Instruction No. 16/2023: Regulation of Participation in BPnet

Instruction No. 16/2023
BO No. 6/2023 3rd Supplement • 2023/07/11
..................................................................................................................................................................................................
Topics
Information Systems :: Communication Systems
Mod. 99999911/T – 01/14
Index
Text of the Instruction
Article 1.
Article 2.
Article 3.
Article 4.
Article 5.
Article 6.
Article 7.
Article 8.
Article 9.
Article 10.
Article 11.
Annex I – Standard Contract
Annex IA – Designation of Interlocutors
Annex IB – Identification of Connection Modality
Annex IC – Direct Debit Authorization
Annex ID – Termination of the BPnet Participation Contract
Annex II – System Description
Text of the Instruction
Subject: Regulation of participation in BPnet
With a view to promoting greater speed, efficiency, and security in the exchange of information with other entities, the Bank of Portugal (hereinafter also referred to as the Bank) makes available an electronic communication system, called BPnet, to which the provisions set out below apply, defined in the exercise of the powers attributed by the Organic Law of the Bank of Portugal, approved by Law No. 5/98, of January 31, in its current wording, specifically the provisions of its Article 17, paragraph 1. In this context, and aiming to expedite the use of this secure communication channel, a revision of the previously valid Instruction is carried out, by altering its respective Annexes IB – Identification of Connection Modality and II – System Description, in order to provide all BPnet Participants with additional options regarding the connection modalities to the network infrastructure that integrates the BPnet system, with a new optional modality made available via “VPN Connection.” In the consolidated text of this Instruction, which revokes Instruction No. 21/2020, punctual adjustments, mostly of a formal nature, are also introduced, among which the express mention of the obligation to present proof of IBAN for billing purposes stands out, which now appears in the table regarding the identification of the debtor in Annex IC – Direct Debit Authorization. The omission found in the revoked Instruction, regarding the publication of Annex IE, which contains the draft of the Declaration of Termination of the BPnet Participation Contract, is also remedied, which now appears in this Instruction under the designation “Annex ID.”

Article 1.
Definitions
For the purposes of this Instruction, the following are understood:
a) BPnet – electronic communication system, composed of an infrastructure and services, made available and managed by the Bank and accessible from determined access points, which aims to interconnect the Bank of Portugal, within the scope of its legal duties, with other entities; b) Electronic communications – exchange of information carried out through BPnet, including the sending and receiving of files, messages, or documents, as well as access to the computer systems and services made available by it; c) Services – set of contents, facilities, and relationship mechanisms, made available by the Bank of Portugal within the scope of BPnet, through which contacts are established between users or computer systems of the Participants and the persons who perform functions or provide services to the Bank or the Bank’s computer systems; d) Participants – entities that, with a view to carrying out electronic communications, enter into a BPnet Participation Contract with the Bank of Portugal, in accordance with this Instruction; e) BPnet Interlocutors – natural persons designated by each Participant with the objective of representing these entities within the scope of the execution of this Instruction; f) Users – natural persons authorized by each Participant to access, on behalf and in the name of the Participant, the services made available in BPnet; g) Access profile – identification of the services to which each user can access and description of their respective access conditions; h) Group relationship – relationship existing between companies as such qualified by the Commercial Companies Code, according to one of the following modalities:
i) group constituted by total dominance, initial or subsequent; ii) parity group contract; and iii) subordination contract;

i) Dominance relationship – relationship existing between a natural or legal person and a company when, regardless of whether its domicile or headquarters are located in Portugal or abroad, the former can exercise, directly or indirectly, dominant influence over the latter. There will, in any case, be a dominance relationship when a natural or legal person:
i) Has the majority of voting rights; ii) Can exercise the majority of voting rights, under a parasocial agreement; iii) Can appoint or dismiss the majority of the holders of the administrative or supervisory bodies; j) Representative – Participant mandated by another Participant to act in its name in the context of information exchange with the Bank of Portugal through the BPnet system.

Article 2.
Object and scope of application

This Instruction regulates participation in BPnet, including access to the infrastructure and the adherence to and provision of services, and is also applicable to electronic communications carried out reciprocally between the Bank of Portugal and the Participants.
The Standard BPnet Participation Contract is contained in Annex I of this Instruction.
The provisions contained in the Bank of Portugal’s other instructions and procedural manuals regarding electronic communications and BPnet services must also be observed.

Article 3.
Participants

All entities, public or private, subject to the supervision of the Bank of Portugal, as well as those that, under applicable legal or regulatory provisions, are obliged to participate in BPnet, participate in BPnet.
In addition to those indicated in the preceding paragraph, the following entities may also participate in BPnet:
a) Entities, public or private, subject to legal and regulatory duties of communication and information to the Bank of Portugal; b) Entities, public or private, not subject to legal and regulatory duties of communication and information, with whom the Bank of Portugal agrees to apply the discipline established by this Instruction; c) Other entities with whom the Bank of Portugal enters into a BPnet Participation Contract.

Article 4.
Conditions for participation in the BPnet system

Participation in BPnet depends on the conclusion of the BPnet Participation Contract and confers upon Participants access to the infrastructure and the possibility of adhering to the services made available by the system.
The modalities and conditions for accessing the BPnet infrastructure are regulated in Annex II of this Instruction.
Without prejudice to the provisions of Article 11, the entities referred to in paragraph a) of paragraph 2 of Article 3, which are in a dominance or group relationship, may share among themselves the use of a common infrastructure for connection to BPnet, provided that the following conditions are observed:
i) The request for connection to the BPnet infrastructure must be formulated by one of the entities, which will assume, vis-à-vis the Bank of Portugal, the obligations and responsibilities arising from the use of that infrastructure; ii) Each interested entity must enter into a BPnet Participation Contract; iii) An authorization from the Participant holding the connection to the infrastructure must be previously sent to the Bank of Portugal, using the form available on the BPnet portal, allowing the use of said connection by the identified entities. iv) In cases defined in their respective adherence conditions, access to certain services through BPnet can only be carried out by a user who acts specifically as a representative of the institution in question, with the Participant and BPnet Interlocutor maintaining strict confidentiality regarding communications operated regarding such service.
The Participant may, at any time, terminate the BPnet Participation Contract, safeguarding the prior fulfillment of reporting duties and other duties determined by the conclusion of the contract.
The termination of the BPnet Participation Contract must be presented, duly signed, to the Bank of Portugal, with a thirty-day advance notice relative to the date of production of the effects of the termination of the BPnet Participation Contract proposed by the Participant, through the subscription of the Declaration of Termination of BPnet Participation Contract, available in Annex ID of this Instruction.
If the communication of the termination of the BPnet Participation Contract is received with less than thirty days' advance notice relative to the respective date of production of effects proposed by the Participant, the cessation of the Contract will only produce effects, notably regarding billing, within the term of the aforementioned thirty-day period.
The provisions of paragraphs 4 to 6 of this Article are excepted for entities that, under applicable legal or regulatory provisions, are obliged to participate in BPnet.
The Bank of Portugal may, at any time, terminate the BPnet Participation Contract, observing the advance notice referred to in paragraph 5 of this Article.
The Bank of Portugal may terminate the BPnet Participation Contract for just cause, through a reasoned communication to the Participant.

Article 5.
BPnet Interlocutors

Each Participant designates, in the BPnet Participation Contract, a minimum of two BPnet Interlocutors and a maximum of three, using for this purpose the form model contained in Annex IA to the BPnet Participation Contract.
The substitution of any of the designated Interlocutors or the alteration of their respective identification elements must be communicated immediately to the Bank of Portugal through the respective update on the BPnet portal.
Interlocutors are obliged to keep the following elements updated:
a) Name or corporate name of the Participant; b) Billing address; c) Email address; d) Telephone contact; and e) Connection modalities.
Participants must ensure the permanent existence of at least two Interlocutors, thereby safeguarding the maintenance of participation in the BPnet system during their respective periods of absence.
It is the responsibility of BPnet Interlocutors to register, alter, manage credentials, or cancel users, in the terms fixed in Annex II to this Instruction.

Article 6.
Adherence conditions and provision of services

Within the scope of the execution of the contract, the adherence conditions and provision of each of the BPnet services are fixed in the Bank of Portugal’s Instructions that regulate, in each area of its activity, duties of information or communication.
The Participant wishing to adhere to one or more BPnet services must, through its respective Interlocutor, subscribe on the BPnet portal, identifying the users and the services to which each of them individually should have access.
The Bank of Portugal will make available the services to which the Participant wishes to adhere, taking into account the legal nature of the Participant and the requirements of the institutional relationship.
According to the elements referred to in paragraph 2, the Bank of Portugal configures the access profile of each user, which may be altered, at any time, upon request by the Participant, or by the Bank, without prior notice, whenever there are weighty reasons, notably related to system security. In the latter case, the Bank will communicate to the respective Participant the content and reasons for the alteration made.
The Bank of Portugal prepares and disseminates to Participants, through available communication means, notably the BPnet portal, procedural manuals per service, as well as their respective alterations.
The introduction of new services in BPnet, as well as alterations in the functioning mode of existing services, or their cancellation, will be subject to prior communication to Participants, and the Bank of Portugal must, in the latter case, carry out said communication with adequate advance notice.
The Bank may limit access to certain services, based on their functional requirements, the availability of installed infrastructure, and defined service quality criteria.

Article 7.
Price List

The BPnet Usage Price List is available on the BPnet portal and in initial presentation documents.
The price list indicated in the preceding paragraph is defined according to the cost recovery principle, and the Bank of Portugal may introduce adjustments, if these prove necessary, due to market variations in technological supply, or when the emergence of new needs regarding infrastructure or provided services justifies it.
Any alterations introduced in the BPnet Usage Price List will be duly communicated to Participants, indicating the respective amount and the reasons determining them.

Article 8.
Security of electronic communications

Participants are obliged to prevent unauthorized users from accessing BPnet.
For identification, protection against illegitimate access to BPnet, and defense of the integrity and confidentiality of electronic communications, Participants and their respective Interlocutors and users must observe the procedures and security and control elements defined in Annex II of this Instruction and applicable procedural manuals, particularly in the Security Manual.
Participants and their respective Interlocutors and users must maintain rigorous confidentiality regarding the procedures and security elements concerning them, and whenever any breach of this confidentiality occurs, they must promptly inform the Bank of Portugal and take all necessary measures to prevent the worsening of the situation.
For all purposes, including verification of compliance with duties of communication and information to the Bank of Portugal, all electronic communications carried out by Participants using the security elements assigned to them by the Bank are considered to have been carried out by the Participants.
The Bank of Portugal commits to keeping the Security Manual updated and disseminating it to all Participants through available communication means, notably the BPnet portal.
As a condition for the execution of procedures in the field of BPnet management, the Bank of Portugal may require Interlocutors and users to present identification elements considered necessary beforehand.
The Bank of Portugal may suspend access to BPnet, in its entirety or to some of the provided services, whenever a certain number of invalid access attempts, to be defined by the Bank of Portugal, is exceeded or other types of behavior occur that suggest a breach of security.

Article 9.
Proof of electronic communications
The rules for proving the carrying out of electronic communications are established in the BPnet Participation Contract, based on the services provided and existing technologies.

Article 10.
Termination of the BPnet Participation Contract

The Participant may, at any time, terminate the BPnet Participation Contract, safeguarding the prior fulfillment of reporting duties and other duties determined by the conclusion of the contract.
The termination of the BPnet Participation Contract must be presented, duly signed, to the Bank of Portugal, with a thirty-day advance notice relative to the date of production of the effects of the termination of the BPnet Participation Contract proposed by the Participant, through the subscription of the Declaration of Termination of BPnet Participation Contract, available in Annex ID of this Instruction.
If the communication of the termination of the BPnet Participation Contract is received with less than thirty days' advance notice relative to the respective date of production of effects proposed by the Participant, the cessation of the Contract will only produce effects, notably regarding billing, within the term of the aforementioned thirty-day period.
The provisions of the preceding paragraphs are excepted for entities that, under applicable legal or regulatory provisions, are obliged to participate in BPnet.
The revocation of an institution’s authorization under the general regime for credit institutions and financial companies or the cancellation of the registration of any company with the Bank of Portugal does not imply the termination of the BPnet Participation Contract; the Participant must proceed with its respective termination in accordance with this clause.
The Bank of Portugal may, at any time, terminate the BPnet Participation Contract, observing the advance notice referred to in paragraph 2 of this Article.
The Bank of Portugal may terminate the BPnet Participation Contract for just cause, through a reasoned communication to the Participant.

Article 11.
Final Provision
Compliance with this Instruction, as well as with the procedural manuals, does not dispense Participants from observing any duties arising from the law or regulatory acts of the Bank of Portugal, notably those concerning the quality and deadlines for providing information.

Annex to Instruction No. 16/2023
BO No. 6/2023 3rd Supplement • 2023/07/11
..................................................................................................................................................................................................
Topics
Information Systems :: Communication Systems
..................................................................................................................................................................................................
Mod. 99999911/T – 01/14

Annex I – Standard Contract
Between:
BANK OF PORTUGAL, with headquarters at Rua do Comércio, No. 148, 1100-150 Lisbon, with the unique collective person identification number 500 792 771 and registered with the Lisbon Commercial Registry Office, herein represented by [Name], and hereinafter referred to as Bank, and [Name], Legal Entity, VAT or Company Number No. [Number], with headquarters at [Address], herein represented by [Name], in the capacity of [Title], hereinafter referred to as Participant. The present contract is entered into, under the following clauses:

1st

This contract is entered into under the terms and for the purposes of Instruction No. 16/2023, hereinafter referred to as Instruction.
The following Annexes form an integral part of this contract:
a. A – Designation of BPnet Interlocutors; b. B – Indication of Connection Modalities; and
c. C – Direct Debit Authorization (if applicable).
Hereinafter Annexes IA, IB, and IC.

2nd

The Participant hereby designates, in Annex IA, its BPnet Interlocutors (hereinafter Interlocutor).
The designation of a new Interlocutor, replacing the one indicated in Annex IA, can be made by the Interlocutor designated at the time of substitution.
According to the conditions established in the Instruction, the Bank commits to making available to the Participant access to the BPnet infrastructure, in the connection modality indicated in Annex IB.
Adherence to BPnet services is made by the Interlocutor, who must identify the users and the services to which each individually should have access, by subscribing on the BPnet portal.

In consideration for the use of the BPnet infrastructure, the Participant is obliged to pay an amount established in accordance with the current Price List.
The Participant is also obliged to pay the amounts due for non-free services to which the Interlocutor subscribes, in accordance with their respective terms of subscription.
The Bank is hereby authorized to make the quarterly debit of the Participant's account at the Bank of Portugal for the total amount owed by the Participant at the end of the respective quarter. If the Participant does not have an account at the Bank of Portugal, they must authorize the Quarterly Direct Debit in the account indicated in the prior Authorization for Direct Debit form submitted as an annex.
The charge for each quarter will be made in the following month, always occurring in the months of January (referring to the last quarter of the previous year), April, July, and October.
4th
The Participant is obliged, in particular, to:
a) Prevent unauthorized users from accessing BPnet; b) Observe the security and control procedures and elements defined in the Annexes to the Instruction and in the applicable procedure manuals. c) Maintain strict confidentiality regarding the security procedures and elements concerning them and to promptly inform the Bank whenever there is a breach of such confidentiality.
All electronic communications made using the authentication elements assigned to them by the Bank, as well as by the designated Interlocutors, are considered to have been carried out by the Participant.
Without prejudice to their liability as the principal, the Participant is liable for damages caused to the Bank by unauthorized persons who access BPnet using the infrastructure or authentication elements assigned to them by the Bank, unless they prove that there was no fault on their part.

The Bank and the Participant agree that, within the scope of BPnet, both the electronic registration and the receipt notifications constitute sufficient proof of the corresponding communications.
The Bank and the Participant further agree that the means of proof referred to in the previous paragraph do not prove the content of the corresponding electronic communications.
In cases where communications to be made through BPnet contain documents that must be signed by a duly authorized representative of the Participant or by an individual related person, or in cases where electronic copies of official documents are delivered, the Participant will keep the original documents in their files for a period of 5 years after the cessation of the relevant situation, and the Bank may request the physical presentation of such documents, if they exist in that format, during that period.
6th
The Bank is not liable for transmission deficiencies resulting in non-reception or discrepancy between the electronic communications sent and received, arising from equipment or computer system failures, as well as from third-party interventions on the network infrastructure. 7th
The Bank undertakes to implement transparency and auditability rules in the management of its systems, making available to the Participant, whenever justified, the data obtained through this means.
The Participant hereby authorizes the Bank, whenever it deems necessary, to:
a) Use the necessary technical equipment to ensure system auditability and manage it effectively, including aspects related to security; b) Use computer equipment to record in digital media any data transmissions maintained between the Participant and the Bank.

If the Participant detects any anomaly in the functioning of the equipment or system, they must immediately notify the Bank, which is hereby authorized, from that moment and until the repair of these situations, to block and prevent any electronic communications through BPnet.
The same authorization is hereby granted to the Bank in case it detects any anomaly in the functioning of the equipment or system.
9th
All disputes arising from this contract will be decided, in a single instance, by an arbitral tribunal composed of one member indicated by the Bank, another by the Participant, and another chosen, by mutual agreement, by these two arbitrators.
The arbitral tribunal has its seat in Lisbon, applies Portuguese Law, and is governed by the provisions of Law No. 63/2011, of December 14, including the provisions of paragraph 3 of Article 4 of this legal instrument.

Annex to Instruction No. 16/2023 BO No. 6/2023 3rd Supplement • 2023/07/11
Topics Information Systems :: Communication Systems
..................................................................................................................................................................................................
Mod. 99999911/T – 01/14
Annex IC – Authorization for Direct Debit
Authorization Reference (ADD) to be completed by the Creditor Mandate reference – to be completed by the creditor.
By subscribing to this authorization, you authorize the Bank of Portugal to send instructions to your bank to debit your account and your bank to debit your account, in accordance with the instructions from the Bank of Portugal. Your rights include the possibility of requesting a refund from your bank of the debited amount, under the terms and conditions agreed with your bank. The refund must be requested within a period of eight weeks, starting from the date of the debit in your account. Your rights are explained in a statement that you can obtain from your bank. Please fill in all fields marked with *. The completion of the fields marked with is the responsibility of the Creditor. By signing this mandate form, you authorize the Banco de Portugal to send instructions to your bank to debit your account and your bank to debit your account in accordance with the instructions from Banco de Portugal. As part of your rights, you are entitled to a refund from your bank under the terms and conditions of your agreement with your bank. A refund must be claimed within 8 weeks starting from the date on which your account was debited. Debtor Identification (Debtor identification) * Name of the Debtor(s) / Name of the debtor(s) Street name and number Postal code - City Country/Country NIPC/VAT/Company BIC SWIFT/SWIFT BIC Account number – IBAN / Account number – IBAN Proof of IBAN must be presented for billing purposes. Creditor Identification (Creditor identification) Creditor Name / Creditor Name Bank of Portugal Creditor Identification Code / Creditor identifier PT37ZZZ111688 Street name and number / Street name and number Rua do Comércio, 148 Postal code / Postal code 1100 - 150 City / City LISBOA Country / Country PORTUGAL Payment (Payment) * Type of payment / Type of payment Recurrent / Recurrent payment Or / Or One-off / One-off payment

Location of signature / City or town in which you are signing Date / Date Your rights, regarding the above-mentioned authorization, are explained in a statement that you can obtain from your bank. / Your rights regarding the above mandate are explained in a statement that you can obtain from your bank. __________________________________________ _____ - ___________________________________________ _____ Signature(s) / Signature(s)

A secure network for interconnection between the Bank of Portugal and the Adhering Institutions, designated as Participants.
A central access point to informational content and services provided through this network – BPnet Portal.
Specific users, named by the Participants, and designated as Interlocutors, who are assigned responsibility for subscribing and changing, electronically, users and their respective access profiles.
Webmail service for users and contextualized to the subscribed services.
File Transfer facilities, for electronic transfer of data and files, in the context of specific business areas.
Mechanisms for implementing solutions based on communication between applications.
Customer support services.
Technical Support Service, with the ability to register and track incidents online.
Notification mechanisms framed within the subscribed services.
Security and procedure manuals for the various services.
AVAILABILITY CONDITIONS
The set of infrastructural means and functionalities integrated into the BPnet system will be available under the following conditions and forms:

Network Infrastructure
Access to BPnet can be made according to the following modes:

Dedicated Link, only available in national territory, through a private network with dedicated circuits contracted from an operator and with accesses starting from 4Mbps.
This mode implements a dedicated and encrypted circuit between the Participant and the Bank of Portugal.
In this mode, two pieces of equipment are installed at the Participant's premises, one from the Bank of Portugal and another from the contracted operator.
These pieces of equipment are provided by the Bank of Portugal, which maintains ownership, as well as responsibility for their management and administration in partnership with the contracted operator.
VPN Link, through an IPSEC Tunnel (VPN).
In this mode, an encrypted connection (IPSEC) is established, via the Internet, between the Participant and the Bank of Portugal.

Non-Dedicated Link, via the Internet.
In this mode, the connection is established by the user at the Participant from their systems or workstations.
This solution requires the use of a fixed, non-shared IP address for Internet access by the Participant.
As this means of communication is via the Internet, it is subject to its limitations.
Link Via another Group entity
In this option, the Participant accesses BPnet through an existing Dedicated Link or VPN Link, which has been previously contracted by an entity of the same group.
Participants are responsible for ensuring the internal configurations necessary to share the access link to BPnet.
Only Participants belonging to the same group (see requirements) are eligible for this link.
High-availability – It is possible to implement high-availability solutions through the contracting of additional secondary links.
Notes: Participants must coordinate with the Bank of Portugal regarding changes to IP and/or Operator, under penalty of being unable to access the Portal.

Portal
Access to the Portal is made to the following address: www.bportugal.net The recommended browsers are Microsoft Edge, with IE mode enabled, or Google Chrome.
Subscription and Change of Users

Allows Participants the autonomy to subscribe and change users and their respective access profiles electronically.
This functionality, accessible via the portal, will be made available to specific users, designated as Interlocutors, named by the Participants to represent them within the scope of their interaction with BPnet.

Webmail
A user's Webmail service comprises:

The facility to receive messages from subscribed services.
The facility to send messages to subscribed services.
Notification facilities for message receipt.
The size of mailboxes and messages is limited according to previously defined values.

Annex to Instruction No. 16/2023 Official Gazette No. 6/2023 3rd Supplement • 2023/07/11
Topics Information Systems :: Communication Systems
..................................................................................................................................................................................................
Mod. 99999911/T – 01/14

File Transfer
File Transfer functionalities are available in the context of the specific needs of each service, presented in two modalities:

Interactive File Transfer - Download / Upload via portal.
Automatic File Transfer
o Based on the FTP (File Transfer Protocol) protocol o Based on Webservices Access to the File Transfer service, in the Automatic File Transfer modality - outside the portal, requires an FTP client or an FTP Server.

Application-to-Application Communication

These solutions will be subject to bilateral agreements between the Bank of Portugal and the BPnet system Participants, aiming at their implementation in the application systems where this type of solution is advisable.
In these cases, it becomes necessary for both parties to develop their respective application components that implement the protocol defined for the respective system.

TECHNICAL SUPPORT SERVICE
Service that covers the reporting and monitoring of issues within the BPnet scope.
Made available for reporting in the following modalities:

Online Incident Registration – based on opening an Occurrence on the BPnet Portal and control through the assigned ticket.
Hours: 24h x 7d
Offline Incident Registration
Hours: 24h x 7d
Phone: 213 130 160 e-mail: apoio.BPnet@bportugal.pt Technical Support operates for monitoring issues on weekdays from 8:00h to 20:00h.
Incidents registered outside support hours will be treated on the immediate next weekday.

CUSTOMER SUPPORT SERVICE
Service that supports general issues – Bank of Portugal Telephone Contact Center:
Hours: Weekdays from 8:30h to 18:00h
Phone: 213 130 000
Service that supports contractual management issues and the adherence and cessation process – Customer Service Coordination:
e-mail: bpnet@bportugal.pt

INFRASTRUCTURE AVAILABILITY AND RESPONSIBILITIES Hours 24h x 7 days; one scheduled downtime per quarter for maintenance is planned.
General Description • The BPnet infrastructure is available, in normal operating conditions, during the indicated hours.

In the event of a communications circuit failure, and in the absence of a connection backup, the recovery time depends on the operator.
Maintenance activities to be performed will be duly scheduled and communicated to Participants.
The Bank of Portugal does not guarantee the resolution of incidents outside support hours.

Responsibilities
Bank of Portugal

It is the objective of the Bank of Portugal to ensure the operability of the service during the indicated hours.
The Bank of Portugal assumes responsibility, in case of incident or problem, for:
o Within technical support hours, immediately proceeding to diagnosis and notifying Participants of the unavailability time required for problem resolution; o Outside support hours, proceeding to diagnosis and notifying Participants during the following active support period.
The Bank of Portugal commits to making available and keeping updated the technical manuals deemed necessary for the proper functioning of BPnet.

Participant
Entities adhering to BPnet, as well as all users acting on their behalf, accept the responsibilities inherent to the service conditions described and to the observance of the rules defined in the technical manuals made available by the Bank of Portugal within the BPnet service.

ADHERENCE AND CESSATION PROCESS AND CONDITIONS FOR THE PORTAL The privileged means for handling these topics will be the electronic address bpnet@bportugal.pt.

Adherence Process

The entity requests adherence by filling in the information requested in the Instruction.
Once the request is accepted, the entity acquires the status of Participant, with the following being assigned by the Bank of Portugal:
o A user identifier and its respective access password for each Interlocutor designated by the entity, as well as their respective Webmail addresses. o Access to the User Profile Management service for each designated Interlocutor. From this service, Interlocutors may submit requests for registration, alteration, or cancellation of users or services that are part of the individual profile of each of them. They may also consult the profiles of the various users of the Participant as well as the subscribed services.
If a Dedicated connection is requested, the Bank of Portugal will request the Communications Operator to install a dedicated circuit with the characteristics defined in the adherence process. After the circuit is made available, the Bank of Portugal will proceed to install the equipment at the Participant's premises, thereby formalizing the start of the adherence contract to BPnet for billing purposes.
For a VPN connection, the Bank of Portugal will make available to the Participant the technical specifications for establishing the IPSEC Tunnel with the Bank of Portugal, and authorize the public IP address, which must be fixed and non-shared, indicated by the Participant at the time of adherence, thereby formalizing the start of the BPnet Adherence Contract for billing purposes.
In a Non-Dedicated connection, the Bank of Portugal will authorize access to the BPnet portal from the public IP address, which must be fixed and non-shared, indicated by the Participant at the time of adherence, thereby formalizing the start of the BPnet Adherence Contract for billing purposes.
In a connection Via another Group entity, no additional configurations are made by the Bank of Portugal; it is up to the Participant to ensure connectivity through the shared connection.

Adherence Conditions

Sharing of Dedicated Connections or VPN Connections: For entities in a relationship of dominance or group, it is possible to share the BPnet infrastructure. Nevertheless, each entity must request adherence to BPnet, using the forms previously indicated. In the corresponding form, it must indicate that it will use the infrastructure already subscribed by another entity of the same Group. In this case, the Bank of Portugal will require proof of acceptance by the respective Participant Holder of the dedicated BPnet connection.
Responsibilities: The Participant adhering to the infrastructure is responsible for its proper use as well as for all aspects regarding the payment of charges associated with it, regardless of whether it shares it or not with other Participants with which it has dominance or group relationships.
Representative: Participant mandated by another Participant to act on its behalf in the context of information exchange with the Bank of Portugal through the BPnet system.
Conditions for Representation to occur:
o Entities must be demonstrably in a relationship of dominance or group. o Participants must have at least one common Interlocutor. o Subscription by representation is only possible for services previously subscribed in the originating Participant and that are configured to allow representation. o A user is considered to be acting in representation when exercising activity in another entity. o The point of union of representation between Participants are the Interlocutors. o It is optional for Participants under these present conditions.
The access and usage charges of BPnet are described in documents on the Portal and in the initial presentation documents.

Instruction No. 16/2023: Regulation of Participation in BPnet

Lineage: In force