In his blog post of 20 July, Christian Walz presented the outline of the guidelines put out for consultation by the EBA on the PSD2 exclusion of so-called “limited networks” under Art. 3k. The exception comprises three groups: “limited network”, “limited range” and the category “social or tax purposes” or in Germany also called “Zweckkarten” (such as the 44-Euro non-cash benefit for employees). The EBA has introduced the abbreviation LNE (“limited network exclusion”) for the entire exemption and this is already a good first suggestion, which I will keep. In this blog post, I go into more detail on the notification procedure under Article 37 No. 2 of PSD2 for the LNE. The notification procedure for telecommunication companies that provide further payment transactions in addition to electronic communication services according to Art. 3 l. is not the subject of the consultation and therefore not the subject of this blog post. In Germany, this provision of PSD2 for LNEs was implemented in §2 para. 2 ZAG. Practice shows that the notification procedure (requirements, content, processing and verification of the notification) is handled completely differently in the member states. This does not exactly lead to the repeatedly invoked “level playing field” for the companies concerned in the internal market. For this reason, the EBA is attempting to harmonise the notification procedure by means of the guidelines submitted for discussion.
Table of Contents
Duty of notification
Service providers offering payment instruments that meet the criteria of the LNE are obliged to notify the respective national supervisory authority (in Germany the BaFin) if the total value of payment transactions in the previous twelve months exceeds the amount of 1 million euros. However, this reporting obligation does not apply to companies that offer payment instruments of the third category of so-called special-purpose cards (“social or tax purposes”). According to Art. 37 No. 2 of PSD2, the notification shall contain a description of the services offered as well as an indication of which subgroup (limited network or limited range) is used.
Review and publication of the advertisement
Based on the data provided in the notification, the competent national authority should assess whether or not the conditions for an LNE are met. The PSD2 provides for “a duly motivated decision on the basis of criteria referred to in point (k) of Article 3“, which must be communicated to the relevant entity. Following this decision, the “negatively tested” entities will be included in a national register, and parallel in an EBA register. Both the national register and the EBA register must be publicly accessible. Here you will find, for example, the BaFin register or the so-called Euclid register of the EBA. The EBA register usually contains the name and registered office of the company, description of the activity, category and start date of the activity.
Backgrounds
What is the rationale behind the limit network exclusion and the notification requirement for larger service providers (annual payment volume of NLE activity from 1 million euros volume)?
The exclusion “limited network/range” already existed in the first Payment Services Directive (PSD1/2007) and first in the first E-Money Directive (EMD1/2000), but in both cases without justification. In the PSD2 (2015), the exception was amended. The criterion for the second subgroup “limited range of goods and services” was further restricted by adding the adjective “very”. In addition, the third case group of special-purpose cards was added. The general justification for the exception was also missing in PSD2. However, there was an indirect reference. The further restriction of the criteria for the “limited range” case group was justified in recital 13 with the allegedly high market volume of the payment instruments benefiting from this exception: “Feedback from the market shows that the payment activities covered by the limited network exclusion often comprise significant payment volumes and values and offer to consumers hundreds or thousands of different products and services. That does not fit the purpose of the limited network exclusion as provided for in Directive 2007/64/EC and implies greater risks and no legal protection for payment service users, in particular consumers, and clear disadvantages for regulated market actors.“
Apart from the fact that the purpose of the LNE, which is assumed to be known here, was not revealed in PSD1 and the alleged “significant payment volumes” have not been proven, both arguments – consumer protection and competitive disadvantage for regulated players – are not valid. The LNE only refers to criteria for product features, which limits the risks of non-regulation for the user. Whether I, as a consumer, spend 100 or 500 euros per month with a public transport card or whether 1,000 or 100,000 fellow citizens use such a card next to me is irrelevant for the LNE area exemption. Otherwise, the legislator would have drawn volume-dependent limits. The second argument does not hold either, since the supervised players (e.g. the issuer of a credit card that can be used worldwide) are active in other markets in terms of products, and supervision is not a disadvantage, but often a predicate. Ergo: Market volumes must not play a role in the question of the LNE due to the inherent logic of the Directive. The question is justified as to how the Commission nevertheless got away with such inconsistent justification at the time. This must not be repeated in PSD3. It is, therefore, to be welcomed that the EBA clarifies the reason for the LNE in its draft GL:
“While the use of these instruments is limited to the purchase of specific goods and services or within specific distribution channels, thus reducing the risk to customers, it should be noted that users carrying out transactions with these payment instrument do not benefit from the protection envisaged under PSD2.”
Now to the second question: Why do beneficiaries of the LNE have to report when they reach a certain volume? Recital 20 of PSD2 succinctly says: “Moreover, it is important to include a requirement for potential payment service providers to notify competent authorities”. Now, however, every payment instrument provider is a potential payment service provider, regardless of volume. We can only puzzle over why the threshold is important:
- The respective authorities would be overburdened if they had to examine every company in the area of LNE. The smaller service providers should assess the LNE requirements themselves, for the larger ones the supervisory authority should become active;
- The notifications allow the Commission to have an overview of the size of the non-regulated market;
- Consumers have at least for larger providers the (rather theoretical) possibility to make a register query whether the respective payment instrument is subject to PSD2 or not.
I suspect that the first reason given for the obligation to report was decisive. Because without the obligation to notify, the supervisory authority would have to act – instead of reacting – and observe the market to see whether the players fulfil the LNE criteria or not. In view of the above-mentioned presumed reasons, however, it remains puzzling why in PSD2 the subgroup of so-called special-purpose cards is exempt from the notification obligation.
Immense differences in practice within the EU
Now, based on the notification, the supervisory authorities are to examine “whether the activities so notified can be considered to be activities provided in the framework of a limited network.” (recital 20 of PSD2). A “duly motivated decision” as required by PSD2 presupposes two facts:
- At least an internal, or even better, an externally communicated clarification by the national competent authority on how the very generic LNE criteria of PSD2 (or the national implementation) are to be interpreted. For example, what does the requirement of a “very limited product range” mean in concrete terms? BaFin, for example, has done an exemplary job here in the ZAG leaflet. In many other member states, this transparency is lacking.
- In the notification, the company should provide the information necessary for an assessment by the competent authority (e.g. product range, payment instrument, foreign use, acceptance partner, contractual relationship with the issuer, etc.).
There are immense differences in the content of the notification in the individual member states. For example, the notification form of the supervisory authority FMA of our neighbours in Austria comprises five pages with detailed information on the respective payment instrument and its possible uses. An extract from the commercial register and a sample of the payment instrument is required as an attachment. The questionnaires in France, Ireland and Italy have a similar or larger scope. The Italian supervisory authority even requires confirmation of the information by an auditor. In Germany, on the other hand, BaFin only requires the identification of the activity by means of a cross in a pre-selection table (“city card”, “clothing card”, “stadium card”, etc.). The German minimalism by means of a 5-minute notification has of course its low-resource charm for both sides but is difficult to reconcile with the PSD2 requirement of a properly justified assessment by the respective competent authority based on the LNE criteria. The assessment is apparently left to the respective market participant.
It can be assumed that the EBA guidelines will also bring about harmonisation of the currently strongly diverging notification procedures at this point. The guidelines explicitly assume an active role of the supervisory authorities in the assessment of the notified payment instruments. As a result of the guidelines, the definition and interpretation of a number of detailed criteria will be harmonised. The EBA requires that the notification must contain sufficient information from the notifying entities on these individual criteria to enable a review based on these criteria (GL 6.9.). For example, the definition of a “leading product” in the 2nd case group (limited range) would lead to the provider having to classify the products to be acquired with the payment instrument accordingly and explain the functional relationship (see GL 4.2.).
New registrations are required
A logical consequence of harmonisation based on detailed criteria is the renewal of the notifications already made since the implementation of PSD2 in the individual member states after the adoption of the guidelines (October 2022). Since currently approx. 65% of the notifications in the EU have been made in Germany, BaFin in particular will have a lot of work to do, provided BaFin agrees to the guidelines (“comply” instead of “explain”). Currently, the BaFin register contains 809 companies registered for the LNE sector (excluding the case group of special-purpose cards and telecommunication companies). See graph. The good news is that it is to be expected that more than 50% of the notifications will not be made in the future, as the BaFin register contains a great number of incorrect notifications. For example, 378 public transport companies and associations were reported, although only a handful of them currently issue a payment instrument. The same applies to the more than 100 small betting offices (partly “kebab shops”) reported.
Further clarifications
- In contrast to Germany, in some countries, the LNE providers have to submit a report every year. The EBA sees no need for this unless there are important changes at the payment instrument provider that affect the criteria (GL 6.4.).
- The notification is to be made in each Member State where the product is offered if the limit value (1 Mi. Euro) is exceeded in the respective country (GL 6.1.).
- The submission of a business plan by the respective companies, currently required in some Member States at the time of notification, would no longer be necessary (to avoid workload on both sides). See Background No. 27.
- A payment instrument can only use one of the three categories of the LNE (GL 1.11.) The declarant must therefore choose one category.
- The current administrative practice of the national competent authorities could result in identical products falling under the LNE in Member State A and under PSD2 as regulated payment instruments in Member State B. It is quite conceivable that despite the introduction of the EBA guidelines, such differences will continue to exist in the future and thus lead to a violation of the “level playing field” principle. The EBA rejects a coordinated approach between the respective national authorities with reference to the additional workload (Background No. 59). It would be welcome if, at least in the case of different classifications by national authorities, there were some kind of arbitration body, e.g. at the EBA.
- If a provider issues several different payment instruments that fall under the LNE (e.g., citycard in city A and in city B), the €1 million threshold should refer to the total payment volume of all LNE products offered by that company and not to each portfolio (GL 6.7.). The EBA refers to the text of Art. 37 No. 2 of PSD2, but the text is not clear here and explicitly refers to individual activities covered by the LNE. The EBA justifies this requirement with the risk of circumvention: “This would be particularly relevant if a single service provider, with the intention to circumvent the requirements of PSD2, issues a large number of payment instruments not breaching the thresholds but at the same time generating a very high amount of transactions” (Background No. 62). This argumentation is inconsistent and contradicts the principle of PSD2 mentioned above, which was affirmed by the EBA, that market volumes may not play a role in the question of the LNE due to the inherent logic of the directive. All criteria as to whether there is an authorisation requirement or an LNE are only product-related, irrespective of any volumes. In the case of a self-assessment and a “five-minute notification”, I think one could still let this requirement pass. But this will no longer be the case in the future. The EBA’s requirement may lead to a time-consuming notification and assessment of mini-systems.
What else is missing?
Some “pain points” that play a role in today’s practice are unfortunately omitted by the EBA, such as a deadline for the supervisory authority to issue an assessment after receiving the notification. In its first draft of PSD2 (2013), the European Commission proposed a deadline of one month, which was, however, deleted in the final version – presumably due to lobbying by the supervisory authorities. There are also no requirements for the timeliness of the respective registers. The last update of the BaFin register was in August 2020.
What about the register information that is supposed to be publicly accessible according to Art. 37 No. 5 of PSD2? Can you see the list of all providers directly (as in the BaFin register, for example), or do you have to know the name of the company and then you only see the data of that company? The register of the Banque de France in France only opens upon request, which can be refused (we were denied access, by the way). In the Italian register, despite a legal requirement, the description of the respective activity of the LNE providers is missing, for example. A complaint to the EBA leads nowhere. Who actually checks whether supervisory authorities comply with the law?
Cover picture: Copyright © Adobe/WrightStudio
