ancillary system or by an NC on behalf of an ancillary system in the NC's TARGET2 component system for use by the ancillary system for the purpose of settling instant payments in its own accounting records; (48) “European Payments Council's SEPA Instant Credit Transfer (SCT Inst) scheme/SCT Inst scheme”, the automatic open standard scheme that provides a set of interbank rules to be complied with by its participants, allowing payment service providers in SEPA to offer an automatic SEPA-wide instant transfer product; (62) “TIPS DCA to TIPS AS technical account liquidity transfer order”, the instruction to transfer a certain amount of funds from a TIPS DCA to a TIPS AS technical account, to finance the position of the TIPS DCA holder (or the position of another ancillary system participant) in the ancillary system's accounting records; (65) “TIPS AS technical account to TIPS DCA liquidity transfer order”, the instruction to transfer a certain amount of funds from a TIPS AS technical account to a TIPS DCA, to reduce the financing of the position of the TIPS DCA holder (or the position of another ancillary system participant) in the ancillary system's accounting records; (68) “Reachable party”: an entity: a) holding a BIC; b) designated as a reachable party by a TIPS DCA holder or an ancillary system; c) a correspondent, client or branch of a TIPS DCA holder or an ancillary system participant, or a correspondent, client or branch of an ancillary system participant; and d) that can be contacted via the TIPS platform and is able to submit or receive instant payment orders, either through the TIPS DCA holder or the ancillary system, or directly if authorized by the TIPS DCA holder or the ancillary system. iii. Definition (41), subparagraph a), formerly definition (42), subparagraph a), shall read as follows: «(41) “Group”: a) The set of credit institutions included in the consolidated financial statements of a parent undertaking that is required to present consolidated financial statements by virtue of International Accounting Standard No. 27 (IAS 27) adopted in accordance with Commission Regulation (EC) No 1126/2008(), and which may consist either: i) of a parent undertaking and one or more subsidiaries; or ii) of two or more subsidiaries of a parent undertaking; or () Commission Regulation (EC) No 1126/2008 of 3 November 2008 adopting certain international accounting standards in accordance with Regulation (EC) No 1606/2002 of the European Parliament and of the Council (OJ L 320, 29.11.2008, p. 1).» iv. Definitions (54) and (55) shall read as follows: «(54) “Payment order”: a credit transfer order, a liquidity transfer order, a direct debit instruction, an MP account to T2S DCA liquidity transfer order, a T2S DCA to MP account liquidity transfer order, a T2S DCA to T2S DCA liquidity transfer order, an MP account to TIPS DCA liquidity transfer order, a TIPS DCA to MP account liquidity transfer order, a TIPS AS technical account to TIPS DCA liquidity transfer order, a TIPS DCA to TIPS AS technical account liquidity transfer order, an instant payment order or a positive response to a revocation request; (55) “Instant payment order”, in the context of the European Payments Council's SEPA instant transfer scheme, a payment instruction that can be executed at any time of day, on any day of the year, with instant or near-instant processing and notification to the payer and which includes i) TIPS DCA to TIPS DCA instant payment orders, ii) TIPS DCA to TIPS AS technical account instant payment orders, iii) TIPS AS technical account to TIPS DCA instant payment orders and iv) TIPS AS technical account to TIPS AS technical account instant payment orders;»
In Annex II, Article 3 is amended as follows: i. Paragraph 2, subparagraph f-C shall read as follows: «f-C) TIPS DCA to MP account liquidity transfer orders, and MP account to TIPS DCA liquidity transfer orders;» ii. Paragraph 2 is supplemented by subparagraph f-D: «f-D) TIPS DCA to TIPS AS technical account liquidity transfer orders and TIPS AS technical account to TIPS DCA liquidity transfer orders; and» iii. Paragraph 3 shall read as follows:

Instruction No. 13/2021 BO No. 10/2021 • 2021/10/15 Topics Payment Systems :: Large Value Payment System .................................................................................................................................................................................................. Mod. 99999940/T – 01/14

«3. TARGET2 allows for gross real-time settlement of euro payments, carried out in central bank money between MP, CND T2S and CND TIPS accounts. TARGET2 is established and operates based on the PUP, through which the transmission and processing of payment orders and the final receipt of payments are carried out in a technically identical manner. Regarding the technical operation of CND T2S, TARGET2 is technically established and operates based on the T2S platform. Regarding the technical operation of CND TIPS and SP TIPS technical accounts, TARGET2 is technically established and operates based on the TIPS platform.»

In Annex II, Article 5 shall be amended to read as follows:

«Article 5 Direct Participants

MP account holders in TARGET2-PT are direct participants and must comply with the requirements set out in Article 8, paragraphs 1 and 2. They must hold at least one MP account at the Banco de Portugal. MP account holders who have joined the SEPA Instant Credit Transfer mechanism by subscribing to the SEPA Instant Credit Transfer Adherence Agreement must be contactable at all times on the TIPS Platform, whether as a holder of a CND TIPS or as a contactable party through a holder of a CND TIPS.
MP account holders may designate addressable BIC holders, regardless of where they are established. MP account holders may only designate addressable BIC holders who have joined the SEPA Instant Credit Transfer mechanism by subscribing to the SEPA Instant Credit Transfer Adherence Agreement if such entities are contactable on the TIPS Platform, whether as a holder of a CND TIPS or as a contactable party through a holder of a CND TIPS.
MP account holders may designate entities as indirect participants in the MP, provided that the conditions set out in Article 6 are observed. MP account holders may only designate as indirect participants entities that have joined the SEPA Instant Credit Transfer mechanism by subscribing to the SEPA Instant Credit Transfer Adherence Agreement if such entities are contactable on the TIPS Platform, whether as a holder of a CND TIPS or as a contactable party through a holder of a CND TIPS.
Access for multiple recipients through branches may be provided as follows: a) A credit institution within the meaning of Article 4(1)(a) or (b) of this Annex that has been admitted as an MP account holder may grant access to its MP account to one or more of its branches established in the Union or in the EEA in order to allow them to directly submit payment orders and/or receive payments, provided that the Banco de Portugal has been informed of this fact; b) Whenever a branch of a credit institution has been admitted as an MP account holder, the other branches of the legal entity and/or its head office, in both cases provided they are established in the Union or in the EEA, may access the MP account of that branch, provided that this has informed the Banco de Portugal of the fact.»
In Annex II, Article 12, paragraph 3 shall be amended to read as follows:

«3. MP accounts and their sub-accounts shall be remunerated at a rate of zero percent or at the deposit facility rate, whichever is lower, except if they are used for the holding of mandatory minimum reserves or excess reserves. In the case of minimum reserves, the calculation and payment of remuneration for held minimum reserves shall be governed by the provisions of Council Regulation (EC) No 2531/98() and European Central Bank Regulation (EU) 2021/378 (ECB/2021/1)(). In the case of excess reserves, the calculation and payment of remuneration for held reserves shall be governed by the provisions of Decision (EU) 2019/1743 (ECB/2019/31)(). () Council Regulation (EC) No 2531/98 of 23 November 1998 concerning the application of minimum reserves by the European Central Bank (OJ L 318 of 27.11.1998, p. 1). () European Central Bank Regulation (EU) 2021/378 of 22 January 2021 on the application of minimum reserve requirements (ECB/2021/1) (OJ L 73 of 3.3.2003, p. 1). (). European Central Bank Decision (EU) 2019/1743 of 15 October 2019 on the remuneration of excess reserves and certain deposits (ECB/2019/31) (OJ L 267 of 21.10.2019, p. 12.)»

In Annex II, Article 28 shall be amended to read as follows:

«Article 28 Security requirements and control procedures

Participants must implement appropriate security measures to protect their systems against unauthorized access and use. Participants are solely responsible for the proper protection of the confidentiality, integrity and availability of their systems.
Participants must inform the Banco de Portugal of any security incidents occurring in their technical infrastructures and also, if applicable, in the technical infrastructures of third-party suppliers. The Banco de Portugal may request additional information about the incident and, if necessary, ask the participant to take appropriate measures to prevent the recurrence of such a situation.
The Banco de Portugal may impose additional security requirements on all participants and/or on participants considered of paramount importance by the Banco de Portugal, especially regarding cybersecurity or fraud prevention.
Participants must provide the Banco de Portugal with i) permanent access to their declaration of adherence to the security requirements of the terminal of the chosen network service provider, and ii) annually, the TARGET2 self-certification declaration as published in English on the website of the Banco de Portugal and on the website of the ECB.

4-A. The Banco de Portugal evaluates the participant's self-certification declaration(s) based on the level of compliance with each of the requirements established in the TARGET2 self-certification requirements. These requirements are listed in Appendix VIII, which, in addition to the appendices listed in Article 2(1), constitutes an integral part of these conditions. 4-B. The participant's level of compliance with the TARGET2 self-certification requirements must be classified as follows, in increasing order of severity: "full compliance"; "minor non-compliance"; or, "major non-compliance". The following criteria apply: "full compliance" is achieved whenever participants satisfy 100% of the requirements; "minor non-compliance" occurs whenever the participant satisfies less than 100% but at least 66% of the requirements and "major non-compliance" occurs whenever the participant satisfies less than 66% of the requirements. If a participant demonstrates that a certain requirement is not applicable to them, they shall be considered in compliance with the requirement in question for classification purposes. A participant who fails to achieve "full compliance" must submit an action plan demonstrating how they intend to achieve full compliance. The Banco de Portugal must inform the competent supervisory authorities about the participant's compliance status. 4-C. If the participant refuses permanent access to their declaration of adherence to the security requirements of the terminals of the chosen network service providers or fails to provide the TARGET2 self-certification, the participant's level of compliance shall be classified as "major non-compliance". 4-D. The Banco de Portugal must re-evaluate the compliance of participants annually. 4-E. The Banco de Portugal may impose the following remedial measures on participants whose level of compliance has been assessed as minor or major non-compliance, in increasing order of severity: i) enhanced monitoring: the participant must submit a monthly report to the Banco de Portugal, signed by a senior manager, on the progress made in resolving the non-compliance. In addition, the participant incurs a monthly penalty for each affected account equivalent to its respective monthly fee, as established in point 1 of Appendix VI, excluding transaction fees. This remedial measure may be imposed if the participant receives a second consecutive minor non-compliance assessment or a major non-compliance assessment; ii) suspension: participation in TARGET2-PT may be suspended under the circumstances described in Article 34(2)(b) and (c) of this Annex. In derogation of Article 34 of this Annex, the participant must be notified of the suspension three months in advance. The participant incurs a monthly penalty for each suspended account equivalent to double its respective monthly fee, as established in point 1 of Appendix VI, excluding transaction fees. This remedial measure may be imposed if the participant receives a second consecutive major non-compliance assessment; iii) termination: participation in TARGET2-PT may be terminated under the circumstances described in Article 34(2)(b) and (c) of this Annex. In derogation of the provisions of Article 34 of this Annex, the participant must be notified of the termination three months in

advance. The participant incurs an additional penalty of 1,000 EUR for each closed account. This remedial measure may be imposed if the participant has not corrected the major non-compliance to the satisfaction of the Banco de Portugal after three months of suspension. 5. Participants who allow third-party access to their MP account, as provided for in Article 5, paragraphs 2, 3 and 4, must treat the risk arising from such access in accordance with the security requirements defined in paragraphs 1 to 4-E of this Article. The self-certification referred to in paragraph 4 must specify that the participant imposes the TARGET2 network service provider terminal security requirements on third parties with access to their MP account.»

In Annex II, Article 34, paragraph 8 shall be amended to read as follows:

«8. The obligations of the Banco de Portugal established in paragraphs 1 to 7 above are equally applicable in the event of suspension or cessation of use of the Peripheral System Interface/Ancillary System Interface (ASI) or the TIPS platform by peripheral systems.»

In Annex II, Article 39, paragraph 1 shall be amended to read as follows:

«1. Participants are presumed to have knowledge of, comply with and be able to demonstrate to the competent authorities compliance with all obligations incumbent upon them under data protection legislation. Participants are presumed to know and comply with all obligations imposed on them under legislation on anti-money laundering and counter-terrorist financing, nuclear non-proliferation and the development of nuclear weapon vectors, especially regarding the adoption of appropriate measures regarding any payments debited or credited to their MP accounts. Participants must ensure that they are informed about the data recovery policy of the network service provider before establishing a contractual relationship with them.»

Article 45-A is added to Annex II:

«Article 45-A Transitional Provisions

As soon as the TARGET system is operational and TARGET2 has ceased operations, the balances of MP accounts shall be transferred to the corresponding successor accounts of the account holder in the TARGET system.
The requirement that MP account holders, indirect participants and addressable BIC holders who join the SEPA Instant Credit Transfer mechanism be contactable on the TIPS Platform in accordance with Article 5 applies from 25 February 2022.»

In Annex II, Appendix I, paragraph 8, point 4(b) shall be amended to read as follows:

«b) User-to-Application (U2A) mode The U2A mode allows direct communication between a participant and the MIC. The information is displayed in a browser program installed on a PC system (SWIFT Alliance WebStation or another interface possibly required by SWIFT). For U2A access, the IT infrastructure must be capable of supporting cookies. The MIC user manual contains more detailed information.»

In Annex II, Appendix IV, paragraph 6, point (g) shall be amended to read as follows:

«g) Participants must provide eligible assets as collateral assets for the processing of payment order contingencies. During contingency processing, received contingency payments may be used to finance paid contingency payments. The Banco de Portugal may not take into account the available liquidity of participants for the purposes of contingency processing.»

Appendix VIII is added to Annex II:

«Appendix VIII Requirements relating to information security management and business continuity management Information Security Management These requirements are applicable to each participant, unless the participant demonstrates that a certain requirement is not applicable to them. In defining the scope of these requirements within their own infrastructure, the participant must identify the elements that are part of the Payment Transaction Chain (PTC). More precisely, the payment transaction chain starts at a Point of Entry (PoE), i.e., a system that participates in the creation of operations (for example, a workstation, a counter or backoffice application, or a middleware application), and ends at the system responsible for sending the message to SWIFT (for example the SWIFT VPN box) or to the Internet (this latter applies in the case of Internet access). Requirement 1.1: Information Security Policy Management must define a clear policy direction, in line with business objectives, and demonstrate support and commitment to information security through the issuance, approval and maintenance of an information security policy intended to manage information security and cyber-resilience across the organization in terms of identification, assessment and treatment of information security and cyber-resilience risks. The policy must contain, at a minimum,

the following sections: objectives, scope (including domains such as organization, human resources, asset management, etc.), principles and assignment of responsibilities. Requirement 1.2: Internal Organization An information security regime is established to implement the information security policy within the organization. Management must coordinate and review the creation of the information security framework to ensure the implementation of the information security policy (in accordance with Requirement 1.1) across the organization, including the allocation of sufficient resources and the assignment of security responsibilities for this purpose. Requirement 1.3: External Parties The information security of the organization and its information processing facilities must not be compromised by the use of one or more external parties or products/services provided by them or by dependence on them or their products/services. Any access to the organization's information processing facilities by external parties must be controlled. Whenever external parties or external party products/services must have access to the organization's information processing facilities, a risk assessment must be carried out to determine the implications for security and control requirements. Controls must be agreed and defined in an agreement with each external party concerned. Requirement 1.4: Asset Management All information assets, operational processes and underlying information systems, such as operating systems, infrastructures, operational applications, standard products, services and user-developed applications, covered by the payment transaction chain must be accounted for and have a designated owner. Responsibility must be assigned for the maintenance and operation of appropriate controls over operational processes and their IT components with a view to protecting information assets. Note: the owner may, if necessary, delegate the implementation of specific controls, but remains responsible for the proper protection of assets. Requirement 1.5: Information Asset Classification Information assets must be classified according to their critical importance for the proper provision of service by the participant. The classification must indicate the need, priorities and degree of protection required in the processing of the information asset in the relevant operational processes and must also take into account the underlying IT components. A management-approved information asset classification system must be used to define a suitable set of protection controls throughout the entire lifecycle of information assets (including the removal and destruction of information assets) and to communicate the need for specific treatment measures. Requirement 1.6: Human Resources Security Security responsibilities must be defined before recruitment, through adequate job descriptions and employment conditions. All job candidates, contractors and third-party users must be subject to adequate control, especially with regard to sensitive positions. Employees, contractors and third-party users of information processing facilities must sign an agreement regarding their functions and security responsibilities. An adequate level of awareness must be ensured for all workers, contractors and third-party users, and teaching and training in security procedures and the correct use of information processing facilities must be provided to minimize possible security risks. A formal disciplinary process must be instituted for the handling of security violations by workers. Responsibilities must be defined to ensure the management of the exit from the organization or the transfer within the same of an employee, contractor or third-party user, as well as the return of all equipment and the revocation of all access rights. Requirement 1.7: Physical and Environmental Security Critical or sensitive information processing facilities must be located in secure zones, protected by defined security perimeters, with adequate barriers and entry controls. They must be physically protected against unauthorized access and damage and interference. Access is exclusively granted to persons covered by Requirement 1.6. Procedures and standards are established to protect physical media containing information assets during their transport. Equipment is protected against physical and environmental threats. Equipment protection (including equipment used off-site) and protection against removal of goods is necessary to reduce the risk of unauthorized access to information and to protect against loss or damage to equipment or information. Special safeguard and protection measures against physical threats to support facilities, such as power supply and cabling infrastructure, may be necessary. Requirement 1.8: Operations Management Responsibilities and procedures must be established for the management and operation of information processing facilities covering all underlying systems of the payment transaction chain, from end to end. Regarding operational procedures, including the technical administration of IT systems, separation of duties must be implemented whenever necessary, in order to reduce the risk of intentional or negligent misuse of the system. In case separation of duties is not

Instruction No. 13/2021 Official Gazette No. 10/2021 • 2021/10/15 Topics Payment Systems :: Large-Value Payment System .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 can be implemented for documented objective reasons, compensatory controls must be introduced following a formal risk analysis. Controls must be established to prevent and detect the introduction of malicious code into payment transaction chain systems. Controls (including user awareness) must also be established to prevent, detect, and remove malicious code. Only mobile code from trusted sources (e.g., signed Microsoft COM components and Java Applets) should be used. Browser configuration (e.g., the use of extensions and plug-ins) must be strictly controlled. Management must implement data backup and recovery policies; such data recovery policies must include a restoration process plan that must be tested at least annually. Systems critical to payment security must be monitored, and relevant information security events must be logged. Operator logs must be used to ensure the identification of IT system problems. Operator logs must be regularly examined by sampling, taking into account the critical importance of operations. System monitoring must be used to verify the effectiveness of controls identified as critical to payment security and to verify compliance with an access policy model. Information exchanges between organizations must be based on a formal exchange policy, executed in accordance with exchange agreements entered into between the parties involved, and comply with all relevant legislation. Third-party software components used in information exchange with TARGET2 (such as software received from a service bureau in scenario 2 of the section on the scope of the TARGET2 self-certification agreement document) must be used under a formal agreement with the third party. Requirement 1.9: Access control Access to information assets must be justified based on operational needs (need-to-know 1) and in accordance with the established corporate policy framework (including the information security policy). Clear access control rules must be defined based on the principle of least privilege 2, in order to faithfully reflect the needs of the corresponding operational and IT processes. Where applicable (e.g., in relation to backup management), logical access control must be consistent with physical access control, unless adequate compensatory controls exist (e.g., encryption and anonymization of personal data). Formal and documented procedures must exist to control the assignment of access rights to IT systems and services covered by the scope of the payment transaction chain.

1 The 'need-to-know' principle refers to the identification of the set of information a person needs to access to perform their duties. 2 The principle of least privilege refers to adapting the subject's access profile to the IT system to match the corresponding professional function.

Instruction No. 13/2021 Official Gazette No. 10/2021 • 2021/10/15 Topics Payment Systems :: Large-Value Payment System .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 procedures must cover all phases of the user access lifecycle, from initial registration of new users to final deregistration of users who no longer need access. Special attention must be given, where applicable, to the assignment of access rights of such critical importance that their abuse could have serious negative repercussions on the participant's operations (e.g., access rights that allow system administration, neutralization of system controls, or direct access to operational data). Adequate controls must be adopted to identify, authenticate, and authorize users at specific points in the organization's network, for example, in relation to local and remote access to payment transaction chain systems. Personal accounts are not shared to ensure accountability. Regarding passwords, rules must be established and applied through specific controls to ensure that they cannot be easily deduced, for example, rules regarding their complexity and limited temporal validity. A secure password recovery and/or reset protocol must be established. A policy on the use of cryptographic controls to protect the confidentiality, authenticity, and integrity of information must be developed and implemented. A key management policy must be established to support the use of cryptographic controls. There must be a policy on the display of confidential information on screen or on paper, for example, a clear screen or clear desk policy, to reduce the risk of unauthorized access. Regarding remote work, the risks of working in an unprotected environment must be taken into account, and adequate technical and organizational controls must be applied. Requirement 1.10: Acquisition, development, and maintenance of IT systems Security requirements must be identified and agreed upon before the development and/or implementation of IT systems. Adequate controls must be incorporated into applications, including user-developed applications, to ensure correct processing. These controls must include validation of input data, internal processing, and output data. Additional controls may be necessary for systems that process or impact sensitive, valuable, or critical information. Such controls will be determined based on security requirements and risk assessment in accordance with established policies (e.g., information security policy, cryptographic control policy). Operational requirements for new systems must be established, documented, and tested before their acceptance and use. Regarding network security, adequate controls must be implemented, including segmentation and secure management, based on the criticality of

Instruction No. 13/2021 Official Gazette No. 10/2021 • 2021/10/15 Topics Payment Systems :: Large-Value Payment System .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 data flows and the risk level of the organization's network areas. Specific controls must exist to protect confidential information circulating on public networks. Access to system files and program source code must be controlled, and IT projects and support activities must be carried out securely. Exposure of sensitive data in test environments must be avoided. Project and support environments must be strictly controlled. The introduction of changes into production must be strictly controlled. A risk assessment of significant changes to be introduced into production must be carried out. Regular security testing activities for production systems must also be carried out according to a predefined plan based on the results of a risk assessment, and security tests must include, at least, vulnerability assessments. All deficiencies evidenced during security testing activities must be evaluated, and action plans must be developed to address any identified gaps, which must be followed up in a timely manner. Requirement 1.11: Information security in supplier relationships 3 To ensure the protection of the participant's internal IT systems accessible to suppliers, information security requirements to mitigate risks associated with supplier access must be documented and formally agreed with the supplier. Requirement 1.12: Management of information security incidents and related improvements To ensure a consistent and effective approach to managing information security incidents, including the communication of security occurrences and vulnerabilities, functions, responsibilities, and procedures must be established and tested, at operational and technical levels, to ensure rapid, effective, orderly, and secure recovery following information security incidents, including scenarios related to a cyber cause (e.g., fraud committed by an external attacker or an insider). Personnel involved in these procedures must receive adequate training. Requirement 1.13: Verification of technical compliance A participant's internal IT systems (e.g., back-office systems, internal networks, and external network connectivity) must be regularly assessed for compliance

3 In the context of this exercise, 'supplier' means any third party (and its personnel) who has entered into a contract (agreement) with the institution to provide a service and who has access, under the service agreement, remotely or on-site, to information and/or IT systems and/or information processing facilities of the institution covered by or associated with the scope of the TARGET2 self-certification exercise.

Instruction No. 13/2021 Official Gazette No. 10/2021 • 2021/10/15 Topics Payment Systems :: Large-Value Payment System .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 with the policy framework adopted by the organization (e.g., information security policy, cryptographic control policy). Requirement 1.14: Virtualization Guest virtual machines must comply with all security controls established for physical hardware and physical systems (e.g., hardening and logging). Controls related to hypervisors must include: hardening of the hypervisor and the host operating system, regular patching, strict separation of different environments (e.g., production and development). Centralized management, logging and monitoring, as well as access rights management, especially for privileged accounts, must be implemented based on a risk assessment. Guest virtual machines managed by the same hypervisor must have a similar risk profile. Requirement 1.15: Cloud computing The use of public and/or hybrid cloud computing solutions in the payment transaction chain must be based on a formal risk assessment, taking into account technical controls and contractual clauses relating to the cloud computing solution. If hybrid cloud computing solutions are used, it is understood that the overall system's criticality level is the highest of the connected systems. All on-premise components of hybrid solutions must be separated from other existing on-premise systems. Business continuity management (applicable only to critical participants) The following requirements (2.1 to 2.6) concern business continuity management. Each TARGET2 participant classified by the Eurosystem as critical for the proper functioning of the TARGET2 system must have a business continuity strategy that includes the following elements. Requirement 2.1: Business continuity plans have been developed and procedures for their maintenance are in place. Requirement 2.2: An alternative operational site must be available. Requirement 2.3: The risk profile of the alternative site must be different from the risk profile of the main site, to prevent both sites from being affected by the same event at the same time. For example, the alternative site must be on a different power grid and central telecommunications circuit from the company's main location. Requirement 2.4: In the event of a major operational disruption that renders the main site and/or critical personnel inaccessible, the critical participant must be able to resume normal operations from the alternative site, where it must be possible to properly close the business day and open the following business day or days.

Instruction No. 13/2021 Official Gazette No. 10/2021 • 2021/10/15 Topics Payment Systems :: Large-Value Payment System .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 Requirement 2.5: Procedures must be in place to ensure that transaction processing is resumed at the alternative site within a reasonable period after the initial service interruption and proportionate to the criticality of the disrupted activity. Requirement 2.6: The ability to cope with operational disruptions must be tested at least once a year and critical personnel must receive adequate training. The maximum interval between tests must not exceed one year." 16. In Annex II-A, Article 1 is amended as follows: i. The definition of "Instant payment order" is amended as follows: "- "Instant payment order", in the context of the European Payments Council's SEPA instant credit transfer scheme, means a payment instruction that can be executed at any time of the day, on any day of the year, with instant or near-instant processing and notification to the payer and which includes i) TIPS DCA to TIPS DCA instant payment orders, ii) TIPS DCA to TIPS AS technical account instant payment orders, iii) TIPS AS technical account to TIPS DCA instant payment orders and iv) TIPS AS technical account to TIPS AS technical account instant payment orders," ii. The following definitions are added: "- "TIPS ancillary system technical account/TIPS AS technical account", means the account held by an ancillary system or by a CB on behalf of an ancillary system in the CB's TARGET2 component system for use by the ancillary system for the purpose of settling instant payments in its own accounting records;" "- "TIPS DCA to TIPS AS technical account liquidity transfer order", means the instruction to transfer a specified amount of funds from a TIPS DCA to a TIPS AS technical account, for financing the position of the TIPS DCA holder (or the position of another ancillary system participant) in the ancillary system's accounting records;" "- "TIPS AS technical account to TIPS DCA liquidity transfer order", means the instruction to transfer a specified amount of funds from a TIPS AS technical account to a TIPS DCA, for reducing the

Instruction No. 13/2021 Official Gazette No. 10/2021 • 2021/10/15 Topics Payment Systems :: Large-Value Payment System .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 financing of the position of the TIPS DCA holder (or the position of another ancillary system participant) in the ancillary system's accounting records;" "- "Network Service Provider/NSP", means a company that has obtained a concession from the Eurosystem to provide connectivity services through the Eurosystem Single Market Infrastructure Gateway," iii. The definition of 'T2S network service provider' is deleted. 17. In Annex II-A, Article 4 is amended as follows: i. Subparagraph f-D) is added to paragraph 2: " f-D) TIPS DCA to TIPS AS technical account liquidity transfer orders and TIPS AS technical account to TIPS DCA liquidity transfer orders; and" ii. Paragraph 3 is amended as follows: "3. TARGET2 allows for real-time gross settlement of payments in euros, effected in central bank money between PM accounts, T2S DCAs and TIPS DCAs. TARGET2 is established and operates based on the ESMIG, through which the transmission and processing of payment orders and the final receipt of payments are carried out in a technically identical manner. With regard to the technical operation of T2S DCAs, TARGET2 is technically established and operates based on the T2S platform. With regard to the technical operation of TIPS DCAs and TIPS AS technical accounts, TARGET2 is technically established and operates based on the TIPS platform. Banco de Portugal is the service provider under these Conditions. The acts and omissions of the CBs providing the ESMIG and/or the 4 CBs will be considered acts and omissions of Banco de Portugal for which it assumes responsibility under Article 21 of this annex. Participation under these Conditions does not create any contractual relationship between T2S DCA holders and the CBs providing the ESMIG or the 4 CBs when any of the latter acts in that capacity. Instructions, messages or information that a T2S DCA holder receives from or sends to the ESMIG or the T2S platform, relating to services provided under these Conditions, are considered received from or sent to Banco de Portugal." 18. In Annex II-A, references to "T2S network service provider" (singular or plural) in Article 6, paragraph 1, subparagraph a), sub-subparagraph i), Article 9, paragraph 5, Article 10, paragraph 6, Article 14, paragraph 1, subparagraph a), Article 22, paragraph 1, Article 22, paragraphs 2 and 3, Article 27, paragraph 5, Article 28, paragraph 1, Article 29, paragraph 1, and paragraph 1 of Appendix I are replaced by references to "NSP".

T2S DCA holders must: a) Have entered into a contract with an NSP within the scope of the concession contract with that NSP, in order to establish a technical connection to TARGET2- PT; b) Connect through another entity that has entered into a contract with an NSP within the scope of the concession contract with that NSP.
The legal relationship between a T2S DCA holder and the NSP is governed exclusively by the terms and conditions of the separate contract entered into with an NSP, as referred to in paragraph 1, subparagraph a).
The services to be provided by the NSP are not part of the services to be performed by Banco de Portugal in relation to TARGET2.
Banco de Portugal is not responsible for any acts, errors or omissions of the NSP (including its directors, personnel and subcontractors), nor for any acts, errors or omissions of third parties selected by participants to access the NSP's network."

Instruction No. 13/2021 Official Gazette No. 10/2021 • 2021/10/15 Topics Payment Systems :: Large-Value Payment System .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 22. Article 34-A is added to Annex II-A: «Article 34-A Transitional provisions As soon as the TARGET system is operational and TARGET2 has ceased its activity, T2S CND holders will become T2S CND holders in the TARGET system.» 23. In Annex II-A, Appendix I, number 7, point 1, subparagraph b) is amended as follows: «b) User-to-application (U2A) mode The U2A mode allows direct communication between a T2S CND holder and the T2S GUI module. Information is displayed in a browser program installed on a PC system. For U2A access, the IT infrastructure must be capable of supporting cookies. The T2S user manual contains more detailed information.» 24. In Annex II-B, the references to «TIPS network service provider» (in the singular or plural) in Article 17, number 1, subparagraph a), in Article 24, numbers 1 and 2, in Article 26, number 2, subparagraph d), in Article 29, number 6 are replaced by references to «NSP». 25. In Annex II-B, Article 1 is amended as follows: i. The definitions of “Reachable party”, “Payment order”, and "Instant payment order" are amended as follows: «- "Reachable party": an entity: a) holding a BIC; b) designated as a reachable party by a TIPS CND holder or an ancillary system; c) correspondent, client or branch of a TIPS CND holder or participant of an ancillary system, or correspondent, client or branch of the participant of an ancillary system; and d) that can be contacted via the TIPS platform and is able to submit or receive instant payment orders, either through the TIPS CND holder or the ancillary system, or directly if authorized by the TIPS CND holder or the ancillary system.» «- "Payment order": except when the term is used in Articles 16 to 18 of this annex, an instant payment order, a positive revocation response, a liquidity transfer order from an MP account to a TIPS CND, a liquidity transfer order from a TIPS CND to an MP account, a TIPS AS technical account to a TIPS CND liquidity transfer order or a TIPS CND to TIPS AS liquidity transfer order.» «- "Instant payment order": in the context of the European Payments Council's SEPA Instant Credit Transfer scheme, the payment instruction that can be executed at any time of the day, on any day of the year, with instant or near-instant processing and notification to the payer and which includes i) instant payment orders from TIPS CND to TIPS CND, ii) instant payment orders from TIPS CND to TIPS AS technical account, iii) instant payment orders from TIPS AS technical account to TIPS CND and iv) instant payment orders from TIPS AS technical account to TIPS AS technical account.» ii. The following definitions are added: «- “TIPS ancillary system technical account (TIPS AS technical account)”: the account held by an ancillary system or by the CB on behalf of an ancillary system in the CB's TARGET2 component system for use by that ancillary system for the purpose of settling instant payments in its own accounting records;

“TIPS CND to TIPS AS technical account liquidity transfer order”: the instruction to transfer a certain amount of funds from a TIPS CND to a TIPS AS technical account, to finance the position of the TIPS CND holder (or the position of another participant of the ancillary system) in the accounting records of the ancillary system;
“TIPS AS technical account to TIPS CND liquidity transfer order”: the instruction to transfer a certain amount of funds from a TIPS AS technical account to a TIPS CND, to reduce the financing of the position of the TIPS CND holder (or the position of another participant of the ancillary system) in the accounting records of the ancillary system;
“European Payments Council's SEPA Instant Credit Transfer (SCT Inst) scheme” or “SCT Inst scheme”: the automatic open standards scheme that provides a set of interbank rules to be complied with by its participants, which allows payment service providers in SEPA to offer an automatic euro instant credit transfer product at SEPA level;
“Mobile proxy look-up (MPL) service” or “MPL service”: a service that allows TIPS CND holders, ancillary systems using TIPS AS technical accounts and reachable parties, who receive from their clients a request to execute an instant payment order in favour of a beneficiary identified by a proxy (for example, a mobile phone number), to obtain from the central MPL repository the corresponding beneficiary IBAN and BIC to be used to credit the relevant account in TIPS;
“Network Service Provider (NSP)”: a company that has obtained a concession from the Eurosystem to provide connectivity services through the Eurosystem Single Market Infrastructure Gateway;
“IBAN”: the international bank account number that uniquely identifies an individual account at a specific financial institution in a given country.» iii. The definition of “TIPS network service provider” is eliminated.

In Annex II-B, Article 3, number 1, the reference to “Appendix V: TIPS technical connectivity requirements” is eliminated.
In Annex II-B, Article 4 is amended as follows: i. Subparagraph i-A is added to number 2: «i-A) Liquidity transfer orders from TIPS CND to TIPS AS technical account and liquidity transfer orders from TIPS AS technical account to TIPS CND; and»; ii. Number 3 is amended as follows: «3. TARGET2 allows for the real-time gross settlement of euro payments, made in central bank money between MP accounts, T2S CNDs and TIPS CNDs. TARGET2 is established and operates based on the PUP, through which the transmission and processing of payment orders and the final receipt of payments are carried out in a technically identical manner. With regard to the technical operation of TIPS CNDs and TIPS AS technical accounts, TARGET2 is technically established and operates based on the TIPS platform. With regard to the technical operation of T2S CNDs, TARGET2 is technically established and operates based on the T2S platform.»
In Annex II-B, Article 6, number 1, subparagraph a), sub-subparagraph i) is amended as follows: «a) Fulfill the following technical requirements: i) install, manage, operate, control and ensure the security of the IT infrastructure necessary to connect to the TIPS platform and submit payment orders to it. Applicants for TIPS CND holders may involve third parties in this process, but the responsibility will be solely and exclusively theirs. In particular, unless resorting to a party responsible for instructing payment orders, applicants for TIPS CND holders must enter into a contract with one or more NSPs in order to obtain the necessary connection and permissions, in accordance with the technical specifications of Appendix I; and»

Participants must: a) Enter into a contract with an NSP within the scope of the concession contract with that NSP, in order to establish a technical connection to TARGET2-PT; b) Establish a connection through another entity that has entered into a contract with an NSP within the scope of the concession contract with that NSP.
The legal relationship between a participant and the NSP is governed exclusively by the terms and conditions of their separate contract, as referred to in paragraph 1, subparagraph a).
The services to be provided by the NSP are not part of the services to be performed by Banco de Portugal in relation to TARGET2.
Banco de Portugal is not responsible for any acts, errors or omissions of the NSP (including its directors, staff and subcontractors), nor for any acts, errors or omissions of third parties selected by participants to access the NSP's network.»
In Annex II-B, Article 10 is eliminated.
In Annex II-B, Article 11-A is added: «Article 11-A MPL Repository
The central MPL repository contains the proxy — IBAN mapping table for the purposes of the MPL service.
Each proxy can only be linked to a single IBAN. An IBAN can be linked to one or more proxies.
Article 29 is applicable to the data contained in the MPL repository.»
In Annex II-B, Article 12, number 9 is eliminated.
In Annex II-B, Article 15, number 5 is amended as follows: «5. TIPS CNDs will be remunerated at zero percent or at the deposit facility rate, whichever is lower, unless they are used for holding minimum reserves or excess reserves. In the case of minimum reserves, the calculation and payment of remuneration for minimum reserves held will be governed by Council Regulation (EC) No 2531/98() and European Central Bank Regulation (EU) 2021/378 (ECB/2021/1)(). In the case of excess reserves, the calculation and payment of remuneration for reserves held will be governed by Decision (EU) 2019/1743 (ECB/2019/31) (). () Council Regulation (EC) No 2531/98 of 23 November 1988 on the application of minimum reserves by the European Central Bank (OJ L 318 of 27.11.1998, p. 1). () European Central Bank Regulation (EU) 2021/378 of 22 January 2021 on the application of minimum reserve requirements (ECB/2021/1) (OJ L 73 of 3.3.2003, p. 1). () European Central Bank Decision (EU) 2019/1743 of 15 October 2019 on the remuneration of excess reserves and certain deposits (ECB/2019/31) (OJ L 267 of 21.10.2019, p. 12.).»
In Annex II-B, Article 16 is amended as follows: «Article 16 Types of payment orders in TIPS CNDs The following are considered payment orders for the purposes of the TIPS service: a) Instant payment orders; b) Positive responses to revocation requests; c) Liquidity transfer orders from TIPS CND to MP account; d) Liquidity transfer orders from TIPS CND to TIPS AS technical account; and e) Liquidity transfer orders from TIPS AS technical account to TIPS CND.»
In Annex II-B, Article 18, number 6 is amended as follows: «6. After the acceptance of a liquidity transfer order from TIPS CND to MP account, from TIPS CND to TIPS AS technical account, or from TIPS AS technical account to TIPS CND, as referred to in Article 17, TARGET2-PT will verify if sufficient funds are available in the originator's account. If sufficient funds are not available, the liquidity transfer order is rejected. If sufficient funds are available, the liquidity transfer order is immediately executed.»
In Annex II-B, Article 20, number 1, subparagraph b) is amended as follows: «b) Liquidity transfer orders from TIPS CND to MP account, positive responses to revocation requests, and liquidity transfer orders from TIPS CND to TIPS AS technical account are considered entered into TARGET2-PT and irrevocable at the moment the respective TIPS CND is debited. Liquidity transfer orders from TIPS AS technical account to TIPS CND are considered entered into TARGET2-PT and irrevocable at the moment the respective TIPS AS technical account is debited.»

Definitions For the purposes of this annex and in addition to the definitions contained in Article 1 of Annex II-B, the following terms mean:

“Ancillary system central bank (ASCB)”: the Eurosystem CB with which the relevant ancillary system settling instant payments in its own accounting records has a bilateral contract for the settlement of instant payments of the ancillary system;
“Underlying gross volume”, the number of instant payments settled in the ancillary system's own accounting records and activated by funds held in the TIPS AS technical account. It does not include instant payments from or to TIPS CNDs or other TIPS AS technical accounts;
“Instructing party”, an entity designated as such by an ancillary system and which is permitted to submit payment orders to the TIPS platform and/or receive payment orders from that platform, on behalf of that ancillary system or a reachable party thereof.

Entry of payment orders into the system and their irrevocability The application of Article 20 of Annex II-B, regarding the moment of entry of instant payment orders, positive responses to revocation requests and liquidity transfer orders from TIPS CND to TIPS AS technical account and from TIPS AS technical account to TIPS CND into the relevant TARGET2 component system will not prejudice any rules of the ancillary systems that determine the moment of registration in the ancillary system and/or the irrevocability of transfer orders submitted to that ancillary system at a moment prior to the moment of registration of the payment order in question in the relevant TARGET2 component system.
Accounts supporting the settlement of instant payments in the ancillary systems' own accounting records

To support the settlement of instant payments related to ancillary systems in TIPS, a TIPS AS technical account is opened.

The ancillary system must use a TIPS AS technical account to collect the necessary liquidity reserved by its clearing members to finance their positions.
If requested, the ancillary system must be notified whenever its TIPS AS technical account is credited or debited.
The ancillary system may send instant payment orders and positive responses to revocation requests to any TIPS CND holder or TIPS ancillary system. The ancillary system must receive and process instant payment orders, revocation requests and positive responses to revocation requests from any TIPS CND holder or TIPS ancillary system.

User interfaces

The TIPS AS technical account holder must access the TIPS platform in A2A mode and may also connect in U2A mode, either directly or through one or more instructing parties.
Access to the TIPS platform allows TIPS AS technical account holders to: a) Access information related to their accounts and manage CMB; b) Initiate a liquidity transfer order from TIPS AS technical account to TIPS CND; c) Manage certain static data.

Fees and invoicing

A TIPS ancillary system is subject to the following two conditions: a) A per-transaction fee, calculated on the same basis as the table established for TIPS CND holders in Appendix IV of Annex II-B.

Instruction No. 13/2021 Official Gazette No. 10/2021 • 2021/10/15 Topics Payment Systems :: Large-Value Payment System .................................................................................................................................................................................................. Mod. 99999940/T – 01/14 b) A fee based on the underlying gross volume of instant payments settled on the peripheral system's own platform and activated by pre-funded positions in the SP TIPS technical account. The fee is EUR 0.0005 per instant payment. 2) The underlying gross volume of instant payments of the peripheral system must be calculated monthly by the BCSP based on the underlying gross volume of the previous month, rounded down to the nearest ten thousand, and reported by the peripheral system no later than the third business day of the following month. The calculated gross volume is applied in the fee calculation in the following month. 3) Each peripheral system receives from its respective BCSP, no later than the ninth business day of the following month, an invoice for the previous month based on the fees referred to in point 1) of this number. Payment must be made no later than the fourteenth business day of the month in which the invoice is issued, to the credit of the account indicated by the BCSP or to the debit of the account indicated by the peripheral system. 4) For the purposes of the fee schedule and invoicing under this annex: a) A peripheral system that has been designated as a system under Directive 98/26/EC must be treated as a separate peripheral system, even if it is operated by a legal entity that operates another peripheral system; b) A peripheral system that has not been designated as a system under Directive 98/26/EC must be treated as a separate peripheral system if it meets the following criteria: i. it is a formal agreement, in the form of a contract or legislative instrument; ii. it has more than one participant, excluding the operator of that system; iii. it has been established for the purposes of clearing, netting and/or settlement of payments and/or securities between participants; and iv. it applies common rules and standardized mechanisms for clearing, netting and/or settlement of payments and securities between participants. 5) For the purposes of invoicing under this article, for the period between December 1, 2021, and February 28, 2022, the fees correspond to the average of the total fees invoiced for the months of September, October, and November 2021.» 49. The provisions of this Instruction shall apply from November 21, 2021, except for numbers 16. iii), 18., and 21. of this Instruction, which shall apply from June 13, 2022.