Regulatory checking

Overview

For a PSP to operate they must register with the NCA of the country they are based in. For example, a PSP based in the UK would register with the Financial Conduct Authority (FCA). When a PSP applies to their home NCA the home NCA will undertake a number of checks to ensure they are eligible to operate and what payment services they can provide within the NCA’s jurisdiction.

If a PSP wishes they can also request to operate outside their home Member State using the right to passport their services or establish a branch. To conduct payment services outside their home Member State a PSP must notify its home NCA of its intentions and the home NCA will apply to another EEA Member State in order for the host NCA to undertake checks on the PSP to ensure they are eligible to operate.

This page covers the register categories found on the NCA registers and EBA register, the 8 payment services a PSP can provide, the passporting process and how Konsentus’s regulatory checking service tests a PSPs status. For response examples please go to GET /v1/psp/eidas.

Register categories

An NCA register or the EBA register is made up of a number of different PSPs. PSD2 sets out seven categories of PSP that are authorised to provide payment services, below is a summary of each category:

Payment Institution

Payment institutions are allowed to provide payment services (such as credit transfers, direct debits, electronic credit card transactions, money transfer). Payment Institutions differ from credit institutions and e-money institutions as they are not allowed to hold a Payment Service User’s (PSU) money unless they have a payment instruction (the details required to make a payment to an account).

Exempt Payment Institution

An exempt payment institution can operate in a similar manner to a payment institution but are defined by the EU as a payment institution that has processed less than €3 million payment transactions in the past twelve-month period (this can be set at a lower level by an NCA if they wish).

As such they are not required to undergo the same checks a payment institution must take when registering. Consequently, exempt payment institutions contain a "registered" status as opposed to an "authorised" status to reflect a lower level of regulation. They are also not able to passport to other EEA countries.

E-Money Institution

E-money institutions can be defined as institutions that issue electronic money. This means that they can hold a PSU’s money (that is a PSU stores money with the institution, but the institution cannot lend or invest the money) and make that money available for withdrawals or payments.

Exempt E-Money Institution

An exempt e-money institution can operate in a similar manner to an e-money institution but are defined by the EU as an e-money institution whose business activities generate less than €5 million of electronic money (this can be set at a lower level by an NCA if they wish).

As such they are not required to undergo the same checks an e-money institution must take when registering. Consequently, exempt e-money institutions contain the "registered" status as opposed to an "authorised" status to reflect a lower level of regulation. They are also not able to passport to other EEA countries.

AISP

An Account Information Service Provider (AISP) is an institution who is only authorised to perform the eighth payment service. They may be in their own category in an NCAs register and contain the authorisation status of "registered" as opposed to "authorised" to reflect a lower level of regulation.

Agent

Agents are individuals or organisations that provide payment services on behalf of a PSP. They are not legally liable for their services, instead the PSP they are providing services on behalf of is legally liable for them. To reflect this an agent is simply "registered" with an NCA instead of being "authorised". In addition to this, unless otherwise stated by the NCA, an agent is assumed to have all of the payment services that its PSP provides.

Credit Institution

A Credit Institution can be defined as an institution that allows a PSU to deposit money with them (that is they can lend or invest the money that PSUs put into their accounts). Consequently, PSD2 recognises that any Credit Institution in an NCA register is entitled to perform all eight of the PSD2 payment services.

Payment services

The PSD2 directive states that there are eight payment services that a PSP can provide. Each register should display a PSPs authorised payment services, below is the list of the eight payment services:

  1. Services enabling cash to be placed on a payment account as well as all the operations required for operating a payment account

  2. Services enabling cash withdrawals from a payment account as well as all the operations required for operating a payment account

  3. Execution of payment transactions, including transfers of funds on a payment account with the user’s payment service provider or with another payment service provider

    a) execution of direct debits, including one-off direct debits

    b) execution of payment transactions through a payment card or a similar device

    c) execution of credit transfers, including standing orders

  4. Execution of payment transactions where the funds are covered by a credit line for a payment service user

    a) execution of direct debits, including one-off direct debits

    b) execution of payment transactions through a payment card or a similar device

    c) execution of credit transfers, including standing orders

  5. Issuing of payment instruments and/or acquiring of payment transactions

  6. Money remittance

  7. Payment initiation services

  8. Account information services

It is easy to confuse the above payment services with the roles that are found on eIDAS certificates. The roles in eIDAS certificates are based on the above payment services as a QTSP will need to check the appropriate NCA register before they can write roles into a certificate. As such you can map the following eIDAS roles to the following PSD2 roles:

eIDAS Role PSD2 Payment Service PSD2 Payment Service Description
PSP_PI 7 Payment Initiation Services
PSP_AI 8 Account Information Services
PSP_CBPII 5 Issuing of payment instruments and/or acquiring of payment transactions
PSP_AS 1 to 8 Account Services

It is worth noting that although there is a degree of reliability with the roles written into an eIDAS certificate (as the QTSP would have been required to check an NCA register) they are not as reliable as the NCA registers themselves. As such, when Konsentus performs a regulatory check it will return the payment services that it finds on the NCA register(s) and not the roles on an eIDAS certificate. This means that the regulatory check returns the payment services in the PSD2 format (1 - 8 index number) and not the eIDAS certificate role format (PSP_AI, PSP_PI, etc).

Passporting

After a PSP has successfully obtained authorisation from their home NCA they have the opportunity to provide payment services throughout the EEA using the passporting service. In order to provide payment services to other EEA countries a PSP must apply through their home NCA to passport to another EEA country (host NCA). It is the responsibility of the home NCA to pass these details onto the host NCA who will approve or decline the PSP request. Assuming the host NCA approves the PSP will be able to provide its payment services to PSUs within the host Member State.

Once approval has taken place it is the responsibility of the home NCA to update their register to show that a PSP is authorised to passport to a host Member State. This process is known as passporting out. It is possible that a host NCA will also update their register to show a PSP who has passported their payment services into the host Member Sate, this is optional and not set out in the PSD2 directive. This process is known as passporting in.

Konsentus check both passporting out and passporting in information from NCA registers. However as explained above because passporting in records are optional the PSP’s record may show only the passporting out information.

Jurisdiction logic

The Konsentus jurisdiction field provides ASPSPs with the option to select the country where the PSU transaction is taking place. Below is a description of the three most common scenarios:

Scenario 1

If a PSP and ASPSP are both in country x then the ASPSP puts jurisdiction x in the Konsentus API call. The PSP is registered by its Home NCA x. The Konsentus service checks the PSP on its Home NCA x and returns payment service for country x to the ASPSP.

Scenario 2

If the PSP is in country x and the ASPSP is in country y then the ASPSP puts jurisdiction y in the Konsentus API call. The PSP is registered by its Home NCA x. The Konsentus service checks the PSP on its Home NCA x and looks to see if they have passported their services to country y. If NO then the Konsentus service returns payment services for country x and reports that the PSP has not passported its services to country y. If YES then the Konsentus service checks the PSP on Host NCA y. If the PSP is NOT listed on Host NCA y then the Konsentus service returns payment services for country x and reports that the PSP is not registered on Host NCA y. If the PSP is listed on Host NCA y then the Konsentus service returns the payment services for country x and the payment services for country y.

Scenario 3

If the PSP is in country x, the ASPSP is in country y and the client calling the Konsentus service is in country z but managing accounts for PSUs in country y then the client puts jurisdiction y in the Konsentus API call. The PSP is registered by its Home NCA x. The Konsentus service checks the PSP on its Home NCA x and looks to see if they have passported their services to country y. If NO then the Konsentus service returns payment services for country x and reports that PSP has not passported its services to country y. If YES then the Konsentus service checks the PSP on Host NCA y. If the PSP is NOT listed on Host NCA y then the Konsentus service returns payment services for country x and reports that the PSP is not registered on Host NCA y. If the PSP is listed on Host NCA y then the Konsentus service returns the payment services for country x and the payment services for country y.

For response examples please go to GET /v1/psp/eidas.

Konsentus regulatory checking service

When an ASPSP uses the GET /v1/psp/eidas endpoint Konsentus will run the following regulatory checks on the PSP:

  • PSP’s home register details (NCA name, country code, register type)
  • PSP’s category within their home NCA register
  • PSP’s authorisation status within their home NCA register
  • Payment services that the PSP is authorised to provide from their home NCA register
  • PSP’s authorisation status from the home NCA register for services provided to a host country (host country is to be defined using the ‘jurisdiction’ input)
  • Payment services that the PSP is authorised to provide within the home NCA register for services provided to a host country (host country is to be defined using the ‘jurisdiction’ input)
  • PSP’s authorisation status within the host NCA register (host register is to be defined using the ‘jurisdiction’ input)
  • Payment services that the PSP is authorised to provide from the host NCA register (host register is to be defined using the ‘jurisdiction’ input)
Last Updated: 7/26/2019, 1:25:34 PM