Instruction No. 16/2023
BO No. 6/2023 3rd Supplement • 2023/07/11

..................................................................................................................................................................................................

Topics
Information Systems :: Communication Systems

Index

Text of the Instruction

Article 1

Article 2

Article 3

Article 4

Article 5

Article 6

Article 7

Article 8

Article 9

Article 10

Article 11

Annex I – Standard Contract

Annex IA - Designation of Interlocutors

Annex IB – Identification of the Connection Modality

Annex IC – Direct Debit Authorization

Annex ID - Termination of the BPnet Participation Contract

Annex II – Description of the System

Text of the Instruction

Subject: Regulation of participation in BPnet

With a view to promoting greater speed, efficiency and security in the exchange of information with other entities, Banco de Portugal (hereinafter also referred to as the Bank) provides an electronic communication system, called BPnet, to which the provisions set out below apply, defined in the exercise of the powers conferred by the Organic Law of Banco de Portugal, approved by Law No. 5/98, of 31 January, in its current wording, namely the provisions of Article 17(1) thereof.

In this context, and aiming to streamline the use of this secure communication channel, the previously applicable Instruction is revised, by amending its Annexes IB – Identification of the Connection Modality and II – Description of the System, in order to provide all BPnet Participants with additional options regarding the modalities of connection to the network infrastructure that integrates the BPnet system, with a new optional modality being made available through "VPN Connection".

In the consolidated text of this Instruction, which repeals Instruction No. 21/2020, occasional adjustments are also introduced, mostly of a formal nature, among which it is worth highlighting the express mention of the obligation to present proof of the IBAN for invoicing purposes, which is now included in the table relating to the identification of the debtor in Annex IC – Direct Debit Authorization.

The omission, verified in the Instruction now repealed, of the publication of Annex IE, which contains the draft of the Declaration of Termination of the BPnet Participation Contract, is also remedied, and it is now included in this Instruction under the designation "Annex ID".

Article 1 Definitions

For the purposes of this Instruction, the following shall mean:

a) BPnet – electronic communication system, composed of an infrastructure and services, made available and managed by the Bank and accessible from determined access points, which aims to interconnect Banco de Portugal, within the scope of its legal attributions, with other entities;

b) Electronic communications – exchange of information carried out through BPnet, including the sending and receiving of files, messages or documents, as well as access to the computer systems and services made available by it;

c) Services – set of contents, facilities and relationship mechanisms, made available by Banco de Portugal within the scope of BPnet, through which contacts are established between users or computer systems of the Participants and the persons who perform functions or provide services to the Bank or its computer systems;

d) Participants – the entities that, with a view to carrying out electronic communications, enter into a BPnet Participation Contract with Banco de Portugal, under the terms of this Instruction;

e) BPnet Interlocutors – natural persons designated by each Participant with the objective of representing these entities within the scope of the execution of this Instruction;

f) Users – natural persons authorized by each Participant to access, on its behalf and in its name, the services made available on BPnet;

g) Access profile – identification of the services that each user can access and description of the respective access conditions;

h) Group relationship – relationship existing between companies as qualified as such by the Commercial Companies Code, according to one of the following modalities:

i) group constituted by total control, initial or supervening;

ii) parity group contract; and

iii) subordination contract;

..................................................................................................................................................................................................
Mod. 99999911/T – 01/14

..................................................................................................................................................................................................

i) Control relationship – relationship existing between a natural or legal person and a company when, regardless of whether its domicile or registered office is located in Portugal or abroad, the former may exercise over the latter, directly or indirectly, a dominant influence. There will, in any case, be a control relationship when a natural or legal person:

i) Holds the majority of voting rights;

ii) May exercise the majority of voting rights, under the terms of a shareholders' agreement;

iii) May appoint or dismiss the majority of the holders of the management or supervisory bodies;

j) Representative – Participant mandated by another Participant to act in its name in the context of the exchange of information with Banco de Portugal through the BPnet system.

Article 2 Object and scope of application

1. This Instruction regulates participation in BPnet, including access to the infrastructure and the adherence to and provision of services, and is also applicable to electronic communications carried out reciprocally between Banco de Portugal and the Participants.

2. The Standard BPnet Participation Contract is set out in Annex I to this Instruction.

3. The provisions contained in the other instructions and procedure manuals of Banco de Portugal must also be observed with regard to electronic communications and BPnet services.

Article 3. Participants

1. All public or private entities subject to the supervision of Banco de Portugal participate in BPnet, as well as those that, under the applicable legal or regulatory terms, have the obligation to participate in BPnet.

2. In addition to those indicated in the previous number, the following entities may also participate in BPnet:

a) Public or private entities subject to compliance with legal and regulatory duties of communication and information before Banco de Portugal;

b) Public or private entities, not subject to legal and regulatory duties of communication and information, with which Banco de Portugal agrees to apply the discipline established by this Instruction;

c) Other entities with which Banco de Portugal enters into a BPnet Participation Agreement.

Instruction no. 16/2023 BO no. 6/2023 3rd Supplement • 2023/07/11 Themes Information Systems :: Communication Systems
..................................................................................................................................................................................................

Article 4. Conditions for participation in the BPnet system

1. Participation in BPnet depends on the conclusion of the BPnet Participation Agreement and grants Participants access to the infrastructure and the possibility of adhering to the services made available by the system.

2. The modalities and conditions of access to the BPnet infrastructure are regulated in Annex II of this Instruction.

3. Without prejudice to the provisions of article 11, the entities referred to in subparagraph a) of no. 2 of article 3, which are in a relationship of dominance or group, may share among themselves the use of a common infrastructure for connection to BPnet, provided that the following conditions are observed:

i) The request for connection to the BPnet infrastructure must be made by one of the entities, which will assume, before Banco de Portugal, the obligations and responsibilities arising from the use of that infrastructure;

ii) Each interested entity must enter into a BPnet Participation Agreement;

iii) An authorization from the Participant holding the connection to the infrastructure must be previously sent to Banco de Portugal, in accordance with the form made available on the BPnet portal, permitting the use of said connection by the identified entities.

iv) In cases defined in the respective adhesion conditions, access to certain services through BPnet may only be carried out by a user who acts specifically as a representative of the institution in question, and the Participant and BPnet Interlocutor must maintain strict confidentiality regarding the communications operated in relation to such service.

4. The Participant may, at any time, terminate the BPnet Participation Agreement, safeguarding the prior completion of reporting duties and other duties determined with the conclusion of the contract.

5. Termination of the BPnet Participation Agreement must be submitted, duly signed, to Banco de Portugal, with thirty days' notice prior to the effective date of termination of the Participation Agreement proposed by the Participant, through the subscription of the Declaration of Termination of the BPnet Participation Agreement, available in Annex ID of this Instruction.

6. If the communication of termination of the Participation Agreement is received with less than thirty days' notice prior to the respective effective date proposed by the Participant, the termination of the Agreement shall only take effect, namely with regard to billing, at the end of said thirty-day period.

7. Excepted from the provisions of numbers 4 to 6 of this article are entities that, under the applicable legal or regulatory terms, have the obligation to participate in BPnet.

8. Banco de Portugal may, at any time, terminate the BPnet Participation Agreement, and must observe the notice period referred to in no. 5 of this article.

9. Banco de Portugal may terminate the BPnet Participation Agreement for just cause, by means of a reasoned communication to the Participant.

Article 5. BPnet Interlocutors

1. Each Participant designates, in the BPnet Participation Agreement, a minimum of two BPnet Interlocutors and a maximum of three, using for this purpose the form template contained in Annex IA to the BPnet Participation Agreement.

2. The replacement of any of the designated Interlocutors or the alteration of their identification elements must be communicated immediately to Banco de Portugal through the respective update on the BPnet portal.

3. The Interlocutors have the obligation to keep the following elements updated:

a) Name or corporate name of the Participant;

b) Billing address;

c) E-mail address;

d) Telephone contact; and

e) Connection modalities.

4. Participants must guarantee the permanent existence of at least two Interlocutors, thus safeguarding the maintenance of participation in the BPnet system during their respective periods of absence.

5. The BPnet Interlocutors are responsible for registering, altering, managing credentials or cancelling users, under the terms set out in Annex II to this Instruction.

Article 6. Conditions for adhesion and provision of services

1. Within the scope of the execution of the contract, the conditions for adhesion and provision of each of the BPnet services are set out in the Instructions of Banco de Portugal that regulate, in each area of its activity, information or communication duties.

2. The Participant intending to subscribe to one or more BPnet services must, through its respective Contact Person, subscribe on the BPnet portal, identifying the users and the services to which each of them individually should have access.

3. Banco de Portugal shall make available the services to which the Participant intends to subscribe, taking into account the legal nature of the Participant and the requirements of the institutional relationship.

4. In accordance with the elements referred to in paragraph 2, Banco de Portugal configures the access profile of each user, which may be changed at any time, at the request of the Participant, or by the Bank, without prior notice, whenever there are weighty reasons, namely related to system security. In the latter case, the Bank shall communicate to the respective Participant the content and the reasons for the change made.

5. Banco de Portugal prepares and discloses to Participants, through the available means of communication, namely the BPnet portal, procedure manuals per service, as well as the respective amendments.

Instruction No. 16/2023 BO No. 6/2023 3rd Supplement • 2023/07/11 Themes Information Systems :: Communication Systems
..................................................................................................................................................................................................

6. The introduction of new services in BPnet, as well as changes in the operating mode of existing services, or their cancellation, shall be subject to prior communication to Participants, and Banco de Portugal must, in the latter case, carry out said communication with adequate advance notice.

7. The Bank may limit access to certain services, depending on their functional requirements, the availability of the installed infrastructure and the defined service quality criteria.

Article 7.º Price List

1. The BPnet Usage Price List is available on the BPnet portal and in the initial presentation documents.

2. The price list indicated in the previous paragraph is defined in accordance with the cost recovery principle, and Banco de Portugal may introduce adjustments, if these prove necessary, due to market variations in terms of technological supply, or when the emergence of new needs at the level of infrastructures or services made available justifies it.

3. Any changes introduced to the Usage Price List shall be duly communicated to Participants, and the respective amount and the reasons that determined them must be indicated.

Article 8.º Security of electronic communications

1. Participants undertake to prevent access to BPnet by unauthorized users.

2. For their identification, protection against illegitimate access to BPnet and defense of the integrity and confidentiality of electronic communications, Participants and their respective Contact Persons and users must observe the security and control procedures and elements defined in Annex II of this Instruction and in the applicable procedure manuals, in particular in the Security Manual.

3. Participants and their respective Contact Persons and users must maintain strict confidentiality regarding the security procedures and elements that concern them, and must, whenever any breach of that confidentiality occurs, promptly inform Banco de Portugal and take all necessary measures to avoid the worsening of the situation.

4. For all purposes, including verification of compliance with the duties of communication and information to Banco de Portugal, all electronic communications made using the security elements assigned to them by the Bank are considered to be made by the Participants.

5. Banco de Portugal undertakes to keep the Security Manual updated and to disclose it to all Participants through the available means of communication, namely the BPnet portal.

6. As a condition for the execution of procedures in the field of BPnet management, Banco de Portugal may previously require the Contact Persons and users to present the identification elements considered necessary.

7. Banco de Portugal may suspend access to BPnet, as a whole or to any of the services made available, whenever a certain number of invalid access attempts, to be defined by Banco de Portugal, is exceeded or another type of behavior occurs that constitutes a security breach.

Article 9.º Proof of electronic communications

The rules for proving that electronic communications were made are established in the BPnet Participation Agreement, depending on the services made available and the existing technologies.

Article 10.º Termination of the Participation Agreement in the BPnet system

1. The Participant may, at any time, terminate the BPnet Participation Agreement, safeguarding the prior completion of the reporting duties and other duties determined by the conclusion of the agreement.

2. The termination of the BPnet Participation Agreement must be submitted, duly signed, to Banco de Portugal, with thirty days' notice prior to the effective date of the termination of the Participation Agreement proposed by the Participant, through the signing of the Declaration of Termination of the BPnet Participation Agreement, available in Annex ID of this Instruction.

3. If the communication of termination of the Participation Agreement is received with less than thirty days' notice prior to the respective effective date proposed by the Participant, the termination shall only take effect, namely with regard to billing, at the end of said thirty-day period.

4. Entities that, under applicable legal or regulatory terms, are obliged to participate in BPnet are excepted from the provisions of the preceding paragraphs.

5. The revocation of an institution's authorization under the general regime for credit institutions and financial companies or the cancellation of the registration of any company with Banco de Portugal does not entail the termination of the BPnet Participation Agreement, and the Participant must proceed with its termination under the terms of this clause.

6. Banco de Portugal may, at any time, terminate the BPnet Participation Agreement, and must observe the notice period referred to in paragraph 2 of this article.

7. Banco de Portugal may terminate the BPnet Participation Agreement for just cause, by means of a reasoned communication to the Participant.

..................................................................................................................................................................................................

Article 11. Final provision

Compliance with this instruction, as well as with the procedure manuals, does not exempt Participants from observing any duties arising from law or from regulatory acts of Banco de Portugal, particularly those concerning the quality and deadlines for the provision of information.

Annex to Instruction No. 16/2023 BO No. 6/2023 3rd Supplement • 2023/07/11
Topics Information Systems :: Communication Systems
..................................................................................................................................................................................................

Annex I – Standard Agreement

Between:

BANCO DE PORTUGAL, with registered office at Rua do Comércio, No. 148, 1100-150 Lisbon, with the single identification number 500 792 771 for legal person identification and registration at the Lisbon Commercial Registry Office, in this act represented by , and hereinafter referred to as Bank, and , Legal Person, VAT or Company Number No. , with registered office at , in this act represented by , in the capacity of , hereinafter referred to as Participant.

This agreement is entered into under the following clauses:

1st

1. This agreement is entered into under the terms and for the purposes of Instruction No. 16/2023, hereinafter referred to as Instruction.

2. The following Annexes form an integral part of this agreement:

a. A – Designation of BPnet Contacts;

b. B – Indication of Connection Modalities; and

c. C – Direct Debit Authorization (if applicable).

Hereinafter Annexes IA, IB and IC.

2nd

1. The Participant hereby designates, in Annex IA, its BPnet Contacts (hereinafter Contact).

2. The designation of a new Contact, replacing the one indicated in Annex IA, may be made by the Contact designated at the date of replacement.

3. In accordance with the conditions established in the Instruction, the Bank undertakes to provide the Participant with access to the BPnet infrastructure, in the connection modality indicated in Annex IB.

4. Subscription to BPnet services is made by the Contact, who must identify the users and the services to which each one individually should have access, by subscribing on the BPnet portal.

3rd

1. As consideration for the use of the BPnet infrastructure, the Participant undertakes to pay an amount established in accordance with the Price List in force.

2. The Participant also undertakes to pay the amounts due for non-free services to which the Contact subscribes, under the respective subscription conditions.

3. The Bank is hereby authorized to debit quarterly the Participant's account at Banco de Portugal for the total amounts owed by the Participant at the end of the respective quarter. If the Participant does not have an account at Banco de Portugal, it must authorize the quarterly Direct Debit on the account indicated in the prior Account Debit Authorization declaration presented in annex.

4. Collection for each quarter shall be made in the following month, always occurring in the months of January (referring to the last quarter of the previous year), April, July and October.

4th

1. The Participant undertakes, in particular, to:

a) Prevent access to BPnet by unauthorized users;

b) Observe the security and control procedures and elements defined in the Annexes to the Instruction and in the applicable procedure manuals.

c) Maintain strict confidentiality regarding the security procedures and elements concerning it and to promptly inform the Bank whenever a breach of that confidentiality occurs.

2. All electronic communications made using the authentication elements assigned to them by the Bank, as well as by the designated Contacts, are considered to have been made by the Participant.

3. Without prejudice to its liability as principal, the Participant is liable for damages caused to the Bank by unauthorized persons who access BPnet using the infrastructure or authentication elements assigned to them by the Bank, unless it proves that there was no fault on its part.

5th

1. The Bank and the Participant agree that, within the scope of BPnet, both the electronic record and the acknowledgments of receipt constitute sufficient proof of the corresponding communications having been made.

2. The Bank and the Participant further agree that the means of proof referred to in the previous paragraph do not prove the content of the corresponding electronic communications.

3. In cases where the communications to be made through BPnet contain documents that must be signed by a representative of the Participant duly authorized for that purpose or must be signed by a related natural person, or also in cases where electronic copies of official documents are delivered, the Participant shall keep the original documents in its files for a period of 5 years after the cessation of the situation in question, and the physical presentation of such documents, when they exist in that format, may be requested during that period by the Bank.

6th

The Bank is not liable for transmission deficiencies resulting in the non-receipt or divergence between the electronic communications sent and received, arising from malfunctions in the equipment or computer systems made available, as well as from third-party interventions on the network infrastructure.

7th

1. The Bank undertakes to implement transparency and auditability rules in the management of its systems, making available to the Participant, whenever justifiable, the data obtained through that means.

2. The Participant hereby authorizes the Bank, whenever it deems necessary, to:

a) Use the necessary technical equipment to ensure the auditability of the system and manage it effectively, including aspects related to security;

b) Use computer equipment to record on digital media any data transmissions maintained between the Participant and the Bank.

Annex to Instruction No. 16/2023 BO No. 6/2023 3rd Supplement • 2023/07/11
Themes Information Systems :: Communication Systems
..................................................................................................................................................................................................

8th

1. If the Participant detects any anomaly in the operation of the equipment or system, it must immediately notify the Bank, and the Bank is hereby authorized, from that moment, and until such situations are repaired, to block and prevent any electronic communications through BPnet.

2. The same authorization is hereby granted to the Bank, if it detects any anomaly in the operation of the equipment or system.

9th

1. All conflicts arising from this contract shall be decided, in a single instance, by an arbitral tribunal composed of one member appointed by the Bank, another by the Participant, and another chosen, by mutual agreement, by these two arbitrators.

2. The arbitral tribunal has its seat in Lisbon, applies Portuguese Law and is governed by the provisions of Law No. 63/2011, of 14 December, including the provisions of paragraph 3 of Article 4 of this legal diploma.

This contract was made in duplicate, with one copy intended for each of the parties.

Lisbon, of of 20

Banco de Portugal
The Participant
By Delegation
(Name)
(Name)
(Function)
(Function)
(Name)
(Name)
(Function)
(Function)

Annex IA - Designation of Contacts

Participant Identification
Designation
NIPC/VAT Number/Company Number
IF Code	Acronym
Address	Locality
Postal Code	Country
E-mail	Telephone

Identification of Contacts
Contact 1
Name
Department/Service	Function
Telephone	Extension
E-mail
The e-mail address referenced is
Single and not shared at the Institution	Shared by several users
If the email is shared, indicate an alternative email that is not shared. It may be created and managed on platforms external to the Institution, but only the BPnet user should have access to it.
Individual email
Are you already a BPnet user?	No
	Yes Assigned User

Contact 2
Name
Department/Service	Role
Telephone	Extension
Email
The email address referenced is
Single and not shared at the Institution	Shared by several users
If the email is shared, indicate an alternative email that is not shared. It may be created and managed on platforms external to the Institution, but only the BPnet user should have access to it.
Individual email
Are you already a BPnet user?	No
	Yes Assigned User

Annex to Instruction no. 16/2023 BO no. 6/2023 3rd Supplement • 2023/07/11
Themes Information Systems :: Communication Systems
..................................................................................................................................................................................................

Contact 3

Name
Department/Service
Role
Telephone
Extension
Email

The email address referenced is

Single and not shared at the Institution

Shared by several users

If the email is shared, indicate an alternative email that is not shared. It may be created and managed on platforms external to the Institution, but only the BPnet user should have access to it.

Individual email

Are you already a BPnet user?
No
Yes
Assigned User

Billing Data

Address to which billing should be sent
Locality
Postal Code
Country
Recipient
Business Area
Email

Technical Contact

Name
Telephone
Email

This document must be completed electronically and signed by the Participant.

The Participant
(Name)
(Name)
(Role)
(Role)

Annex IB – Identification of the Connection Modality

Participant Designation

Types of Connections	Selected Option(s)
Primary Connection (1st)/Primary Connection (1st)
LD - Dedicated Connection
4 Mbps
10 Mbps
100 Mbps
Dedicated Connection via another entity of the Group
Designation of the entity holding the connection to be shared
LVPN - VPN Connection
Internet, public and fixed IP
Address/Address (Ex.196.111.111.111)
VPN Connection via another entity of the Group
Designation of the entity holding the connection to be shared
LND - Non-Dedicated Connection
Internet, public and fixed IP
Address/Address (Ex.196.111.111.111)
Secondary Connection (Optional) / Secondary Connection (Optional)
Secondary Connections (Adds costs to the 1st connection, if applicable) Secondary connections (Cost to be added to the 1st connection if applied)
2nd LD - Secondary Dedicated Connection
In Hot Standby (at the same site) or Disaster Recovery (different site)
4 Mbps
10 Mbps
100 Mbps
2nd LVPN - Secondary VPN Connection
Internet, public and fixed IP
Address/ Address (Ex.196.111.111.111)
2nd LND - Secondary Non-Dedicated Connection
Internet, public and fixed IP
Address/ Address (Ex.196.111.111.111)

..................................................................................................................................................................................................

This document must be completed electronically and signed by the Participant.

The Participant
(Name)
(Role)
(Name)
(Role)

..................................................................................................................................................................................................

Annex IC – Direct Debit Authorization

Authorization reference (ADD) to be completed by the Creditor Mandate reference – to be completed by the creditor.

By subscribing to this authorization, you are authorizing Banco de Portugal to send instructions to your Bank to debit your account and your Bank to debit your account, in accordance with the instructions of Banco de Portugal. Your rights include the possibility of demanding from your Bank a refund of the debited amount, under the terms and conditions agreed with your Bank. The refund must be requested within a period of eight weeks, counting from the date of the debit on your account. Your rights are explained in a statement that you can obtain from your Bank. Please fill in all fields marked with *. The completion of the fields marked with ** is the responsibility of the Creditor.

By signing this mandate form, you authorise the Banco de Portugal to send instructions to your bank to debit your account and your bank to debit your account in accordance with the instructions from Banco de Portugal. As part of your rights, you are entitled to a refund from your bank under the terms and conditions of your agreement with your bank. A refund must be claimed within 8 weeks starting from the date on which your account was debited.

Debtor identification (Debtor identification) *
Name of the debtor(s) / Name of the debtor(s)
Street and number / Street name and number
Postal code / Postal code	- City / City
Country/Country	NIPC/VAT/Company	BIC SWIFT/SWIFT BIC
Account number – IBAN / Account number – IBAN

Proof of IBAN must be presented for invoicing purposes. Proof of IBAN must be presented for billing purposes.

Creditor identification (Creditor identification) **
Creditor Name / Creditor Name	Banco de Portugal
Creditor identifier / Creditor identifier	PT37ZZZ111688
Rua e número / Street name and number	Rua do Comércio, 148
Postal code / Postal code	1100 - 150	Cidade / City	LISBOA	País / Country	PORTUGAL

Pagamento (Payment) *
Type of payment / Type of payment	Recurrent / Recurrent payment	Ou / Or Pontual / One-off payment

Local de assinatura / City or town in which you are signing Data / Date

Your rights regarding the above mandate are explained in a statement that you can obtain from your bank. / Your rights regarding the above mandate are explained in a statement that you can obtain from your bank.

Assinatura(s) / Signature(s)

..................................................................................................................................................................................................

Informação detalhada subjacente à relação entre o Credor e o Devedor – apenas para efeitos informativos Details regarding the underlying relationship between the Creditor and the Debtor – for information purposes only.

Name of the person on whose behalf payment is made / Person on whose behalf payment is made

Name of the Debtor Reference Party: if you make a payment under an agreement between Banco de Portugal and another person (e.g. when you are settling an invoice from a third entity), please write here the name of the other person. Name of the Debtor Reference Party: If you are making a payment in respect of an arrangement between Banco de Portugal and another person (e.g. where you are paying the other person’s bill) please write the other person’s name here.

Identification code of the Debtor Reference Party / Identification code of the Debtor Reference Party

Relativamente ao Contrato / In respect of the contract

Identification number of the underlying contract

Description of contract BPnet Contract

Annex to Instruction n.o 16/2023 BO n.o 6/2023 3rd Supplement • 2023/07/11
Topics Information Systems :: Communication Systems
..................................................................................................................................................................................................

Annex ID- Notice of Termination of the Participation Contract in BPnet

NOTICE OF TERMINATION OF THE PARTICIPATION CONTRACT IN BPNET

, legal entity no. , with registered office at , represented by and , in the capacity of , hereby declares, for the purposes of and in accordance with Article 10.º of Instruction no. 16/2023, that it intends to terminate the BPnet Participation Agreement entered into on with Banco de Portugal.

This termination shall take effect from the day of 20 , thereby complying with the minimum thirty-day advance notice period prior to the date of this communication.

Note: should the request to terminate the Participation Agreement be received with less than thirty days' notice prior to the respective effective date proposed by the Participant, the termination shall only take effect, notably for invoicing purposes, at the end of the said thirty-day period.

Lisbon, of of 20

This document must be completed electronically and signed by the Participant.

The Participant
(Name)
(Name)
(Function)
(Function)

Annex to Instruction no. 16/2023 BO no. 6/2023 3rd Supplement • 2023/07/11
Topics Information Systems :: Communication Systems
..................................................................................................................................................................................................

Annex II – System Description

WHAT IS THE BPnet SYSTEM?

BPnet is a secure electronic communication system whose objective is to interconnect Banco de Portugal with other entities, within the scope of their respective legal attributions.

This system aims to provide a set of services of common interest or that constitute a responsibility for the parties.

SYSTEM PURPOSE

The BPnet system comprises:

A secure network for interconnection between Banco de Portugal and the Adhering Institutions, designated as Participants.
A central access point to informational content and services made available through this network – the BPnet Portal.
Specific users, appointed by the Participants, and designated as Interlocutors, to whom responsibility is assigned for the electronic subscription and modification of users and their respective access profiles.
A Webmail service for users, contextualized to the subscribed services.
File Transfer facilities, for the electronic transfer of data and files, in the context of specific business areas.
Mechanisms for the implementation of solutions based on application-to-application communication.
Customer support services.
Technical Support Service, with the capacity for online recording and monitoring of incidents.
Notification mechanisms framed within the subscribed services.
Security and procedure manuals for the various services.

AVAILABILITY CONDITIONS

The set of infrastructural means and functionalities integrated into the BPnet system will be available under the following conditions and forms:

1. Network Infrastructure

Access to BPnet may be made through the following modalities:

Dedicated Connection, available only on national territory, through a private network with dedicated circuits contracted from an operator and with access from 4Mbps.

This modality implements a dedicated and encrypted circuit between the Participant and Banco de Portugal.

In this modality, two pieces of equipment are installed at the Participant's premises, one from Banco de Portugal and the other from the contracted operator.

These pieces of equipment are supplied by Banco de Portugal, which retains ownership of them, as well as responsibility for their management and administration in partnership with the contracted operator.

VPN Connection, through an IPSEC Tunnel (VPN).

In this modality, an encrypted (IPSEC) connection is established via the Internet between the Participant and Banco de Portugal.

This connection requires the Participant to have a fixed, non-shared IP address for Internet access and the necessary technical means to establish an IPSEC connection with Banco de Portugal.

As this means of communication is via the Internet, it is subject to its limitations.

Non-Dedicated Connection, via the Internet. In this modality, the connection is established by the user at the Participant from their systems or their workstations. This solution requires the use of a fixed, non-shared IP address for Internet access by the Participant. As this means of communication is via the Internet, it is subject to its limitations.
Connection Via another entity of the group In this option, the Participant accesses BPnet through an existing Dedicated Connection or VPN Connection, which has been previously contracted by an entity of the same group. Participants are responsible for ensuring the internal configurations necessary for sharing the BPnet access connection. Only Participants belonging to the same group are eligible for this connection (see requirements).

High availability – It is possible to implement high-availability solutions by contracting additional secondary Connections.

Notes: Participants must coordinate with Banco de Portugal regarding changes related to IP and/or Operator changes, failing which they will be unable to access the Portal.

2. Portal

Access to the Portal is made at the following address: www.bportugal.net

The recommended browsers are Microsoft Edge, with IE mode enabled, or Google Chrome.

3. Subscription and Modification of Users

Allows Participants the autonomy to subscribe and modify users and their respective access profiles electronically.
This functionality, accessible via the portal, will be made available to specific users, designated as Interlocutors, appointed by the Participants to represent them in the context of their interaction with BPnet.

4. Webmail

A user's Webmail service comprises:

The facility for receiving messages from subscribed services.
The facility for sending messages to subscribed services.
Message receipt notification facilities.
The size of mailboxes and messages is limited in accordance with the values previously defined.

5. File Transfer

The File Transfer functionalities are available in the context of the specific needs of each service, presented in two modalities:

Interactive File Transfer - Download / Upload via portal.
Automatic File Transfer

o Based on the FTP (File Transfer Protocol) protocol

o Based on Webservices

Access to the File Transfer service, in the Automatic File Transfer modality - outside the portal, requires an FTP client or an FTP Server.

6. Application-to-Application Communication

These solutions will be the subject of bilateral agreements between Banco de Portugal and the Participants of the BPnet system, aiming at their implementation in the application systems where this type of solution is advisable.
In these cases, it is necessary for both parties to develop their respective application components that implement the protocol defined for the respective system.

TECHNICAL SUPPORT SERVICE

Service covering the reporting and monitoring of problems within the scope of BPnet.

Made available for reporting in the following modalities:

1. Online Incident Registration – based on opening an Occurrence in the BPnet Portal and monitored through the assigned ticket.

Hours: 24h x 7d

2. Offline Incident Registration

Hours: 24h x 7d
Telephone: 213 130 160 e-mail: apoio.BPnet@bportugal.pt

Technical Support operates for problem monitoring on business days from 8:00h to 20:00h.

Incidents registered outside support hours will be processed on the immediately following business day.

CUSTOMER SUPPORT SERVICE

Service that supports general matters – Banco de Portugal Telephone Call Centre:

Hours: Business days from 8:30h to 18:00h
Telephone: 213 130 000

Service that supports contractual management and joining and termination processes – Customer Service Coordination:

e-mail: bpnet@bportugal.pt

Annex to Instruction n.o 16/2023 BO n.o 6/2023 3.º Suplemento • 2023/07/11
Topics Information Systems :: Communication Systems
..................................................................................................................................................................................................

INFRASTRUCTURE AVAILABILITY AND RESPONSIBILITIES

Hours 24h x 7 days; a scheduled shutdown is planned each quarter for maintenance.

General description

The BPnet infrastructure is available, under normal operating conditions, during the indicated hours.
In the event of a failure in the communications circuit, and if there is no connection backup, the recovery time depends on the operator.
The maintenance activities to be carried out will be duly scheduled and disclosed to the Participants.
Banco de Portugal does not guarantee the resolution of incidents outside support hours.

Responsibilities

Banco de
Portugal

It is Banco de Portugal's objective to ensure the operability of the service during the indicated hours.
Banco de Portugal is responsible, in the event of an incident or problem, for:

o Within technical support hours, immediately proceeding with the diagnosis and notifying the Participants of the unavailability time required for problem resolution;

o Outside support hours, proceeding with the diagnosis and notification of the Participants in the next active support period.
Banco de Portugal undertakes to make available and keep updated the technical manuals it deems necessary for the proper functioning of BPnet.

Participant

The entities adhering to BPnet, as well as all users designated on their behalf, accept the responsibilities inherent to the described service conditions and to compliance with the rules defined in the technical manuals made available by Banco de Portugal within the scope of the BPnet service.

PROCESS AND CONDITIONS FOR ACCESSION AND TERMINATION OF THE PORTAL

The preferred means for handling these matters will be the email address bpnet@bportugal.pt.

Accession Process

The entity requests accession by filling in the information requested in the Instruction.
Once the request is accepted, the entity acquires the status of Participant, and Banco de Portugal assigns:

o A user identifier and the respective access password for each Interlocutor designated by the entity, as well as the respective Webmail addresses.

o Access to the User Profile Management service for each designated Interlocutor. From this service, Interlocutors may submit requests for registration, alteration or cancellation of users or services that are part of each one's individual profile. They may also consult the profiles of the various users of the Participant as well as the subscribed services.
If a Dedicated connection is requested, Banco de Portugal will request the Communications Operator to install a dedicated circuit with the characteristics defined in the accession process. After the circuit is made available, Banco de Portugal will

proceed with the installation of the equipment at the Participant's premises, thereby formalizing the beginning of the BPnet accession contract for billing purposes.

For a VPN connection, Banco de Portugal will provide the Participant with the technical specifications for establishing the IPSEC Tunnel with Banco de Portugal, and authorize the public IP address, which must be fixed and not shared, indicated by the Participant at the time of accession, thereby formalizing the beginning of the BPnet Accession Contract for billing purposes.
In a Non-Dedicated connection, Banco de Portugal will authorize access to the BPnet portal from the public IP address, which must be fixed and not shared, indicated by the Participant at the time of accession, thereby formalizing the beginning of the BPnet Accession Contract for billing purposes.
In a connection Via another entity of the Group, no additional configurations are made by Banco de Portugal, and it is up to the Participant to ensure connectivity through the connection to be shared.

Accession Conditions

Sharing of Dedicated Connections or VPN Connections: For entities in a controlling or group relationship, it is possible to share the BPnet infrastructure. Nevertheless, each entity must apply for BPnet membership, using the forms already indicated above. In the corresponding form, it must state that it will use the infrastructure already subscribed to by another entity of the same Group. In this case, Banco de Portugal will require proof of acceptance from the respective Participant holding the dedicated BPnet connection.
Responsibilities: The Participant joining the infrastructure is responsible for its proper use as well as for all aspects relating to the payment of the charges associated with it, regardless of whether or not it shares it with other Participants with which it has controlling or group relationships.
Representative: A Participant mandated by another Participant to act on its behalf in the context of the exchange of information with Banco de Portugal through the BPnet system.

Conditions for Representation to occur:

o The entities are demonstrably in a controlling or group relationship.

o The Participants have at least one Interlocutor in common.

o Subscription in representation is only possible for services previously subscribed to by the originating Participant and that are configured to allow representation.

o A user is considered to be acting in representation when they carry out activity at another entity.

o The point of union of representation between Participants are the Interlocutors.

o It is optional for Participants under these conditions.

The charges for access to and use of BPnet are described in documents on the Portal and in the initial presentation documents.

Index

Text of the Instruction

Article 1 Definitions

Article 2 Object and scope of application

Article 3. Participants

Article 4. Conditions for participation in the BPnet system

Article 5. BPnet Interlocutors

Article 6. Conditions for adhesion and provision of services

Article 7.º Price List

Article 8.º Security of electronic communications

Article 9.º Proof of electronic communications

Article 10.º Termination of the Participation Agreement in the BPnet system

Article 11. Final provision

Annex I – Standard Agreement

1st

2nd

3rd

4th

5th

6th

7th

8th

9th

Annex IA - Designation of Contacts

Contact 3

Billing Data

Technical Contact

Annex IB – Identification of the Connection Modality

Annex IC – Direct Debit Authorization

Informação detalhada subjacente à relação entre o Credor e o Devedor – apenas para efeitos informativos Details regarding the underlying relationship between the Creditor and the Debtor – for information purposes only.

Annex ID- Notice of Termination of the Participation Contract in BPnet

NOTICE OF TERMINATION OF THE PARTICIPATION CONTRACT IN BPNET

Annex II – System Description

WHAT IS THE BPnet SYSTEM?

SYSTEM PURPOSE

AVAILABILITY CONDITIONS

1. Network Infrastructure

2. Portal

3. Subscription and Modification of Users

4. Webmail

5. File Transfer

6. Application-to-Application Communication

TECHNICAL SUPPORT SERVICE

CUSTOMER SUPPORT SERVICE

INFRASTRUCTURE AVAILABILITY AND RESPONSIBILITIES

PROCESS AND CONDITIONS FOR ACCESSION AND TERMINATION OF THE PORTAL

Accession Conditions

Lineage: No known changes