Royal Decree-Law 19/2018 of 23 November on Payment Services and Other Urgent Financial Measures

OFFICIAL STATE GAZETTE
No. 284 Saturday, November 24, 2018 Sec. I. Page 114474
I. GENERAL PROVISIONS
THE HEAD OF STATE
16036 Royal Decree-Law 19/2018, of November 23, on payment services and other urgent measures in financial matters.
I
The existence of an adequate payment services market constitutes a basic requirement in the construction of an efficient single market within the European Union. To this end, the regulation of payment services must promote, in particular, an environment that fosters the agile development of payment transactions, common rules regarding their operation, a sufficiently broad range of payment options for users, and effective protection rules for users of payment services. Security and homogeneity in payment processes are key pieces in improving the efficiency and reducing the costs of these processes, both at the national level and for payments made between Member States. Law 16/2009, of November 13, on payment services, laid the foundations to establish common bases in the regulation of the provision of payment services within our legal system, transposing the content of Directive 2007/64/EC of the European Parliament and of the Council of November 13, 2007, on payment services in the internal market, amending Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC. In addition to establishing a homogeneous protection framework for users of payment services, said law considerably facilitated the operational application of payment instruments in euros within the Single Euro Payments Area (SEPA). With the Single Euro Payments Area consolidated, it is necessary to advance in adapting the regulation to new technological changes that allow users to have more reliable access to new payment services and new agents that are being implemented increasingly intensely, especially in the context of a market broader than the national one. The leveraging of innovations produced in recent years and the need to generate a safer and more reliable environment for their development are at the base of the approval of the new Directive (EU) 2015/2366 of the European Parliament and of the Council of November 25, 2015, on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010 and repealing Directive 2007/64/EC, in substitution of the 2007 Directive, which, together with Regulation (EU) 2015/751 of the European Parliament and of the Council of April 29, 2015, on interchange fees applicable to card-based payment transactions, form the assembly pieces of the new regulatory framework for payment services. This new European framework, which this royal decree-law partially incorporates into our legal system, has as its main objectives to facilitate and improve security in the use of internet payment systems, reinforce the level of user protection against fraud and potential abuses, compared to that provided in Law 16/2009, of November 13, as well as to promote innovation in payment services via mobile and internet. This new framework is characterized by aspects born from experience in the application of the previous one, in each of the three basic aspects it regulates:
the services to be provided, transparency towards the user, and the obligations of the parties involved. II This royal decree-law is structured on the basis of a scheme very similar to that of the Directive it mainly transposes, an option that, in addition to improving the degree of harmonization and homogeneity with the common European framework, facilitates systematicity in the interpretation of the entire normative set. Thus, the royal decree-law is structured in five titles, with a total of 72 articles, three additional provisions, nine transitional provisions, one repealing provision, and thirteen final provisions. The preliminary title contains the general provisions regulating the main aspects of the legal text. From an objective point of view, the scope of application concerning payment services is delimited. Among the payment services regulated by this royal decree-law, two new ones are included: payment initiation and account information. Both services involve third-party access to users' payment accounts. Payment initiation services allow their provider to give the beneficiary of the payment order the assurance that the payment has been initiated. The purpose of this operation is to incentivize the beneficiary to deliver the good or provide the service without delay from the moment the payment order is given. Such services offer a solution to both merchants and users of payment services and guarantee the possibility of making online purchases even when they do not possess payment cards. Account information services provide the user of the payment service with aggregated online information about one or more payment accounts held with their payment service providers, allowing the user of the payment service to have at all times global and immediate information about their financial situation. Neither of these two services has been subject to specific regulation in the Spanish legal system until now. In a context of growing supply, this circumstance has raised certain legal uncertainty in such relevant aspects as the protection of users of payment services, the security parameters with which these services are provided, as well as liability, competition, and the data protection regime. On the other hand, from the point of view of the objective scope of application, the principle is maintained that the royal decree-law applies to all services provided on Spanish territory, regardless of the origin or final destination of the operations. Therefore, a single system is established for providers subject to Spanish law, without affecting operations that take place solely within the territory of other Member States of the European Union. The royal decree-law establishes an authorization system for access to the provision of payment services, in accordance with what is established in Directive (EU) 2015/2366 of the European Parliament and of the Council of November 25, 2015, as Directive 2007/64/EC already did. Both norms consider it necessary to
establish a prudential regime through which a single license is introduced for certain payment service providers not linked to the acceptance of deposits or the issuance of electronic money. Such authorization is subject to a series of strict and exhaustive requirements, uniform throughout the European Union. Furthermore, the protection provided for consumers is extended to micro-enterprises regarding the transparency of conditions and information requirements applicable to payment services, resolution and modification of the framework contract, and rights and obligations regarding the provision and use of payment services. However, micro-enterprises are exempted from the application of the right to order the refund of direct debits as a result of an authorized payment transaction initiated by a beneficiary or through the same, for a period of eight weeks counted from the date of debit of the funds in their account. The reason is that attributing such a right to micro-enterprises would distort the management system of direct debits, causing micro-enterprises harm derived from the credit risk that payment service providers would have to assume during that period. Regarding Title I, which establishes the general lines of the authorization regime for payment institutions, the most relevant novelty lies in the fact that competencies related to its processing and granting, which until this moment were held by the Ministry of Economy and Enterprise, are transferred to the Bank of Spain. The Bank of Spain, which previously had to issue a mandatory report within said procedure, now assumes the ultimate responsibility of granting the corresponding authorization. Quite frequently, payment service providers benefiting from an exclusion from the scope of application of Law 16/2009, of November 13, did not consult the competent authorities to determine if their activities were included or excluded from the scope of application of said law, but relied on their own analyses. This resulted in enormous disparities in the application of certain exclusions, also among the different Member States of the European Union. To avoid problems derived from this, this royal decree-law obliges notification to the Bank of Spain of payment services provided under the exclusions set out in Article 4(k), subparagraphs 1 and 2, and (l), so that it can evaluate whether the requirements established to be excluded from the application of the royal decree-law are met and guarantee, in this way, a homogeneous interpretation. In Title II, the transparency system regarding conditions and information requirements applicable to said services is generally maintained for all payment services, always giving a notable margin to contractual freedom. In Title III, the rights and obligations of providers and users regarding payment services are established. The most relevant change introduced in this title derives from the regulation of payment initiation services and account information
services, particularly regarding the delimitation of responsibilities derived from the use of both services. Additionally, a new chapter is introduced regulating the operational and security risks of payment service providers. Title IV collects the sanctioning regime applicable to payment service providers, which is integrated into the corresponding regime of Law 10/2014, of June 26, on the regulation, supervision, and solvency of credit institutions, through the sixth final provision. As for the first to third additional provisions, they maintain the regime applicable to debits or credits corresponding to operations other than payments, that regarding cash withdrawals at ATMs, and the faculties of the Bank of Spain as the competent authority to determine the information that payment service providers must submit to it. The first to ninth transitional provisions seek the adaptation of payment institutions and electronic money institutions to the new regulation contained in Title I, and in particular of those companies that had been providing payment initiation and account information services. The first final provision updates the list of payment and securities settlement systems following the integration of the Spanish community into the pan-European TARGET2-Securities platform. The second final provision modifies Law 35/2003, of November 4, on Collective Investment Institutions, to adapt our legal system to Regulation (EU) No 2017/1131 of the European Parliament and of the Council of June 14, 2017, on money market funds, which establishes a harmonized regulation for this type of investment funds and imposes on Member States the obligation to establish a sanctioning regime. Since July 21, 2018, said Regulation has been applicable; therefore, the sanctioning regime for non-compliance with said European norm is included in Law 35/2003, of November 4, on Collective Investment Institutions, with a view to establishing the infringing types that reflect the non-compliance with the obligations of the Regulation. The third final provision adapts the regulation on the distance marketing of financial services to the requirements of Directive (EU) 2015/2366 of the European Parliament and of the Council of November 25, 2015. The fourth final provision modifies the Capital Companies Law by adding a new circumstance in which shareholder separation is not possible due to lack of dividend distribution, for the case of partners of credit institutions and other financial entities that are not listed companies subject to Regulation (EU) No 575/2013 of the European Parliament and of the Council of June 26, 2013, on prudential requirements for credit institutions and investment firms, and amending Regulation (EU) No 648/2012. The fifth final provision modifies the regulation on electronic money entities in the sense established by Directive (EU) 2015/2366 of the European Parliament and of the Council of November 25, 2015. The sixth final provision modifies the
sanctioning regime of Law 10/2014, of June 26, on the regulation, supervision, and solvency of credit institutions, to adapt it to the activity of providing payment services and complete the adaptation of the regulation to Directive 2013/36/EU of the European Parliament and of the Council of June 26, 2013, on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC, and to homologate the Spanish sanctioning regime with that of other Member States and the European Central Bank. Particularly notable is the enabling of an adequate channel so that any person who has knowledge or well-founded suspicion of non-compliance with the obligations in matters of prudential supervision of credit institutions provided for in said law and its development regulation has the possibility and right to communicate it to the Bank of Spain with due guarantees (also known as whistleblowing). This same final provision also makes adjustments in matters of supervision and sanctioning of credit institutions and investment firms, which guarantee a better transposition of said Directive 2013/36/EU of the European Parliament and of the Council of June 26, 2013. Specifically, it aims to clarify that all activity centers established on Spanish territory by European credit institutions whose central administration is in another Member State will be considered a single branch, and to ensure adequate information exchange between the Bank of Spain and other competent authorities of the European Union, in the case of Spanish entities controlled by a Union parent entity. The seventh final provision modifies Law 5/2015, of April 27, on the promotion of business financing, to attribute to the Bank of Spain the authorization of hybrid credit financial establishments. To the extent that Hybrid Credit Financial Establishments provide payment services, this modification is coherent with the fact that competencies in the authorization of payment institutions are attributed to the Bank of Spain in this royal decree-law. The eighth final provision modifies Law 11/2015, of June 18, on the recovery and resolution of credit institutions and investment firms, regarding the definition of branches in Spain of entities subject to said law. This modification aims to correctly transpose what is provided for branches of entities established outside the European Union in Directive 2014/59/EU of the European Parliament and of the Council of May 15, 2014, establishing a framework for the restructuring and resolution of credit institutions and investment firms, and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012. In this sense, the modification of Article 53 is also necessary to clarify that the FROB (Fund
de Reestructuración Ordenada Bancaria) may collect contributions from branches in Spain of entities established outside the European Union. Likewise, this final provision contains provisions to clarify the faculties of the FROB as the executive resolution authority when carrying out a resolution, with respect to the limitations and requirements required in corporate law, in accordance with Directive 2014/59/EU of the European Parliament and of the Council of May 15, 2014. The ninth final provision modifies the consolidated text of the Securities Market Law, approved by Royal Legislative Decree 4/2015, of October 23. The objectives pursued with this modification are the following: first, a formal and technical adaptation of some of its provisions is carried out. Second, the norm is adapted to various recent European regulations whose entry into force and effective application has already occurred, specifically:
– Regulation (EU) No 2016/1011 of the European Parliament and of the Council of June 8, 2016, on indices used as reference in financial instruments and financial contracts or to measure the profitability of investment funds, and amending Directives 2008/48/EC and 2014/17/EU and Regulation (EU) No 596/2014; – Regulation (EU) No 596/2014 of the European Parliament and of the Council of April 16, 2014, on market abuse and repealing Directive 2003/6/EC of the European Parliament and of the Council, and Directives 2003/124/EC, 2003/125/EC and 2004/72/EC of the Commission; – Regulation (EU) No 1286/2014 of the European Parliament and of the Council of November 26, 2014, on key information documents for packaged retail and insurance-based investment products; and – Regulation (EU) No 2015/2365 of the European Parliament and of the Council of November 25, 2015, on the transparency of securities financing transactions and of the reuse and amending Regulation (EU) No 648/2012. Third, the transposition of two partially transposed Directives is completed. On the one hand, Commission Implementing Directive (EU) 2015/2392 of December 17, 2015, on Regulation (EU) No 596/2014 of the European Parliament and of the Council as regards reporting of possible or actual infringements of said Regulation to competent authorities; and Directive 2013/36/EU of the European Parliament and of the Council of June 26, 2013, on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC. In this way, the normative framework governing the regulation applicable to securities markets is fully adapted to current European law, ensuring that the National Securities Market Commission (CNMV) has all the necessary supervision instruments to guarantee the proper functioning of said markets and the adequate protection of the investor. The tenth to thirteenth final provisions collect the competence titles, the declaration of incorporation of European Union Law, the enabling for regulatory development, and the entry into force. III Circumstances of extraordinary and urgent necessity concur in this case that justify the approval of this norm as a royal decree-law. First, it is urgent to complete the transposition of Directive (EU) 2015/2366 of the European Parliament and of the Council of November 25, 2015, given that the transposition deadline has not only expired, but the European Commission has sent a letter of formal notice for infringement due to lack of transposition to the Kingdom of Spain. But, in addition, it is urgent to complete the transposition of Directive (EU) 2015/2366 to avoid serious harm to Spanish credit institutions and payment institutions, as well as to users of payment services. The regulatory uncertainty to which these companies are subjected due to the lack of timely transposition produces an important cost and uncertainty
that affects their competitiveness in European markets, uncertainty that is not dissipated through the so-called direct effect of Directives. Likewise, the lack of timely transposition of said Directive is affecting the capacity to attract the Spanish market as a market where new payment service providers from other countries can establish themselves. In a context of growing mobility of these companies, many of which are currently considering relocating their registered office to other Member States of the European Union, the existence of a certain and stable regulatory framework becomes an absolutely essential condition that determines their investment decisions. The lack of transposition also concurs in relation to Commission Implementing Directive (EU) 2015/2392 of December 17, 2015, on Regulation (EU) No 596/2014 of the European Parliament and of the Council as regards reporting of possible or actual infringements of said Regulation to competent authorities, since the European Commission has sent a letter of formal notice for infringement to the Kingdom of Spain for lack of transposition and even an infringement procedure has been processed before the Court of Justice of the European Union. It is also urgent to modify Law 10/2014, of June 26, on the regulation, supervision, and solvency of credit institutions, first to complete the transposition of Directive 2013/36/EU, to the extent that the European Commission has suspended the execution of the infringement action conditioned on the urgent approval of this modification. It is also necessary to undertake these modifications promptly to guarantee the level of effectiveness and homogeneity with the regulation of other Member States of the European Union projected by the Directive. Precisely, this last aspect responds also to the adjustment of the sanctioning regime that is carried out, which also emanates from said Directive 2013/36/EU, and which is homologated...