Instruction No. 2/2024 - Amendment to the SICOI Compensation System Regulations

Instruction No. 2/2024 BO No. 1/2024 2nd Supplement • 2024/02/08 .................................................................................................................................................................................................. Topics Payment Systems :: Clearing Mod. 99999940/T – 01/14

Index Text of the Instruction "Annex IX - Terms and Conditions of the Account Derivation Identifier Service and Beneficiary/Debtor Confirmation

Text of the Instruction Subject: Amendment to the Regulation of the Interbank Clearing System – SICOI.

Pursuant to Article 14 of its Organic Law and Article 92 of the General Regime of Credit Institutions and Financial Companies (RGICSF), it is the responsibility of Banco de Portugal to regulate, supervise, and promote the proper functioning of payment systems.

In this context, Banco de Portugal is the regulator and manager of the Interbank Clearing System (SICOI), the retail payment system where payments made with cheques, commercial bills, credit transfers, instant transfers, direct debits, and card-based operations are processed.

Considering that in recent years there has been a growing digitalization of the economy and profound changes in the behaviors and expectations of payment service users, and in order to guarantee the proper functioning and security of payment systems, SICOI must evolve to allow its participants to use new functionalities: • The Account Derivation Identifier functionality - Proxy Lookup, which allows participants in SICOI to make available to payment service users the possibility of initiating a payment operation by indicating a "user identifier," from which the respective "payment account identifier" is obtained. • The Beneficiary/Debtor Confirmation functionality - Confirmation of Payee/Payer, which allows participants in SICOI to make available to payment service users the possibility of confirming the identity of the beneficiary or debtor of a payment operation before it is initiated.

These functionalities, on one hand, provide greater usability and convenience to payment service users and, on the other hand, contribute to greater security and prevention of fraud, scams, and errors.

Instruction No. 2/2024 BO No. 1/2024 2nd Supplement • 2024/02/08 Topics Payment Systems :: Clearing .................................................................................................................................................................................................. Mod. 99999940/T – 01/14

To establish the conditions for making these functionalities available to participants in SICOI, it is necessary to revise the regulation of this system, contained in Instruction No. 8/2018 of March 22.

Additionally, the price list applicable to participants in SICOI is amended, namely the monthly participation fee per subsystem or subsystem aspect, in reflection of the regular exercise of updating based on the recovery of costs borne by Banco de Portugal associated with the management of SICOI.

Thus, under the competence attributed to it by Article 14 of its Organic Law and Article 92 of the RGICSF, Banco de Portugal amends the articles of Instruction No. 8/2018 – SICOI Regulation –, determining the following:

1. A new Chapter III is added to Instruction No. 8/2018 of March 22, with the following title, proceeding to renumber the following Chapters and numbers: "III - ACCOUNT DERIVATION IDENTIFIER SERVICE AND BENEFICIARY/DEBTOR CONFIRMATION.
2. Provision of the Account Derivation Identifier and Beneficiary/Debtor Confirmation Service 9.1. Banco de Portugal makes available, to participants in the instant transfers subsystem and in the SEPA aspect of the credit transfers subsystem in SICOI, established in Portugal, the Account Derivation Identifier functionality – Proxy Lookup (PL) and the Single Beneficiary Confirmation functionality – Confirmation of Payee Single (CoPS), as described in Annex IX. 9.2. Banco de Portugal makes available, to participants in the instant transfers subsystem, in the SEPA aspect of the credit transfers subsystem, and in the direct debits subsystem in SICOI, established in Portugal, the Bulk Beneficiary/Debtor Confirmation functionality – Confirmation of Payee/Payer Bulk (CoPB), as described in Annex IX. 9.3. The PL functionality allows participants in SICOI, established in Portugal, to make available to payment service users the possibility of initiating a payment operation by indicating a "user identifier" of the beneficiary, from which the respective "payment account identifier" is obtained. 9.4. The CoPS and CoPB functionalities allow participants in SICOI, established in Portugal, to make available to payment service users the possibility of confirming the identity of the beneficiary or debtor of a payment operation before it is initiated.

Instruction No. 2/2024 BO No. 1/2024 2nd Supplement • 2024/02/08 Topics Payment Systems :: Clearing .................................................................................................................................................................................................. Mod. 99999940/T – 01/14

10. Provision of the Account Derivation Identifier and Beneficiary/Debtor Confirmation Service to payment service users 10.1. Participants in the instant transfers subsystem and in the SEPA aspect of the credit transfers subsystem, established in Portugal, are obliged to make the PL and CoPS functionalities available to payment service users. 10.2. Participants in the instant transfers subsystem, in the SEPA aspect of the credit transfers subsystem, and in the direct debits subsystem, established in Portugal, are obliged to make the CoPB functionality available to payment service users.

11. Terms and conditions Participation in the instant transfers subsystem, in the SEPA aspect of the credit transfers subsystem, and in the direct debits subsystem, by entities established in Portugal, implies acceptance of the Terms and Conditions defined in Annex IX of this Regulation."

12. The letter i) of number 49.4 of Instruction No. 8/2018 of March 22 shall have the following wording, with the following letter being renumbered: " i) Annex IX – Terms and Conditions of the Account Derivation Identifier Service - Proxy Lookup and Beneficiary/Debtor Confirmation - Confirmation of Payee/Payer"

13. A new Annex IX is added to Instruction No. 8/2018 of March 22, with the following wording, with the following Annexes being renumbered: "Annex IX - Terms and Conditions of the Account Derivation Identifier and Beneficiary/Debtor Confirmation Service Banco de Portugal makes available the Account Derivation Identifier - Proxy Lookup and Beneficiary/Debtor Confirmation - Confirmation of Payee/Payer service (hereinafter, "PLCP service") to participants in SICOI established in Portugal. With the provision of this service, Banco de Portugal intends, on one hand, to reinforce security in the execution of payment operations and, on the other hand, to contribute to better usability and experience for payment service users. The PLCP service is provided in accordance with the following Terms and Conditions:

I. OBJECT

1. Scope 1.1. Banco de Portugal makes the PLCP service available to participants in the instant transfers subsystem, in the SEPA aspect of the credit transfers subsystem, and in the direct debits subsystem of SICOI, who are established in Portugal. 1.2. The PLCP service is composed of three functionalities: a) The Account Derivation Identifier functionality - Proxy Lookup (PL); b) The Single Beneficiary Confirmation functionality - Confirmation of Payee single (CoPS); c) The Bulk Beneficiary/Debtor Confirmation functionality - Confirmation of Payee/Payer bulk (CoPB).

II. ACCOUNT DERIVATION IDENTIFIER FUNCTIONALITY 2. Account Derivation Identifier Functionality 2.1. The PL functionality allows the initiation of payment operations by indicating a "user identifier" which, in the case of individuals, is the mobile phone number and, in the case of legal entities, the Corporate Tax Identification Number (NIPC). 2.2. The provision of the PL functionality is based on a database, managed by Banco de Portugal, where the association between the "user identifier" and the respective "payment account identifier" – the International Bank Account Number (IBAN) – is recorded. 2.3. Within the scope of the PL functionality, participants must communicate to Banco de Portugal, upon the user's request, the following information: a) Regarding individuals: the mobile phone number ("user identifier"), the Tax Identification Number (NIF), and the IBAN of the payment account ("payment account identifier"). b) Regarding legal entities: the NIPC ("user identifier") and the IBAN of the payment account ("payment account identifier"). 2.4. Banco de Portugal ensures the centralization and maintenance of the information transmitted by participants, as well as the response to consultation requests made by them.

Instruction No. 2/2024 BO No. 1/2024 2nd Supplement • 2024/02/08 Topics Payment Systems :: Clearing .................................................................................................................................................................................................. Mod. 99999940/T – 01/14

2.5. The information to be transmitted by participants to Banco de Portugal must comply with the technical specifications provided in the Operating Manual of the Account Derivation Identifier and Beneficiary/Debtor Confirmation Service. 3. Association of the "user identifier" to the "payment account identifier" 3.1. Participants must communicate to Banco de Portugal the association of a "user identifier" to the "payment account identifier" as soon as it is requested by the payment service user. 3.2. Participants must allow payment service users to associate their "user identifier" with their respective "payment account identifier" at minimum through remote electronic channels where SEPA credit transfers or SEPA instant transfers are made available, excluding applications operated by third parties. 3.3. Participants must ensure that, in the same channels where association is permitted under point 3.2, payment service users can consult at any time whether their "user identifier" is associated with their respective "payment account identifier." 3.4. The association between the "user identifier" and the "payment account identifier" and its consultation may only be requested by the participant where the payment account that the payment service user intends to associate or consult is domiciled. 3.5. At any given moment, a specific "user identifier" may only be associated with one "payment account identifier." 4. Alteration or elimination of the association of the "user identifier" to the "payment account identifier" 4.1. Participants must, at all times, allow payment service users to alter or eliminate the association between their "user identifier" and the "payment account identifier." 4.2. Participants must allow payment service users to request the alteration or elimination of the association of their "user identifier" to the "payment account identifier" in the channels where association is permitted, under point 3.2. 4.3. The alteration of the association of the "user identifier" to the "payment account identifier" may only be requested by the participant where the payment account that the payment service user intends to associate is domiciled.

Instruction No. 2/2024 BO No. 1/2024 2nd Supplement • 2024/02/08 Topics Payment Systems :: Clearing .................................................................................................................................................................................................. Mod. 99999940/T – 01/14

4.4. The elimination of the association between the "user identifier" and the "payment account identifier" may only be requested by the participant where the payment account that the payment service user intends to dissociate is domiciled. 5. Initiation of payment operations using the Account Derivation Identifier functionality 5.1. Participants must allow payment service users to initiate payment operations using the PL functionality through remote and in-person channels where SEPA credit transfers or SEPA instant transfers are made available in a non-bulk manner. 5.2. The PL functionality cannot be used by payment service users for the creation of recurring transfer orders, nor for the creation of schedules. 5.3. Any use of the PL functionality is carried out by participants on behalf of payment service users, at their initiative, and as a preparatory step for a payment operation that is expected to be performed. 5.4. Participants must implement control mechanisms that prevent abusive use of the PL functionality by payment service users, namely the performance of consultations that do not result in the actual initiation of payment operations. 5.5. Participants may not charge any fees to payment service users for the use of the PL functionality. 6. Responsibility for transmitted information 6.1. The completeness, currency, and accuracy of the data submitted by the participant within the scope of the PL functionality is their exclusive responsibility. 6.2. The transmitted data must be duly verified and certified by participants, ensuring, namely, that the "user identifier" effectively belongs to the payment service user. 6.3. The "user identifier" of individuals (mobile phone number) should be the same that is registered and certified with the participant for interaction with the payment service user, namely for the purposes of strong customer authentication, as provided for in the Legal Regime of Payment Services and Electronic Money (RJSPME), approved in annex to Decree-Law No. 91/2018 of November 12.

Instruction No. 2/2024 BO No. 1/2024 2nd Supplement • 2024/02/08 Topics Payment Systems :: Clearing .................................................................................................................................................................................................. Mod. 99999940/T – 01/14

6.4. Whenever a participant, on its own initiative or at the initiative of the payment service user, verifies that there has been an omission or inaccuracy in the communication of data, it is obliged to proceed with its immediate rectification. 6.5. Requests made by payment service users, through electronic channels, aimed at associating a "user identifier" to the "payment account identifier," as well as subsequent alterations or eliminations, must be validated by the participant through the application of strong customer authentication. When the request is made through non-electronic channels, the participant must ensure the collection of elements that allow proving that the instruction was effectively transmitted by the client. 6.6. The closure of a payment account of a payment service user implies that the participant must, by the end of the day the account is closed, communicate to Banco de Portugal the elimination of associations that are active for the respective "payment account identifier." 6.7. Participants must provide, namely in the framework contract with payment service users, that participants or Banco de Portugal may eliminate any association that is active, for objectively justified reasons related to the security of the PL functionality or suspicion of fraudulent use thereof. In this case, participants must inform payment service users of the elimination of the PL association, justifying the reason, if possible before this elimination or, at the latest, immediately after it. 6.8. Participants must transmit to Banco de Portugal, as soon as they become aware of them, any anomalies, fraudulent actions by third parties, and/or attempts to manipulate data related to the use of the PL functionality, in the manner provided for in point V of these Terms and Conditions.

III. BENEFICIARY/DEBTOR CONFIRMATION FUNCTIONALITIES 7. Single Beneficiary Confirmation Functionality 7.1. The CoPS functionality allows the payment service user to obtain information about the beneficiary of the SEPA credit transfer or SEPA instant transfer. 7.2. Within the scope of the CoPS functionality, the participant where the payment account of the orderer of the SEPA credit transfer or SEPA instant transfer is domiciled must submit, to the participant where the payment account of the beneficiary is domiciled, through Banco de Portugal, the "payment account identifier" (the IBAN) to which the payment operation is destined, receiving in response: a) The first holder's name, in the case of accounts held by individuals;

Instruction No. 2/2024 BO No. 1/2024 2nd Supplement • 2024/02/08 Topics Payment Systems :: Clearing .................................................................................................................................................................................................. Mod. 99999940/T – 01/14

b) The corporate name and, if applicable, the trade name, in the case of legal entities. 7.3. The participant in SICOI is obliged to use the CoPS functionality when the SEPA credit transfer or SEPA instant transfer is initiated individually, or during the creation of a recurring transfer order or a schedule, and the user is in direct interaction with the participant. 7.4. By derogation from number 7.3, in the case of accounts domiciled with the same participant: a) held by different payment service users, the participant may, alternatively, opt to obtain the beneficiary confirmation directly in its internal systems, based on an autonomous legal basis, namely at the level of compliance with legislation relating to data protection. b) held by the same payment service user, the participant is not obliged to use the CoPS functionality. 7.5. In compliance with number 7.3, the participant where the payment account of the orderer is domiciled must present to the payment service user, at a moment prior to the initiation of the SEPA credit transfer or SEPA instant transfer, the name or corporate name and, if applicable, the trade name of the first holder of the payment account to which the funds are destined, which was transmitted to them, through Banco de Portugal, by the payment service provider of the beneficiary. 7.6. In the event that technical issues temporarily prevent the availability of the CoPS functionality and, consequently, the possibility of presenting to the orderer the name or corporate name and, if applicable, the trade name of the first holder of the payment account to which the funds are destined, the participant must inform the orderer of this fact. The orderer must still have the possibility to proceed with the payment operation. 8. Bulk Beneficiary/Debtor Confirmation Functionality 8.1. The CoPB functionality allows the payment service user to confirm that SEPA credit transfers, SEPA instant transfers, or SEPA direct debits are made/to the payment accounts of the intended beneficiaries or debtors. 8.2. Within the scope of the CoPB functionality, the participant where the payment account of the orderer of the SEPA credit transfers or SEPA instant transfers is domiciled, or the creditor of the SEPA direct debits, must submit, through Banco de Portugal, to the participants where the payment accounts of the beneficiaries of these transfers or the debtors of these direct debits are domiciled, the "payment account identifiers" to which the payment operations are destined, accompanied by the NIF or NIPC of the beneficiaries, receiving in response, for each beneficiary/debtor, information on whether the NIF/NIPC belongs, or not, to one of the holders of the payment account. 8.3. The participant in SICOI is obliged to make the CoPB functionality available when SEPA credit transfers, SEPA instant transfers, or SEPA direct debits are initiated by the payment service user in a bulk manner. 8.4. By derogation from number 8.3, in the case of accounts domiciled with the same participant: a) held by different payment service users, the participant may, alternatively, opt to obtain the beneficiary/debtor confirmation directly in its internal systems, based on an autonomous legal basis, namely at the level of compliance with legislation relating to data protection. b) held by the same payment service user, the participant is not obliged to use the CoPB functionality. 8.5. In compliance with number 8.3: a) The participant where the payment account of the orderer is domiciled must allow the orderer, at a moment prior to the initiation of SEPA credit transfers or SEPA instant transfers, to use the service to confirm the ownership of the beneficiary's accounts, according to the information transmitted to them by the