Consultations

EMA response to FCA Guidance consultation on outsourcing to the cloud

Read about FCA’s consultation here.

The EMA responded to the FCA’s recent consultation on the use of cloud IT service providers This is of significant interest for many Fintechs and innovative PSPs who rely on such outsourcers to deliver many important functions. The FCA draft guidance in a number of areas (i.e. Legal and regulatory considerations, Effective access to Systems Data, Access to business premises) will likely have a significant impact on existing outsourcerrelationships. Based on the current draft, it is likely that many existing service contracts would have to be re-negotiated and possibly terminated with the financial service providers bearing additional costs and corresponding impact on existing operations.

The EMA’s response calls on the FCA to take into account current technology trends and market dynamics when drafting the Final Guidance on this topic. Currently, many regulated firms have limited negotiating leverage to introduce any changes to the standard service delivery agreements offered by the large, reputable cloud IT service providers.

The EMA’s response suggests that instead the Guidance focus on:
(1) additional criteria for a regulated firm to consider when establishing a cloud-service outsourcer due diligence process, and
(2) setting up a robust service review & monitoring framework; for example ensuring a service provided by a cloud-based outsourcer meets agreed key performance indicators (“KPIs”).

Read the EMA response here.

The EMA has responded to the EBA’s discussion paper on strong customer authentication and secure communication under PSD2. This discussion paper asks for views from stakeholders regarding a number of topics that the EBA proposes to address in the regulatory technical standards it will develop to support compliance with the PSD2 security requirements (including the practicalities around strong customer authentication, dynamic linking of customer authentication with individual transaction information and secure intra-PSP communication).

The EMA’s response:
– raises concerns regarding the minimum 10-month time gap between the time PSD2 comes into force and the earliest date that the EBA RTS may be implemented;
– calls for a risk- and principles-based approach rather than delving into prescriptive detail or producing exhaustive lists of security controls/transaction types;
– expresses concern about the negative consequences of an EU standard that is overly prescriptive or diverges significantly from global standards, as many EMA members operate outside the EU;
– calls for the definition of a governance framework (used to assess compliance of individual solutions/products) with the RTS.

The EMA response also requests:
– further clarification around the category of payment activities that might benefit from the ‘risk-based’ exemption frjaneom the requirement to complete strong customer authentication (SCA): Many online account access interactions (i) do not expose sensitive payment data or payment user credentials and (ii) cannot be used to alter existing account settings; thus, they do not give rise to payment fraud risks.
– a flexible approach with regards to the requirements to ‘dynamically link’ each payment with information about the payee and payment amount, as this will introduce significant friction to the user experience with little benefit in terms of security of payment transaction.

Read the EMA response here.

EMA response to HMRC on Extension of data-gathering powers

Read about HMRC’s consultation here.

The EMA has responded to HMRC’s consultation on draft legislation intended to tackle the ‘hidden economy’ of tax avoidance by extending their powers to gather bulk data on transactions by customers of electronic PSPs and business intermediaries. This would give HMRC the legal power to require electronic PSPs (ePSPs) and business intermediaries to report bulk transaction data on their customers on a regular (annual, quarterly or potentially monthly) basis.

The EMA has two main concerns in relation to the draft legislation. Firstly, whilst the intention is only to capture income received in the course of business, the current legal drafting would not preclude HMRC from requesting bulk data related to certain consumer accounts as well as business accounts. Secondly, there is no intention of collecting equivalent data from other PSPs, such as banks. We believe that not only would this have a negative impact on consumer trust in relation to ePSP accounts by raising data privacy concerns, it would place ePSPs at a disadvantage to other PSPs such as banks, who would not be required to provide equivalent information.

On that basis, the EMA’s response proposes amendments to the legislation in several areas:
1. A narrowing of the defintion of electronic PSP
2. A narrowing of the types of payment transactions that can be captured
3. A narrowing of the type of payment recipient whose transaction data can be captured
4. A clarification that merchant acquirers should be excluded, as they are already covered under existing powers.

Read the EMA response here.

Read about the European Supervisory Authorities’ Joint consultation here.

The EMA has responded to the European Supervisory Authorities’ Joint consultation on risk factors and simplified and enhanced customer due diligence as under 4MLD. The EMA welcomed the format of the draft guidance, which set out an initial section with generic guidance followed by sector-specific guidance.

The response highlights a number of points:

– the guidance around the treatment of Politically Exposed Persons (PEPs) is overly complex, and risks excluding PEPs from financial services as the cost of maintaining their accounts may outweigh any commercial benefit for providers.
– the guidance for around correspondent banking relationships could lead to the conclusion that banks have to take steps to “know their customer’s customer”, which will exacerbate de-risking, a phenomenon that has had a negative impact on the e-money and money service business sectors in recent years
– several detailed comments around risk factors that indicate higher or lower risk in the e-money sector.

Read the EMA response here.

The Electronic Money Association (EMA) has responded to the Cabinet Office’s review of the impact on business of the current anti-money laundering (AML) and counter terrorist financing (CTF) regime, as e-money and other small value retail payment products are disproportionately impacted by some AML and CTF obligations.

Read the EMA response here.

The EMA has responded to the Irish Department of Finance’s consultation on the implementation of the Payment Accounts Directive (PAD). The EMA supports the aims of the Directive: to improve transparency around fees, facilitate switching between accounts, and ensure access to basic bank accounts. Similar to the response to HMT, the EMA expressed concern about the lack of clarity around the scope of the Directive, and proposed that the scope be more clearly defined. If not, it could bring a wide variety of e-money accounts into the scope unnecessarily, such as prepaid cards or online wallets, which are generally considerably different from bank current accounts in terms of consumer usage and purpose. Read the EMA response.

The Electronic Money Association (EMA) has responded to the FCA’s Call for input on the regulatory barriers to innovation, as EMA members have long had to grapple with regulatory features that prevent them either from developing a viable business model, or from growing beyond a certain size.

In this response, the EMA has focused mainly on EU regulation, as it has the greatest impact on our members, many of whom are authorized in the UK or Gibraltar and passport into other EU member states under the Freedom to Provide Services.

Read EMA response to FCA call for input on regulatory barriers to innovation.

On 27 July, HM Treasury published a consultation on the application of the Interchange Fee Regulation in the UK, asking for feedback on their proposals on credit and debit card caps, a time-limited exemption from the rules for three-party schemes, and the regulatory structure. The EMA’s response to each question is below:

• Credit cards: The EMA agrees with HMT’s plans to apply the same cap on interchange fees as set out in the regulation (i.e. maximum of 0.3% per domestic or international transaction).
• Debit cards: The EMA agrees with HMT’s plans to apply a “weighted average” (i.e. interchange fees cannot exceed more than the equivalent of 0.2% of the annual average transaction value of all domestic debit card transactions within each payment card scheme). However the EMA raises concerns about the uncertainty this may bring for industry, and supports a review of the policy once its impact has been measured and analysed by the PSR.
• Three-party schemes: The EMA agrees with HMT’s proposal to exempt three-party schemes that do not exceed 3% of market share across all card products for the maximum 3 year period permitted under the regulation. 
• Regulatory oversight: Agrees in principle with HMT’s proposed regulatory regime of splitting regulatory responsibilities between the PSR, the FCA, and the Trading Standards Institute. However the EMA raises concerns about the potential for duplication of effort for firms, and calls for guidance for firms setting out the remit and jurisdiction of each regulator.

[button link=”https://emaprd.wpengine.com/wp-content/uploads/2015/08/EMA-Response-to-HMT-Interchange-Fee-Consultation.pdf” style=”download” color=”green”]Download the full response (PDF)[/button]

On 27th July, the Slovenian Office for Money Laundering Prevention from the Ministry of Finance published a new draft of their Prevention of Money Laundering and Terrorist Financing Act (ZPPDFT) to bring it in line with 4MLD. The EMA’s response raises 4 issues with the draft:

• The draft scope of the Act extends to credit institutions, payment institutions and electronic money institutions passporting into Slovenia on a cross-border basis under Freedom of Services, and should be limited to those authorised in Slovenia or operating in Slovenia under the Freedom of Establishment only; 
• The translation of the term “payment instrument” as “electronic medium” is legally unclear, potentially narrowing the e-money exemption from CDD, so the original EU translation should be used
• The draft has incorrectly transposed the e-money CDD exemption by requiring EMIs providing reloadable cards that can be used outside of Slovenia to conduct CDD, regardless of any limits on the amount.
• The current draft translation of the redemption provision under the e-money exemption from CDD doesn’t permit redemption transfers over €100 to a bank account to be exempt from CDD, so should be amended.

[button link=”https://emaprd.wpengine.com/wp-content/uploads/2015/08/EMA-Response-to-Slovenian-Ministry-of-Finance-on-Draft-ZPPDFT.pdf” style=”download” color=”green”]Download full response (PDF)[/button]