1. 1 29 June 2016 EU and Polish legislation related to the payment services market TAIEX Workshop on Regulation of Payment Systems 29 June 2016, Kiev Ewa Karkowska The Polish Financial Supervision Authority

2. Disclaimer The presentation expresses the views of the author only and can not be identified with the official stance of the Office and the Financial Supervision Commission in Poland. 2

3. The most important aspects of the payment services market in EU and Poland 1)Payment and banking services 2)Electronic money 3)Prevention of the use of the financial system for the purpose of money laundering and terrorist financing 4)Internet security 5)Data protection 6)Payment system 3 29 June 2016

4. Payment and banking services in EU (1) Directive 2007/64/EC of the European Parliament and of the Council of 13 November 2007 on payment services in the internal market amending Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC (PSD1) Guidelines on Payment Services Directive Passport Notifications on 1 November 2009, revised: June 2011 (The European Commission) 4 29 June 2016

5. Payment and banking services in EU (2) Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (PSD2) PURPOSE: to help to develop further an EU-wide market for electronic payments CONTENT: the Directive repeals and incorporates directive 2007/64/EC, which provided the legal basis for the creation of an EU-wide single market for payment services. ENTRY INTO FORCE: 12.01.2016. TRANSPOSITION: 13.01.2018. Member States shall adopt and publish the measures necessary to comply with this Directive. DELEGATED ACTS: the Commission shall be empowered to adopt delegated acts concerning certain elements of the Directive. It shall be conferred on the Commission for an undetermined period of time from 12 January 2016. The European Parliament or the Council may formulate objections with regard to the delegated act within a period of three months of its notification (this period may be extended by three months). If the European Parliament and the Council object, the delegated act may not enter into force. 5 29 June 2016

6. Payment and banking services in EU (3) Directive 2014/92/EU of the European Parliament and of the Council of 23 July 2014 on the comparability of fees related to payment accounts, payment account switching and access to payment accounts with basic features (PAD) PURPOSE: to ensure access to basic payment accounts and improve the availability of information on fees related to payment accounts. CONTENT:  the Directive lays down : (i) rules concerning the transparency and comparability of fees charged to consumers on their payment accounts held within the Union, (ii) rules concerning the switching of payment accounts within a Member State and (iii) rules to facilitate cross-border payment account-opening for consumers;  defines a framework for the rules and conditions according to which Member States are required to guarantee a right for consumers to open and use payment accounts with basic features in the Union. ENTRY INTO FORCE: 17.9.2014. TRANSPOSITION: 18.9.2016. 6 29 June 2016

7. Payment and banking services in EU (4) Regulation (EC) No 924/2009 of the European Parliament and of the Council of 16 September 2009 on cross-border payments in the Community Regulation (EU) No 260/2012 of the European Parliament and of the Council of 14 March 2012 establishing technical and business requirements for credit transfers and direct debits in euro and amending Regulation (EC) No 924/2009 Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 2015 on information accompanying transfers of funds and repealing Regulation (EC) No 1781/2006 7 29 June 2016

8. Payment and banking services in EU (5) Regulation (EU) 2015/751 of the European Parliament and of the Council of 29 April 2015 on interchange fees for card-based payment transactions (MIF Reg) PURPOSE: to lay down uniform technical and business requirements on interchange fees for card-based payment transactions. CONTENT: the Regulation lays down uniform technical and business requirements for card-based payment transactions carried out within the Union, where both the payer's payment service provider and the payee's payment service provider are located therein. Interchange fees are usually applied between the card-acquiring payment service providers and the card-issuing payment service providers belonging to a certain payment card scheme. Interchange fees are a main part of the fees charged to merchants by acquiring payment service providers for every card-based payment transaction. Merchants in turn incorporate those card costs, like all their other costs, in the general prices of goods and services. The aim is to reduce costs for both retailers and consumer, and to help create an EU-wide payments market. The regulation will also help users make more informed choices about payment instruments. ENTRY INTO FORCE: it shall apply from 8 June 2015, with the exception of certain provisions which shall apply from 9 December 2015 and 9 June 2016. 8 29 June 2016

9. Payment and banking services in EU (6) Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (CRR) REGULATION (EU) No 575/2013 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 26 June 2013 on prudential requirements for credit institutions and investment firms and amending Regulation (EU) No 648/2012 (CRD) Regulatory Technical Standards supplementing CRR and CRD Implementing Technical Standards supplementing CRR and CRD Commission Delegated Acts Adopted Implementing Acts 9 29 June 2016

10. Payment and banking services in Poland (7)  The Act on Supervision of Financial Market of 21 July 2006  The Act on Payment Services of 19 August 2011  The Banking Act of 29 August 1997  The Law on Operations of Cooperative Banks, their Affiliation and affiliated banks of 7 December 2000  The Act on Credit Unions of 5 November 2009  Resolutions of the Financial Supervision Commission  Regulations of the Minister of Finance 10 29 June 2016

11. Electronic money in EU (1) Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions amending Directives 2005/60/EC and 2006/48/EC and repealing Directive 2000/46/EC (EMD2) PURPOSE: to promote the emergence of a true single market for electronic money services in the European Union that is innovative and secure while ensuring there is competition between players on the market and that it is accessible to new entrants. CONTENT: the Council has adopted EMD2 having reached agreement with the European Parliament at first reading. Its adoption follows on from an evaluation by the Commission of the application of Directive 2000/46/EC on the taking up, pursuit of and prudential supervision of the business of electronic money institutions which shows that electronic money is still far from delivering the full potential benefits that were expected eight years ago at the time of the adoption of the Directive. The number of new entrants to the market is relatively low and, in the majority of Member States, electronic money is still not considered a credible substitute for cash. The new directive updates the provisions of Directive 2000/46/EC by giving particular emphasis to the level of initial capital and prudential supervision of electronic money establishments. It also seeks to ensure consistency with Directive 2007/64/EC concerning payment services. 11 29 June 2016

12. Electronic money in EU (2) EMD2 updates the provisions of Directive 2000/46/EC by giving particular emphasis to the level of initial capital and prudential supervision of electronic money establishments. It also seeks to ensure consistency with Directive 2007/64/EC concerning payment services. ENTRY INTO FORCE: 30/10/2009. TRANSPOSITON: 30/04/2011. APPLICATION: from 30/04/2011. Guidelines on Electronic Money Directive Passport Notifications (30/04/2011; The European Commission) 12 29 June 2016

13. Electronic money in Poland (3) The Act on Payment Services of 19 August 2011 13 29 June 2016

14. Prevention of the use of the financial system for the purpose of money laundering and terrorist financing in EU (1) Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (AMLD4) PURPOSE: to protect the financial system against money laundering and terrorist financing through measures on prevention, investigation, and detection. CONTENT: this Directive updates and revises the existing 3rd anti-money laundering Directive with the aim of further strengthening the Eus and of ensuring the soundness, integrity and stability of the financial defences against money laundering and terrorist financing system. It aims to ensure consistency between the EU approach and the international one - in particular, alignment with the most recent (February 2012)Recommendations of the Financial Action Task Force (FATF). ENTRY INTO FORCE: 25/06/2015. TRANSPOSITION: 26/06/2017. 14 29 June 2016

15. Prevention of the use of the financial system for the purpose of money laundering and terrorist financing in EU (2) Supervisory Cooperation Protocol between „Home Supervisor” and „Host Supervisor(s) of Agents and Branches of Payment Institutions in Host Member State (July 2012) Report on the application of AML/CTF obligations to, and the AML/CTF supervision of e-money issuers, agents and distributors in Europe (December 2012) 15 29 June 2016

16. Prevention of the use of the financial system for the purpose of money laundering and terrorist financing in Poland (3) The Act on counteracting money laundering and financing of terrorism of 16 November 2000 16 29 June 2016

17. Internet security in EU (1) The European Agenda on Security COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT, THE COUNCIL, THE EUROPEAN ECONOMIC AND SOCIAL COMMITTEE AND THE COMMITTEE OF THE REGIONS (28/04/2015) DRAFT RECOMMENDATION FOR SECOND READING on the Council position at first reading with a view to the adoption of a directive of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union (the NIS Directive) - 14/06/2016 The NIS Directive foresees a lex specialis with respect to incidents reporting, indicating that provisions will not apply to credit institutions (ad operators of essential services) if they provide payment services. Therefore, as long as they provide payment services, credit institutions could apply the obligatiions of the PSD2 instead of the NIS Directive, thus reducing the reporting burden 17 29 June 2016

18. Internet security of payments in EU (2) Recommendations concerning the safety of online payments on 31 January 2013 - the European Forum on the Security of Retail Payment (SecuRePay), as applicable from 1 February 2015 The Final guidelines on the security of internet payments (EBA/GL/2014/12) on 19 December 2014 - the European Banking Authority (the EBA), as applicable from 1 August 2015 14 recommendations „comply or explain” 18 29 June 2016

19. Internet security of payments in Poland (3) Recommendation for security of internet payment transactions effected by banks, domestic payment institutions, domestic electronic money institutions and credit unions on 17 November 2015 (The Polish Financial Supervision Authority) The document contains 14 recommendations, which were divided into the following areas: 1) The principles and organization of the governance and risk assessment Payment service providers should have a formal security policy and regularly assess detailed risks in relation to internet payments and related services and, if necessary, to make changes in this policy. The analysis should take into account, among others, used technology, technical environment in which the client is running or outsourcing issues. 19 29 June 2016

20. Internet security of payments in Poland (3) 2) The specific control and security measures for internet payments Payment service providers should use the mechanism of strong client authentication whenever a client initiates an internet payment or wants to get access to sensitive payment data. From this rule may be waived only in exceptional cases. Providers should provide customers safe tools to authorize internet transactions and provide a general concern for the safety of the transaction, through a clear definition of the duties and responsibilities of the payment service provider and the customer in connection with the use of internet payments, among others, the prohibition of sharing (disclosure) login data with third parties. Providers should also have in place systems to help identify and block fraudulent transactions. 3) Customer awareness, education, and communication Educational activities should be done either through regular activities, and through incidental warning about the dangers and the current contact with a customer via a secure communication channel. ENTRY INTO FORCE: 05/12/2015 (with same excection) 20 29 June 2016

21. Data protection in EU (1) DIRECTIVE (EU) 2016/680 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ENTRY INTO FORCE: 05/05/2016 TRANSPOSITION: 06/05/2018 21 29 June 2016

22. Data protection in EU (2) REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ENTRY INTO FORCE: 04/05/2016 TRANSPOSITION: 25/05/2018 22 29 June 2016

23. Data protection in EU (3) Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC (e-IDAS) ENTRY INTO FORCE: 17/09/2014 DATE OF EFFECT: 17/09/2014 (partial application) 01/07/2016 (full application) 23 29 June 2016

24. Data protection in Poland (4) The Act about personal data protection of 29 August 1997 24 29 June 2016

25. Payment system in EU (1) DIRECTIVE 98/26/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 19 May 1998 on settlement finality in payment and securities settlement system 25 29 June 2016

26. Payment system in Poland (2) The Act on settlement finality in payment and securities settlement systems and the supervision of such systems of 24 August 2001. 26 29 June 2016

27. 27 29 June 2016 THANK YOU FOR YOUR ATTENTION Ewa Karkowska The Polish Financial Supervision Authority