NBB Communication NBB_2022_12: Clarifications from the European Banking Authority regarding certain aspects of the regime for access to online payment accounts under PSD2 and the SCA & CSC RTS

Boulevard de Berlaimontlaan 14-BE-1000 Bruxelles tel. +32 2 221 48 66 numero d'entreprise: 0203.201.340 RPM Bruxelles www.bnb.be

Nationale Bank
DE BELGIE VAN BELGIË

Communication
Brussels, 03 May 2022
Reference: NBB_2022_12 your contact:
Reinout Temmerman tel. +32 2 221 32 09 reinout.temmerman@nbb.be

Communication NBB_2022_12/Clarifications from the European Banking Authority regarding certain aspects of the regime for access to online payment accounts organized by PSD2 and the SCA & CSC RTS

Scope
Belgian payment service providers managing accounts within the meaning of Article 2, 12°, of the Law of 11 March 2018 on the status and supervision of payment institutions and electronic money institutions, regarding access to the activity of payment service provider, and to the activity of electronic money issuance, and to access to payment systems (hereinafter "the Law of 11 March 2018") who offer a dedicated interface within the meaning of Article 32 of the SCA & CSC RTS.

Summary/Objective
This communication clarifies the Bank's expectations regarding the implementation of certain clarifications from the European Banking Authority ("EBA") and the European Commission regarding the application of the SCA & CSC RTS by payment service providers managing accounts who offer a dedicated interface. This communication is necessary, taking into account the difficulties, existing or anticipated, related to said clarifications. The Bank emphasizes, however, that this communication has no impact on the clarifications published elsewhere by the EBA (Q&A or otherwise) concerning PSD2 in general, and the SCA & CSC RTS in particular; these clarifications remain relevant and the Bank expects them to be taken into account, even in the absence of a specific communication from the Bank concerning them.

1 Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC.
2 Delegated Regulation (EU) 2018/389 supplementing Directive (EU) 2015/2366 with regulatory technical standards on strong customer authentication and common and secure open standards of communication (hereinafter, according to the usual English abbreviation, the "SCA & CSC RTS").

NBB_2022_12-03 May 2022 Communication - Page 1/8

Dear Sir,
Dear Madam,

PSD2 aims, in particular, to allow payment initiation service providers3 and account information service providers4 (hereinafter, the "third-party providers") to securely access online payment accounts, provided and managed by payment service providers managing accounts (hereinafter, the "account managers"). The conditions for this secure access are specified in the SCA & CSC RTS, which impose, in particular, on account managers to allow this access by means of a dedicated interface or by means of the interface intended for users of payment services (Article 31 of the SCA & CSC RTS).

In the case of dedicated interfaces, Article 32, paragraph 3, of the SCA & CSC RTS provides that "payment service providers managing accounts that have set up a dedicated interface shall ensure that this interface does not impede the provision of payment initiation services and account information services".

This article has raised numerous questions from the sector (both from account managers and third-party providers), aiming to identify the implementation modalities of dedicated interfaces that should be considered non-compliant as constituting an "obstacle".
The EBA provided certain clarifications in this regard in its opinion EBA/OP/2020/10, which was expressly integrated into the supervisory exercise by the National Bank of Belgium (hereinafter "the Bank"), through its communication 2020_022 of the NBB of 1 July 2020.
Other aspects, particularly relevant for the Belgian market, have been further clarified by the answers to questions 2021_5763, 2018_4081 and 2019_4601 published by the EBA pursuant to Article 16(1) of Regulation (EU) No 1093/2010 by means of the EBA's online tool "Single Rulebook Q&A". Aware of the difficulties (existing or anticipated) related to the aforementioned answers, the Bank wishes to clarify certain of their implications through this communication. The Bank emphasizes, however, that this communication has no impact on the clarifications published elsewhere by the EBA (Q&A or otherwise) concerning PSD2 in general, and the SCA & CSC RTS in particular. These clarifications remain relevant and the Bank expects them to be taken into account, even in the absence of a specific communication from the Bank concerning them.

3 As defined in Article 2, 14° of the Law of 11 March 2018.
4 As defined in Article 2, 16° of the Law of 11 March 2018.
5 Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC.

Communication - Page 2/8 NBB_2022_12-03 May 2022

Point I of this communication concerns the following implementation modalities of dedicated interfaces and their character as an obstacle or not within the meaning of Article 32, paragraph 3, of the SCA & CSC RTS:
(i) the manual entry of an IBAN in the IT environment of the third-party provider; (ii) the indication of the account holder's name; (iii) the confirmation of available funds to payment initiation service providers; (iv) additional controls of the payment service user's consent.

Point II concerns the circumstances in which credit card accounts must be considered as payment accounts.

NBB_2022_12-03 May 2022 Communication - Page 3/8

I. IMPLEMENTATION MODALITIES OF DEDICATED INTERFACES

1. MANUAL ENTRY OF AN IBAN IN THE IT ENVIRONMENT OF A THIRD-PARTY PROVIDER
   The Bank integrates into its supervisory exercise the EBA's answer to question 2021_57636, which clarifies that account managers cannot reject access requests from third-party providers solely on the grounds that the latter have not transmitted the relevant data of the payment account(s) to which they wish to access (namely the IBAN number of the concerned payment account(s))7.
   Through this communication, the Bank confirms that consequently, it is now expected of account managers to provide the possibility for the payment service user to select, in the IT environment of the account manager which applies a redirection or decoupled approach for user authentication, the payment account(s) to which this user wishes to grant access for the provision by the third-party provider of the account information service and/or payment initiation service, when this information has not been communicated by the latter to the account manager. Furthermore, the Bank clarifies that the account manager's requirement to apply separately strong authentication of the payment service user so that the latter can beforehand access the list of their payment accounts in the account manager's environment is not considered by the Bank as constituting the obstacle specified in paragraphs 22 et seq. of the EBA Opinion 2020-10.

2. INDICATION OF THE ACCOUNT HOLDER'S NAME
   The Bank integrates into its supervisory exercise the answer from the European Commission, published by the EBA, to question 2018_40818, which clarifies that account managers are required to provide the concerned third-party providers with the name (i.e., first name(s) and surname(s)) of the payment service user if this name is included in the information made available to said user when they directly initiate a payment or directly access their accounts by means of the user interface9. Through this communication, the Bank clarifies that when the account manager includes the user's name, and, where applicable, the name of the agent or representative who would hypothetically be authorized by the holder(s) to grant access to the account10, in any of the screens presented to said user (or agent or representative) in the user interface for them to directly initiate a payment order or directly consult the balance or transaction history of the payment account, this name11 must also be provided to third-party providers when they access said account. The circumstance, for example, that the user's name is omitted from the screen confirming the success of the payment order initiation presented to the user in the user interface, if this same information was presented to them in a previous screen, is thus irrelevant.

6 https://www.eba.europa.eu/single-rulebook-qa/-/qna/view/publicld/2021_5763.
7 Article 32, paragraph 3, of the SCA & CSC RTS; Article 36, paragraph 1, a), of the SCA & CSC RTS; paragraphs 34 of the EBA Opinion 2020_10 (cf. NBB Communication 2020_022 of 1 July 2020).
8 https://www.eba.europa.eu/single-rulebook-qa/-/qna/view/publicld/2018_4081.
9 Article 36, paragraph 1, (a) and (b), of the SCA & CSC RTS; see e.g. Article 2, 46°, of the Law of 11 March 2018.
10 See the European Commission's answer to question 2020_5165, https://www.eba.europa.eu/single-rulebook-qa/qna/view/publicld/2020_5165.
11 And, where applicable, the name of the agent or representative who would hypothetically be authorized by the holder(s) to grant access to the account.

Communication - Page 4/8 NBB_2022_12-03 May 2022

The Bank further clarifies that the communication of an alias given by the payment service user to their payment account(s) does not replace the communication by the account managers of the payment service user's name when this name is, as stated above, included in any of the screens presented to the user in the user interface. It must furthermore be communicated identically to what is presented to the user (e.g., in the case of a joint account, only the surnames joined, if such is the presentation to the user).

3. CONFIRMATION OF THE AVAILABILITY OF FUNDS TO PAYMENT INITIATION SERVICE PROVIDERS
   The Bank integrates into its supervisory exercise the answer from the European Commission, published by the EBA, to question 2019_460112, which clarifies that in the case of payment initiation by a payment initiation service provider, account managers are required to provide said provider, when requested, with information ("yes/no") regarding the availability - on the concerned payment service user's payment account - of the funds necessary for the execution of the initiated payment (hereinafter, "the confirmation"). Through this communication, the Bank clarifies that:
   the request for confirmation must be able to be included in the payment order itself addressed by the third-party provider to the account manager, and thus by means of the same dedicated interface; any confirmation is subject to the strong authentication of the payment service user.
   When the request for confirmation is included in the payment order addressed to the account manager, the latter cannot require that separate strong authentications be performed by the user for the confirmation, on the one hand, and for the initiation, on the other hand.
   Thus, the requirement for separate redirection paths and/or separate strong authentications for the confirmation within the framework of the initiation of a payment order by the third-party provider is not compliant with Article 36, paragraph 1, b, and constitutes an obstacle referred to in Article 32, paragraph 3, of the SCA & CSC RTS; when the account manager confirms the success of the initiation only on the condition that the funds necessary for the execution of the payment order are available, it may specify, in the dedicated interface documentation, that the confirmation is implicit but certain when the account manager confirms to the payment initiation service provider the success of the initiation of the payment order after the strong authentication of the user.

4. ADDITIONAL CONTROLS OF THE PAYMENT SERVICE USER'S CONSENT
   Certain additional controls of the payment service user's consent required by account managers may constitute obstacles within the meaning of Article 32, paragraph 3, of the SCA & CSC RTS, as the EBA clarified in its opinion 2020_10 of the EBA13, expressly integrated into the Bank's supervisory practice via its communication 2020_022 of 1 July 2020.

12 https://www.eba.europa.eu/single-rulebook-qa/-/qna/view/publicld/2019_4601.
13 Free translation: Additional controls of consent.

42. Various market actors have raised questions about what constitutes an "additional control of consent" under Article 32(3) of the RTS [RTS SCA & CSC] and have reported cases where payment service providers managing accounts offer acceptance options requiring that users of their payment services provide initial consent to the payment service provider managing accounts in order to use the services of third-party providers, a practice that these market actors consider to be an obstacle.

The EBA refers in this regard to paragraphs 7 and 15 of the aforementioned EBA opinion 2020_10. These paragraphs state the following (free translation):

7. The EBA also clarified in the final report on the aforementioned directives that, in a redirection or decoupled approach, where the payment service user is redirected to the payment service provider managing accounts to authenticate, the interaction between the payment service user and the payment service provider managing accounts must be reduced to the minimum so that the payment service user authenticates. The authentication procedure with the payment service provider managing accounts within the framework of an account information service/payment initiation service journey must not include unnecessary steps or require the payment service user to provide unnecessary or superfluous information compared to how the payment service user can authenticate when they directly access their payment accounts or initiate a payment with the payment service provider managing accounts. The EBA considers these steps or requests for unnecessary information as obstacles.

15. Furthermore, the authentication of the payment service user with the payment service provider managing accounts in an account information service/payment initiation service journey, in a redirection or decoupled approach, must not generate unnecessary friction nor add unnecessary steps in the customer journey compared to the identical authentication procedure proposed to users of payment services when they directly access their payment accounts or when they initiate a payment with the payment service provider managing accounts.

43. Article 32(3) of the RTS explicitly mentions additional controls of the consent given by users of payment services to payment initiation service providers and account information service providers as a potential obstacle. The EBA clarified in paragraph 13 of the EBA opinion on the implementation of RTS (EBA-Op-2018-04)14 and the final report on the EBA directives on the exemption of setting up an emergency mechanism under Article 33(6) of RTS (EBA/GL/2018/07)15 that the payment initiation service provider and account information service provider is required to ensure that it has obtained the explicit consent of the payment service user in accordance with Article 66(2) of PSD2 and, respectively, Article 67(2)(a) of PSD2, and that the payment service provider managing accounts must not verify the consent given by the payment service user to the payment initiation service provider and account information service provider. This was also confirmed by the European Commission in its answer in the Q&A 430916.

44. Consequently, a general, ex ante consent requested by the payment service provider managing accounts so that users of payment services can use the services of account information service providers and payment initiation service providers is an obstacle within the meaning of Article 32(3) of RTS. The EBA would also like to recall that, as indicated in point 69 of PSD2, the terms concluded by payment service providers managing accounts with users of their services "should not contain any provision that would complicate in any way the use of payment services of other authorized or registered payment service providers under [PSD2 Directive]".

45. This does not exclude the possibility for the payment service user to request the payment service provider managing accounts to refuse access to their payment account(s) to one or more third-party providers. In such cases, payment service providers managing accounts must ensure that any restriction on access to third-party provider services is compliant with PSD2 Directive, including, where applicable, the requirements of Article 68(5) of PSD2, which authorizes payment service providers managing accounts to refuse access to a payment initiation service provider or an account information service provider to a payment account when the payment service provider managing accounts has "objectively justified and documented reasons related to unauthorized or fraudulent access to the payment account" from said account information service provider or said payment initiation service provider."

Communication - Page 6/8 NBB_2022_12-03 May 2022

Through this communication, the Bank clarifies that it expects account managers to:
a) not use, in their IT environment (whether the latter applies a redirection approach or a decoupled approach for user authentication), formulations likely to dissuade the payment service user from using payment initiation services or account information services. The Bank specifies in this regard that the formulation must be neutral and of a factual nature. Thus, the account manager cannot resort to a formulation by which it is requested that the user consent again to the third-party provider's service14. b) not require, at the end of the user's journey in this same IT environment, a click that the payment service user should perform on the last information screen presented to them, before being redirected to the IT environment of the third-party provider. Thus, after successfully completing the authentication procedure, the user must automatically be redirected to the third-party provider's environment.

14 Constitutes, by way of example, a purely informational message reflecting the prior consent given to the third-party provider, the message that would state: "[the third party] has requested access to your [payment account] for the purpose of [initiating a payment/obtaining information related to the account]. To proceed, you must be authenticated";

NBB_2022_12-03 May 2022 Communication - Page 7/8

CREDIT CARDS
The Bank integrates into its supervisory exercise the answer from the European Commission, published by the EBA, to question 2019_485615 which clarifies that credit card accounts held for the payment service user must be considered as online payment accounts if (a) they allow the user to receive and send funds to and from a third party and (b) these accounts are accessible by means of an online interface16. Through this communication, the Bank clarifies that these conditions are considered met only when the user can, by means of an online user interface, transfer and receive available funds directly from or on the account covered by a credit line, to or from a third party's account. The Bank is aware that the technical adaptations necessary to take into account, in the dedicated interface(s), the clarifications mentioned in this communication may require some time. Consequently, it is expected of account managers to bring their dedicated interface(s) into compliance with this communication by 31 March 2023 at the latest. A copy of this communication is sent to the commissioner(s), statutory auditor(s) of your institution.

Please accept, Dear Sir, Dear Madam, the assurance of my distinguished consideration.

Pierre Wunsch
Governor

15 https://www.eba.europa.eu/single-rulebook-qa/-/qna/view/publicld/2019_4856.
16 Article 2, 22°, of the Law of 11 March 2018 juncto ruling of the European Court (Fifth Chamber) of 4 October 2018 (case C-191/17).

Communication - Page 8/8 NBB_2022_12-03 May 2022