Notice No. 5/2025

Published in: DR, 2nd Series, Part E, No. 151, of 07/08/2025 Mod. 99999910/T – 01/14

Index

Text of the Notice
Annex to the Notice

Text of the Notice

Paragraph 2 of Article 127 of the Treaty on the Functioning of the European Union (TFEU) and Article 3 of the Statutes of the European System of Central Banks (ESCB) and of the European Central Bank (ECB) establish that one of the functions of the ESCB is the promotion of the smooth operation of payment systems.

Furthermore, Article 22 of the ESCB Statutes subordinates the actions of the ECB and the National Central Banks (NCBs) to the purpose of promoting the efficiency and robustness of payment and securities settlement systems.

The oversight function is performed by the NCBs in compliance with their mandate to promote the smooth operation of payment instruments and financial market infrastructures (FMIs), thereby contributing to the stability of the financial system.

The performance of oversight by the NCBs pursues the following objectives:

• ensure systemic stability;
• promote the efficiency of payment instruments and FMIs;
• guarantee the safety of payment instruments and FMIs in order to promote confidence in them and in the Eurosystem currency (euro); and
• safeguard the monetary policy transmission channel.

The exercise of the oversight function is supported by the monitoring and evaluation of the characteristics and performance of payment instruments and FMIs that are operating (or in the process of starting their activity), against a set of previously defined principles and standards, as well as through the definition of action plans and follow-up reports whenever necessary.

Thus, the oversight activity has been framed within international principles and standards, European regulation (focused on systemically important payment systems) or moral suasion. On the other hand, it is also relevant to highlight the importance that the information held by the supervised entities assumes for the fulfillment of the duties entrusted to the NCBs in matters of oversight.

In this context, and with the aim of allowing the Bank of Portugal to perform its oversight function, the Organic Law of the Bank of Portugal, approved by Law No. 5/98 of January 31, determines, in its Article 14, that it is the responsibility of the Bank to regulate, supervise and promote the smooth operation of payment systems, notably within the scope of its participation in the ESCB.

To achieve the objectives pursued by the oversight function attributed to the Bank of Portugal, the national legislator expressly provided, in paragraph 2 of Article 117-B of the General Regime of Credit Institutions and Financial Companies (RGICSF), that entities carrying out any activity within the scope of payment systems must communicate this fact to the Bank of Portugal and provide it with all information requested.

Given this framework, and in order to strengthen the conditions under which the Bank of Portugal exercises its oversight function, the adoption of a regulatory instrument is considered necessary to fix, at the national level, a legal framework that more perfectly establishes and details the existing information, notification and/or communication obligations for entities carrying out activity within the scope of payment systems in Portugal.

Therefore, this Notice, together with the current legal framework mentioned above, aims to regulate the information and elements that entities covered by its scope of application must communicate to the Bank of Portugal. The issuance of this Notice will improve the current performance of the Bank of Portugal regarding its mandate to promote the smooth operation of payment systems, including schemes and arrangements of payment instruments, clearly reflecting the evolution of the actions of the ESCB and NCBs as overseers, which now covers not only payment systems but also the aforementioned schemes and arrangements, given the close, necessary and inseparable link between the regulation of these and the regulation of payment systems.

For this same reason, this Notice also provides that entities offering cash withdrawal services through ATMs must notify the Bank of Portugal of the start of this activity, as well as provide information allowing the monitoring of their activities in the context of the performance of the oversight function by the Bank of Portugal.

The collection of information from entities covered by the scope of application of this Notice is fundamental for the Bank of Portugal to exercise the public interest duties entrusted to it, for example, regarding the production of payment and payment systems statistics or the definition and execution of macroprudential policy, notably identifying, monitoring and evaluating systemic risks, as well as proposing and adopting measures to prevent, mitigate or reduce these risks, with a view to strengthening the operational and cyber resilience of the financial sector.

Additionally, the existence of a regulatory instrument at the national level that synthesizes the obligations that may arise for the entities concerned in matters of oversight appears very advantageous for them as well, presenting itself as a clear and simple solution for their own activity of verifying compliance with those, strengthening the identification of these duties.

The provisions of this Notice do not prejudice the competences of the Bank of Portugal resulting from its participation in the ESCB, nor the legitimate exercise of oversight by other NCBs or the ECB itself, notably by application of the Revised Oversight Framework for Retail Payment Systems, the Eurosystem Oversight framework for electronic payment instruments, schemes and arrangements (PISA Framework), or Regulation (EU) No. 795/2014 relating to the oversight requirements for systemically important payment systems (ECB/2014/28), which may fall upon entities carrying out activity within the scope of payment systems.

This Notice was subject to prior consultation with the ECB, pursuant to Article 2 of Decision 98/415/EC, as matters within the scope of the ECB's duties are involved.

This Notice was also subject to public consultation, pursuant to Article 101 of the Administrative Procedure Code.

Thus, in the exercise of the competence conferred upon it by Article 14 of its Organic Law, approved by Law No. 5/98 of January 31, in its current wording, and by the provisions of paragraph 2 of Article 117-B of the RGICSF, approved by Decree-Law No. 298/92 of December 31, in its current wording, the Bank of Portugal determines:

Chapter I

General Provisions

Article 1

Object and Scope of Application

1. Entities carrying out activity within the scope of retail payment systems in Portugal, referred to in paragraph 1 of Article 2, have the duty to notify the Bank of Portugal of the start, alteration and cessation of this activity, in accordance with Chapter II below.

2. The entities referred to in paragraph 1 that are established in Portugal and are covered by the Eurosystem frameworks have the duty to provide the Bank of Portugal with the information it considers necessary to allow the monitoring of their activities in the context of the performance of the oversight function by the Bank of Portugal, in accordance with Chapter III below. The information collected may be used within the scope of assessments as provided for in this Notice, as well as any other oversight actions, notably under the Eurosystem frameworks.

3. The entities referred to in points (a) to (c) of paragraph 1 of Article 2 that are established in Portugal have the duty to report to the Bank of Portugal incidents of a severe nature, whether operational or security-related, in accordance with Chapter IV below;

4. The entities referred to in points (a) and (d) of paragraph 1 of Article 2 that are established in Portugal have the duty to report to the Bank of Portugal statistical information on the operations and services covered by the activity within the scope of payment systems, in accordance with Chapter V below.

5. The entities referred to in paragraph 1 of Article 2 are responsible for complying with all duties contained in this Notice regardless of whether, within the organization, these duties fall specifically on a particular body or agent.

6. The provisions of this Notice do not prejudice the competences of the Bank of Portugal resulting from its participation in the European System of Central Banks, nor the legitimate exercise of oversight by other National Central Banks or the European Central Bank itself, notably by application of the Revised Oversight Framework for Retail Payment Systems, the Eurosystem Oversight framework for electronic payment instruments, schemes and arrangements, or Regulation (EU) No. 795/2014 relating to the oversight requirements for systemically important payment systems (ECB/2014/28).

7. The provisions of this Notice do not prejudice the obligations that fall upon entities carrying out activity within the scope of retail payment systems in Portugal via other regulatory frameworks, such as those applicable to payment service providers, under the Legal Regime of Payment Services and Electronic Money.

Article 2

Entities carrying out activity within the scope of retail payment systems

1. It is considered that an entity carries out activity within the scope of retail payment systems, for the purposes of this Notice, notably when:
   a) It operates or processes retail payment systems; b) It manages schemes of payment instruments, as defined in the “Eurosystem oversight framework for electronic payment instruments, schemes and arrangements”, of November 2021; c) It manages arrangements of payment instruments, as defined in the “Eurosystem oversight framework for electronic payment instruments, schemes and arrangements”, of November 2021; d) It offers cash withdrawal services through ATMs, acting on behalf of one or more card issuers and not being a party to the framework contract with the payment service user who withdraws cash from the payment account, pursuant to point (o) of paragraph 1 of Article 5 of the Legal Regime of Payment Services and Electronic Money.

2. It is understood that activities within the scope of retail payment systems are carried out in Portugal whenever they are made available to users or payment service providers established in Portugal.

Chapter II

Communication of Start, Alteration and Cessation of Activity

Article 3

Communication of Start of Activity

1. Entities carrying out activity within the scope of retail payment systems must communicate to the Bank of Portugal the start of activity in Portugal.

2. The communication referred to in the previous paragraph must contain:
   a) The identification of the entity; b) The country of origin; c) The date from which it intends to start activity in Portugal; d) A description of the activities performed in Portugal; e) The identification of interlocutors authorized to answer any questions and provide clarifications related to the content of this Notice.

3. The communication referred to in paragraph 1 must be sent with a minimum advance of 30 days relative to the date of start of activity.

4. Entities carrying out activity within the scope of retail payment systems that, on the date of publication of this Notice, are already carrying out activity in Portugal, must communicate this fact to the Bank of Portugal within 30 days after said publication.

Article 4

Communication of Subsequent Alterations

Entities carrying out activity within the scope of payment systems in Portugal must communicate to the Bank of Portugal any alterations to the information provided within the scope of the communication of start of activity, provided for in Article 3.

Article 5

Communication of Cessation of Activity

1. Entities carrying out activity within the scope of payment systems in Portugal must communicate to the Bank of Portugal the cessation of activity in Portugal.

2. The communication referred to in the previous paragraph must contain:
   a) The date from which the entity intends to cease activity in Portugal; b) The reason for the cessation of activity in Portugal.

3. The communication referred to in paragraph 1 must be sent with a minimum advance of 30 days relative to the date of cessation of activity.

Article 6

Communications with the Bank of Portugal

The communications referred to in this Chapter must be made by filling out the Annex to this Notice, available in electronic format on the institutional website of the Bank of Portugal, and sent to the email address: oversight@bportugal.pt.

Article 7

Calculation of Deadlines

The deadlines fixed in this Chapter are continuous, their counting not being suspended on Saturdays, Sundays and holidays.

Chapter III

Oversight Function

Article 8

Performance of the Oversight Function

1. In the performance of the oversight function, the Bank of Portugal carries out assessment actions with entities established in Portugal that carry out the activities within the scope of payment systems provided for in points (a) to (c) of paragraph 1 of Article 2.

2. The Bank of Portugal details, by means of Instruction, the information that must be sent by the entities mentioned in the previous paragraph, as well as the procedures to be adopted by them within the scope of the provisions of this article, including the deadlines to be respected.

3. The provisions of the previous paragraphs do not prejudice, nor limit the possibility of the Bank of Portugal requesting additional information or carrying out other assessment actions in compliance with the applicable framework defined by the ESCB.

Chapter IV

Incidents of a Severe Nature

Article 9

Reporting of Incidents of a Severe Nature

1. Entities established in Portugal that carry out the activities within the scope of payment systems provided for in points (a) to (c) of paragraph 1 of Article 2 report to the Bank of Portugal severe incidents affecting their activity, which may be operational or security-related.

2. For the purposes of applying the previous paragraph, an operational or security incident of a severe nature is considered to be a single event or a series of connected and unforeseen events by the processor of the retail payment system or the manager of the scheme or arrangement of payment instruments, which has, or may have, an adverse impact on the integrity, availability, confidentiality, authenticity and/or continuity of services related to payments.

3. The Bank of Portugal details, by means of Instruction, the information that must be sent by the entities mentioned in paragraph 1 of this article, as well as the procedures to be adopted by them, including the deadlines to be respected regarding the reporting of severe operational or security incidents.

Chapter V

Information on Payment Systems and Instruments

Article 10

Reporting of Statistical Information on Payment Operations and Services

1. Entities established in Portugal that carry out the activities within the scope of payment systems provided for in points (a) and (d) of paragraph 1 of Article 2 report to the Bank of Portugal statistical information on the payment operations and services carried out within the scope of their activity.

2. The Bank of Portugal details, by means of Instruction, the statistical information that must be sent by the entities mentioned in the previous paragraph, as well as the procedures to be adopted by them within the scope of the provisions of this article, including the deadlines to be respected.

Chapter VI

Final Provisions

Article 11

Entry into Force

This Notice enters into force on the date of its publication.

July 29, 2025 - The Governor, Mário Centeno.

---

Annex to Notice No. 5/2025

Entities that carry out activity within the scope of payment systems

Communication of activity in Portugal

Communication date aaaa/mm/dd
Type of communication Start of activity Amendment Cessation of activity Date of entry into effect aaaa/mm/dd

I | Identification of the Entity that carries out activity within the scope of the payment systems

Name
Head office country
BIC LEI

II | Activities

Identification of activities provided in Portugal

• Operation or processing of payment systems [article 2.º (1) (a)]
• Management of schemes of payment instruments [article 2.º (1) (b)]
• Management of arrangements of payment instruments [article 2.º (1) (c)]
• Cash withdrawal services offered through ATMs [article 2.º (1) (d)]

Description of activities performed in Portugal Reason for cessation of activity in Portugal [when applicable]

III | List of payment service providers established in Portugal with whom the entity carries out activity within the scope of payment systems

Code	Name	Start aaaa/mm/dd	End aaaa/mm/dd
Code	Name	Start aaaa/mm/dd	End aaaa/mm/dd
Code	Name	Start aaaa/mm/dd	End aaaa/mm/dd
Code	Name	Start aaaa/mm/dd	End aaaa/mm/dd
Code	Name	Start aaaa/mm/dd	End aaaa/mm/dd
Code	Name	Start aaaa/mm/dd	End aaaa/mm/dd
Code	Name	Start aaaa/mm/dd	End aaaa/mm/dd
Code	Name	Start aaaa/mm/dd	End aaaa/mm/dd
Code	Name	Start aaaa/mm/dd	End aaaa/mm/dd
Code	Name	Start aaaa/mm/dd	End aaaa/mm/dd

IV | Contacts

Representatives | Telephone | E-mail

V | Date and authorized signatures

Date aaaa/mm/dd
Name | Signature
Name | Signature

---

Compliance with the duty of information towards the data subject

1. Responsible, ground and purpose

The personal data collected are processed by the Bank of Portugal, a public law legal person with number 500 792 771 and headquarters at Rua do Comércio, No. 148, 1100-150, Lisbon (hereinafter referred to as the Bank), in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (Regulation) and other applicable data protection legislation, based on the fulfillment of a legal obligation and for the purposes provided for in this Notice which regulates the information and elements that entities carrying out activity within the scope of payment systems must communicate to the Bank of Portugal within the scope of its oversight function.

2. Obligation

The provision of data for this purpose is mandatory for entities carrying out activity within the scope of payment systems in Portugal.

3. Retention

Personal data are retained for the said purpose during the period of time that the entities in question carry out the activities within the scope of payment systems provided for in this Notice of the Bank of Portugal and for a maximum period of 10 years after the cessation of activity, for archival purposes.

4. Rights

We also inform you that, pursuant to the provisions of the Regulation and other applicable data protection legislation, you have the right:

• To request the Bank to access the personal data concerning you, to rectify and delete them; and
• To limit and oppose processing, considering the provisions of point 2.

5. Contacts

Any requests for information or clarifications related to the exercise of rights regarding personal data protection within the scope of this communication should be addressed to the Bank of Portugal, via email: oversight@bportugal.pt.

6. Complaint

Any complaints related to the exercise of rights regarding personal data protection within the scope of this communication should be addressed to the Data Protection Officer of the Bank of Portugal, via email: encarregado.protecao.dados@bportugal.pt. Nevertheless, you also have the right to lodge a complaint with the National Data Protection Commission (CNPD), as the control authority.