An overview of providing payment services under the psd2
Category: Regulatory Compliance
With the PSD2, companies can gain access to banks’ payment accounts, but only if the account holder has given explicit permission to do so. In this way, companies can gain insight into consumers’ payment data and these companies can offer their services, including issuing payment orders online and providing insight into spending.
The directive clearly impedes on peoples’ privacy. Therefore, additional rules and safeguards have been included to ensure that the processing and storage of (personal) data is done correctly. In light of the General Data Protection Regulation (AVG), the Personal Data Authority keeps a close eye on whether payment service providers are complying with the rules. In addition, parties providing payment services in accordance with the PSD2 must apply for a licence from the DNB. One of the requirements is that the payment service provider has a security policy (e.g. policy to prevent fraud and the illegal use of payment data).
What is new for authorisation payment services under PSD2?
The PSD2 introduced a number of developments, some of which are briefly mentioned below. Two new payment service providers will have access (based on the consent of their customers) to the payment accounts of these customers. These new payment service providers are:
Those who provide payment initiation services, meaning: “A service for initiating a payment order at the request of payment service user, in respect of a payment account held with another payment service provider.”
- Take, for example, online purchases. The moment the payment service provider has initiated a payment at the request of a customer, this information must be immediately provided to the payment service provider.
- In the case of payment initiation services, it is important to note that customer due diligence must be performed, as per the Prevention of Money Laundering and Terrorist Financing Act (Wwft). Transaction monitoring is also necessary.
Those that provide account information services, meaning: “An online service for providing consolidated information about one or more payment accounts held by the payment service user with another payment service provider or with more than one payment service provider.”
- Account information services should also provide customer due diligence in accordance with the Wwft. It is relevant to identify and verify the customer, determine the purpose and nature of the business relationship, investigate Politically Exposed Persons (PEPs) and investigate the authorised representative and Ultimate Beneficial Owner (UBO).
- Although the risks of money laundering and terrorist financing are considered low, parties that provide account information services must also comply with transaction monitoring.
- New rules were also added for existing payment service providers. There are more rules regarding the management of the business, namely with respect to notifications, reporting requirements and internal operations (including IT). Holders of equity investments or control of 10% or more also must have a declaration of no objection (VVGB) from the Dutch Central Bank (DNB).
When is a licence from the DNB required?
A party providing payment services must have a licence from the DNB. There are eight payment services in total, two of which have already been explained above. The other six are as follows:
- Services that allow cash to be placed on a payment account maintained by the payment service provider, and all transactions required to operate a payment account;
- Services enabling cash withdrawals from a payment account, and all transactions required for operating a payment account;
- Services by which payment transactions, including money transfers, are carried out on a payment account with the user’s payment service provider or with another payment service provider;
- Services through which payment transactions are carried out where the funds are secured by a line of credit provided to the payment service user;
- Services through which payment instruments are issued or accepted; and
- Money transfers.
When does the exemption for a payment services licence apply?
This exemption will apply where:
- The service provider intends to provide one or more payment services mentioned above under numbers 1 to 5, and thus does not intend to provide money transfers, payment initiation services or account information services;
- The service provider will provide payment services only in the Netherlands;
- The average of the total amount of the payment transactions carried out in the preceding twelve months does not exceed EUR 3,000,000 per month;
- The persons who determine or co-determine the policy of the company are persons without antecedents pursuant to section 6, subsections a, b, d of the Besluit prudentiële regels Wft.
- The funds of the payment service users that are, or have been received, are secured by the company (e.g. by a lawyer’s trust account).
In order to make use of this exemption it is necessary to register this exemption with DNB by means of the notification form. Among other things, you will be asked to demonstrate/describe why you qualify as an exempt service provider.