- The decree partly transposes the PSD2 directive, which opens access to bank accounts to other payment service providers.
- Payment initiation and account information services are regulated, with registration at the Bank of Spain.
- It also gives more tools to the securities regulator and the Bank of Spain, including a channel for reporting breaches.
On 23 November 2018 the Council of Ministers approved Royal Decree-law 19/2018 on payment services and other urgent financial measures, published in the Official State Gazette on 24 November. It partly transposes Directive (EU) 2015/2366, known as PSD2, which replaces the 2007 payment services directive, and completes the transposition of other European directives whose deadline had passed and for which infringement proceedings had been opened.
The directive was due to be incorporated into national law at the beginning of 2018, and the decree comes late. Besides payment services, it adjusts Spanish law to several European regulations already applicable, on benchmarks, market abuse, retail investment products and money market funds, and gives supervisors more powers.
What changes in payments
The decree regulates eight payment services, including two that the directive introduces as new: payment initiation, whereby a provider orders a transfer from the customer’s account, and account information, which gathers in one place data from accounts held at different banks. These third-party providers will be able to access the user’s account with their consent, without needing a contract with the bank where the account is held.
Providers of these services will register with the Bank of Spain and must hold professional liability insurance or an equivalent guarantee. Banks may not discriminatorily deny access to accounts, and any refusal must be reported to the supervisor with its reasons. Smaller payment institutions, with an average monthly volume of transactions below a set threshold, may be exempt from authorisation.
Security and strong authentication
The directive strengthens the security of electronic payments with strong customer authentication, which requires two or more independent elements from something the user knows, something they possess and something that identifies them personally, such as a fingerprint. The technical standards implementing that requirement will apply from September 2019, and for e-commerce it will mean changes to the payment experience.
The stated aim is to improve the protection of users’ rights, who will be able to make safer transactions and access a growing range of innovative services. For institutions, it means a more competitive environment, in which traditional banks will share access to the customer relationship with technology companies.
More financial supervision
The decree is not limited to payments. It gives the securities regulator the powers needed to penalise market manipulation, the sale of certain particularly complex products or the manipulation of benchmarks, and creates a channel through which possible breaches of prudential supervision rules can be reported to the Bank of Spain, even anonymously.
These measures seek to increase the effectiveness of supervision and investor protection, and to put Spain on a par with its European partners in supervision. For financial institutions and listed companies, it implies a tougher penalty regime and greater attention to compliance.
What to review
Companies that take payments online or manage third-party payments can check with their payment provider that strong authentication will be ready by the date of application and that their gateway is compatible. Those that offer financial services, or are considering doing so, must analyse whether they need authorisation or registration with the Bank of Spain.
For individuals and SMEs, the novelty is the possibility of aggregating accounts from several banks in one app, or of paying without a card from the bank. It is advisable to use only providers listed in the official register, check the permissions granted and periodically review authorised access.
Opening payments to new players will bring convenience, but it requires choosing carefully whom to give access to financial information.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
