What changed between the draft committee report and the plenary report

Removed:Article 83 – paragraph 3: 3. To comply with paragraph 1, point (c), payment service providers shall exchange the unique identifier of a payee with other payment service providers who are subject to information sharing arrangements as referred to in paragraph 5, when the payment service provider has sufficient evidence to assume that there was a fraudulent payment transaction. Sufficient evidence for sharing unique identifiers shall be assumed when at least two different payment services users who are customers of the same payment service provider have informed that a unique identifier of a payee was used to make a fraudulent credit transfer. Payment service providers shall not keep unique identifiers obtained following the information exchange referred to in this paragraph and paragraph 5 for longer than it is necessary for the purposes laid down in paragraph 1, point (c).

Added:(65a) The term ‘permission’ in this Regulation should not be understood as meaning the same as the term ‘consent’ under Regulation (EU) 2016/679 to which the requirements of that Regulation apply. Permission under this Regulation refers to the authorisation by a payment service user for the execution of a payment transaction or for access to account information data. That requirement is without prejudice to the application of Regulation (EU) 2016/679 and of Directive 2005/29/EC of the European Parliament of the Council.

Removed:Article 83 – paragraph 4 a (new): 4a. The EBA shall set up a dedicated IT platform to allow payment service providers to exchange information on fraudulent unique identifiers with other payment service providers. / That platform shall be set up by ... [12 months from the date of entry into force of this Regulation].

Added:(65b) The EBA should develop draft regulatory technical standards setting out a standardised list of categories of information to be disclosed on the dashboard.

Removed:Article 83 – paragraph 5 a (new): 5a. Where the payment service provider fails to block a unique identifier which was reported to that payment service provider as fraudulent or involved in fraudulent transactions, the payment service user shall not bear any resulting financial losses.

Added:(66) The review of Directive (EU) 2015/2366 has revealed that account information and payment initiation service providers are still exposed to many unjustified obstacles, despite the level of harmonisation achieved and of the prohibition on such obstacles imposed by Article 32(3) of Commission Delegated Regulation (EU) 2018/389. Those obstacles still significantly hamper the full potential of open banking in the Union. Those obstacles are regularly reported by account information and payment initiation service providers to supervisors, regulators and the Commission. They were analysed by the EBA in its June 2020 entitled “Opinion of the European Banking Authority on obstacles under Article 32(3) of the RTS on SCA and CSC”. Despite clarifications efforts made there is still a lot of uncertainty, in the market and with supervisors, as to what constitutes a ‘prohibited obstacle’ to regulated open banking services. It is therefore indispensable to provide a clear and non-exhaustive list of such prohibited open banking obstacles, relying in particular on the work carried out by the EBA.

Removed:Article 85 – paragraph 12: 12. The two or more elements referred to in Article 3, point (35), on which strong customer authentication shall be based need to belong to different categories and their independence shall be fully preserved.

Added:(67) The obligation to keep personalised security credentials safe is of the utmost importance to protect the funds of the payment service user and to limit the risks relating to fraud and unauthorised access to payment accounts. However, terms and conditions or other obligations imposed by payment service providers on payment service users in relation to keeping personalised security credentials safe should not be drafted in a way that prevents payment service users from taking advantage of services offered by other payment service providers, including payment initiation services and account information services. Such terms and conditions should not contain any provisions that would make it more difficult, in any way, to use the payment services of other payment service providers authorised or registered pursuant to Directive (EU) XXX (PSD3). Furthermore, it is appropriate to specify that, for the activities of payment initiation service providers and account information service providers, the name of the account owner and the account number do not constitute sensitive payment data.

Removed:Article 88 – paragraph 2: 2. Payment services providers shall not make the performance of strong customer authentication dependant on the exclusive use of a single means of authentication and shall not make the performance of strong customer authentication depend, explicitly or implicitly, on the possession of a smartphone or other smart device. Payment services providers shall develop a diversity of means for application of strong customer authentication to cater for the specific situation of all their customers.

Added:(68) To be fully successful, ‘open banking’ requires a robust and effective enforcement of the rules that regulate that activity. As there exists no single authority at the level of the Union to enforce ‘open banking’ rights and duties, national competent authorities are the first level of open banking enforcement. It is essential that national competent authorities proactively and rigorously ensure the respect of the Union ‘open banking’ regulated framework. Insufficient enforcement by the relevant authorities is regularly presented by open banking operators as being one of the reasons for its still limited take-up in the Union. National competent authorities should have the appropriate resources to perform their enforcement tasks effectively and efficiently. National competent authorities should promote and broker a smooth and regular dialogue between the various actors of the ‘open banking’ ecosystem. Account servicing payment service providers and account information and payment initiation service providers which do not comply with their obligations should be subjected to appropriate sanctions. Regular monitoring of the ‘open banking’ market in the Union by competent authorities, coordinated by the EBA, should facilitate enforcement, and collection of data on the ‘open banking’ market will remedy a data gap which currently exists, hampering any effective measurement of the actual take-up of ‘open banking’ in the Union. Account servicing payment service providers and account information and payment initiation service providers should have access to dispute settlement bodies, pursuant to Article 10 of the Data Act proposal, once that Regulation enters into force.

Removed:Article 88 – paragraph 2 a (new): 2a. The performance of strong customer authentication shall be free of charge for the payment service user.

Added:(69) The parallel use of the term ‘explicit consent’ in Directive (EU) 2015/2366 and Regulation (EU) 2016/679 of the European Parliament and of the Council has led to misinterpretations. The object of the explicit consent under Article 94 (2) of Directive (EU) 2015/2366 is the permission to obtain access to those personal data, to be able to process and store these personal data that are necessary for the purpose of providing the payment service. Therefore, a clarification should be made to increase legal certainty and have a clear differentiation with data protection rules. Where the term ‘explicit consent’ was used in Directive (EU) 2015/2366, the term ‘permission’ should be used in the present Regulation. When reference is made to ‘permission’ that reference should be without prejudice to obligations of payment service providers under Article 6 of Regulation (EU) 2016/679. Therefore, permission should not be construed exclusively as ‘consent’ or ‘explicit consent’ as defined in Regulation (EU) 2016/679.

Removed:Article 94 – paragraph 2 – subparagraph 1: Payment service providers shall reply, on paper or, if agreed between the payment service provider and the payment service user, on another durable medium, to the payment service users’ complaints. Such a reply shall address all points raised, within an adequate timeframe and at the latest within 15 business days of receipt of the complaint. In exceptional situations, if the answer cannot be given within 15 business days for reasons beyond the control of the payment service provider, it shall send a holding reply, clearly indicating the reasons for a delay in answering to the complaint and specifying the deadline by which the payment service user will receive the final reply. In any event, the deadline for receiving the final reply shall not exceed 35 business days.

Added:(70) Security of credit transfers is fundamental for increasing the confidence of payment service users in such services and ensuring their use. Payers intending to send a credit transfer to a given payee may, as a result of fraud or error, provide a unique identifier which does not correspond to an account held by that payee. To contribute to the reduction of fraud and errors, payment service users should benefit from a service which would verify whether there is any discrepancy between the unique identifier of the payee and the name, or other identifier such as a fiscal number, a European unique identifier as referred to in Article 16(1), second subparagraph, of Directive (EU) 2017/1132 of the European Parliament and of the Council, or a legal entity identifier (LEI), that unambiguously identifies of the payee provided by the payer and, should any such discrepancies be detected, notify the payer thereof. The unique identifier does not have to be the international bank account number (IBAN). Such services, in the countries where they exist, have had a substantial positive impact on the level of fraud and errors. Given the importance of that service for the prevention of fraud and errors, such service should be available free of charge to consumers. To avoid undue frictions or delays in the processing of the transaction, the payment service provider of the payer should provide such notification within no more than a few seconds from the moment the payer has entered the payee information. To enable the payer to decide whether to proceed with the intended transaction, the payment service provider of the payer should provide such notification before the payer authorises the transaction. Certain credit transfer initiation solutions may be available to payers allowing them to place a payment order without inserting themselves the unique identifier. Instead, such data elements are provided by the provider of that initiation solution. In such cases, there is no need for a service verifying the match between the unique identifier and the name of the payee since the risk of fraud or errors is significantly reduced.

Removed:Article 95 – paragraph 1 a (new): 1a. The participation of payment service providers in ADR procedures for consumers shall be mandatory unless the Member State demonstrates to the Commission that other mechanisms are equally effective.

Added:(71) Regulation (EU) XXX amending Regulation (EU) No 260/2012 provides for a service verifying the match between the unique identifier and the name or other identifier of the payee to be offered to users of instant credit transfers in euro. To achieve a coherent framework for all credit transfers whilst avoiding any undue overlap, the verification service referred to in the present Regulation should only apply to credit transfers which are not covered by Regulation (EU) XXX amending Regulation (EU) No 260/2012.