EBA publishes report on authorisation under the Payment Services Directive

Today the EBA published a Peer Review Report on the authorisation of Payment Institutions (PIs) and Electronic Money Institutions (EMIs) by the national authorities / financial regulators. The report provides a valuable insight in where precisely authorisation practices differ across Europe, points to some shortcomings and suggests some good practices.

Some first takeaways from the report:

1. Information required from PIs and EMIs.

The national competent authorities have largely implemented the EBA Guidelines on authorisation issued in 2017 in support of the PSD2. This provides consistency and transparency in the authorisation information that prospective PIs and EMIs have to submit. However, some countries have not fully implemented the Guidelines, in particular in relation to obtaining the full set of information required from applicants.

2. Assessment of the information submitted in the PIs / EMIs application file

No supervisory level playing field. There are significant divergences in the national practices when assessing the information submitted, and the level of scrutiny of those documents varies considerably, more in particular for:

1. business plans
2. governance arrangements
3. internal control mechanisms.
4. assessment of directors and managers
5. the issue how much “local substance” is needed in the jurisdiction where the application is filed.
   • i. Some jurisdictions require that the PI must be effectively directed from the jurisdiction in which it is seeking authorisation. In that case (some of) the executive members of the management or members of the board must be located in their jurisdiction.
   • ii. Others do not require any physical presence of the management body but require instead local presence of other staff e.g. internal control function, or in-house staff who are able to interact with the local authorities.
   • iii. A third group does not impose any quantitative thresholds in terms of minimum presence of the members of the management body or other staff, but require applicants to explain the adequacy of their structure in the home country and demonstrate that the business will be directed from there.

This implies that there is no supervisory level playing field and it may give rise to ‘forum shopping’. The report therefore sets out follow-up measures to strengthen convergence of supervisory practices in assessing applications.

3. Internal controls and the ‘three lines of defence’ model

The report recommends that all competent authorities should ensure that PI/EMI applicants have a ‘three lines of defence’ model that includes the functions of risk management, compliance and internal audit, where the nature, scale and complexity of their activities makes this appropriate. To minimise potential forum shopping and ensure sufficient local substance, all competent authorities should ensure that EMIs/PIs are effectively managed and controlled from the jurisdiction in which they seek authorisation, and have close links with that jurisdiction.

4. How long does it take?

The average duration ranges from 4-6 months to 20 months or more. The main reason for delays is:

• the quality of applications and applicants’ timeliness in addressing issues identified. Some authorities encourage applicants to only submit a formal application once the have gone through an (informal and non-mandatory) pre-screening, which increases the quality of the applications and allows better expectation management;
• different timelines set out in national laws;
• different procedural approaches in the acceptance and assessment of applications.

5. Best practices

The report identifies some best practices for the national competent authorities, e.g. :

• publishing guidance to clarify the requirements;
• comparing applicants’ forecasts against data from existing similar PIs/EMIs to help making a reality check of the financial forecasts;
• making use of existing EBA and EBA/ESMA guidelines under the Capital Requirements Directive to assess independence of the internal control functions and suitability of the directors and persons responsible for the management of PIs and EMIs.

6. Recommendation for European Commission

The report also makes some recommendations to the European Commission. EBA recommends that, as part of its ongoing PSD2 review process, the European Commission:

• clarifies the delineation between the different categories of payment services as well as eMoney issuance
• clarifies the applicable governance arrangements for PIs and EMIs;
• clarifies the criteria that the national competent authorities should use in assessing the suitability of directors and persons responsible for the management of PIs and EMIs;
• clarifies the requirements that applicants must meet in order to ensure sufficient local substance.

If you have questions about PSD2 or wonder whether you need a payment license, don’t hesitate to book a free 15-minute call with Edwin Jacobs (reserved for organisations).