CENTRAL CONTACT POINTS UNDER PSD2: DO YOU NEED TO APPOINT ONE?

Payment Institutions (PIs) and Electronic Money Institutions (EMIs) with a head office in a member state and that operate through agents in a member state, may soon need to appoint a Central Contact Point (CCP) in that territory.

It all comes from draft regulatory technical standards recently issued by the European Banking Authority (EBA) as part of PSD2, which state that member states can require PIs and EMIs to appoint a CCP to act as a point of communication between the company and their authorities.

Why is a Central Contact Point necessary?
The aim of appointing CCPs is to facilitate supervision by and communication with host regulators and to improve compliance and reporting obligations.

The functions of a CCP include:

• Reporting on the company’s financial activity in the member state’s territory
• Ensuring the company’s compliance with PSD2 information and transparency obligations
• Facilitating supervision of the company by the home and host member states
• Ensuring the company’s compliance with the member state’s reporting obligations
• Coordinating communication between the company and authorities (of both home and host member states)
• Facilitating on-site inspections of the company’s agents
• Providing any other information required by the host member state to fulfil its supervisory function.

Is it fair for the EBA to require companies to appoint a CCP?
Good question.

According to their own definition, EBA says that the appointment of a CCP should be ‘proportionate to achieving the aims’ without placing any extra burdens on companies but of course, this is all relative, especially when you consider that the previous legislation, PSD1 had no requirement for a CCP.

It’s hard to argue that appointing a CCP won’t be a burden but it is one that has been deemed necessary.

What is the criteria for appointing a CCP?
As with most elements of setting up shop in a home country state, it’s all a numbers game.

The criteria for PIs and EMIs are as follows:

• Operating through 10 or more agents; or
• Completing payment transactions with a value of more than 3 million EUR, plus two of the agents are engaged under the right of establishment (including payment initiation); or
• Completing payment transactions numbering more than 100,000 plus 2 of the agents are engaged under the right of establishment (including payment initiation).

We can see therefore, that it’s all about volume and value and the EBA can change the goalposts on these thresholds at any time.

With this in mind, along with the apparent lack of any consideration of the type of payment service provided (a clear legislative requirement under article 29.5 PSD2), it’s tempting to think that the EBA are overstepping the authority that has been given to them under PSD2.

These standards certainly seem to favour the bigger players, leaving smaller players that provide niche solutions and only one type of payment service at a disadvantage.

I have already questioned in previous blogs whether the EBA was the right body to set the regulatory standards; these newly issued standards have done nothing to alleviate my skepticism!

Read my blog “PSD2: a Broken Promise Already? here: https://www.linkedin.com/pulse/psd2-broken-promise-already-nadja-van-der-veer/

Number Crunching
It’s interesting to note that the numbers above include volume/ value of transactions performed locally through the agents but also under the freedom to provide services (i.e. cross-border).

However, it’s not clear if volume in a host member state is based on local merchants or local consumers making the payments.

Is this to be decided by individual companies? If so, it could lead to a lot of confusion!

Even more interesting is the fact that during initial consultations on the criteria for CCPs, most respondents found the numbers too low.

However, in the absence of more specific data, the EBA stated it had no choice but to stick with them.

The difficulty of gathering the necessary data has also been cited as justification for having just a single set of thresholds, rather than different thresholds based on market characteristics or determining criteria and thresholds in addition to the PSD2 criteria.

Makes you wonder what data the EBA used to decide the thresholds in the first place.

Hiring a CCP
It has been questioned whether an existing agent could act as the CCP or whether the function has to be outsourced (thus saving the cost of setting up a local payroll).

The EBA has stated that CCPs should have the following:

• Appropriate knowledge of national laws transposing PSD2’s information and transparency requirements
• The ability to increase awareness within their local network of agents
• The ability to serve as a single provider/ point of collection of reporting obligations
• Access to all the data necessary for the performance of their function.

Considering the above, it might not be plausible to appoint an agent as CCP.

Companies will therefore need to keep this in mind and set aside a portion of their budget to make an additional hire.

Could companies combine their CCP and AML contact?
Don’t forget, the 4th AML Directive also requires PIs and EMIs to setup a central contact point if it has local establishments in a host country other than a branch (along with other criteria).

This CCP must – according to the regulatory technical standards formulated by the European Supervisory Authorities (ESA) jointly – have a sound understanding of applicable AML/ CFT requirements and facilitate the development and implementation of policies and procedures.

So, the ideal scenario would be to find someone that could perform both these requirements and the ones of the PSD2 CCP and kill two birds with one stone!

What should PIs and EMIs do now?
I advise that the sensible thing for PIs and EMIs to do with all this information is follow these six steps:

• Create a list of all the countries in which they have a head office or agents
• Check which of these countries opt-in on the CCP requirement
• Check if any of the CCP thresholds are met for any of these countries
• Notify the relevant local authorities within 30 days
• Assess which information and transparency obligations under titles III and IV of PSD2 apply (some might not if they are not dealing with consumers, micro-enterprises or one-leg transactions) and check all national provisions transposing these requirements in all countries from step 2
• Hire a local CCP that fulfils the requirements of both PSD2 and the 4th AML Directive.

I can help
I provide legal advice and support to PSPs/ Acquirers/ EMIs and other related service providers.

If you require assistance with the above steps or need a CCP in the Netherlands, contact me, Nadja van der Veer at Payment Counsel on (+31) 6-4343-6023 or via nadja@paymentcounsel.com