The European Banking Authority (EBA) has issued a consultation paper on draft guidelines specifying the information to be provided by applicants intending to obtain authorisation as payment and electronic money institutions as well as to register as account information service providers under the Payment Services Directive (revised) (PSD2).

Specifically the draft guidelines specify:

• the type of information that applicants are required to submit in fulfilment of the requirements set out in PSD2, in respect of the applicant’s programme of operations; its business plan; evidence that the payment institution holds initial capital; the measures taken for safeguarding payment service users’ funds; the applicant’s governance arrangements and internal control mechanisms; and the procedure in place to monitor, handle and follow up a security incident and security related customer complaint;
• information requirements in respect of the process the applicant has in place to file, monitor, track and restrict access to sensitive payment data; its business continuity arrangements; the principles and definitions applied for the collection of statistical data on performance, transactions and fraud; a security policy document; its internal control mechanisms for the purpose of anti-money laundering obligations; the applicant’s structural organisation; the identity of persons holding qualifying holdings; the identity of directors and persons responsible for the management of the payment institution and, where relevant, persons responsible for the management of the payment services activities of the payment institution; the identity of statutory auditors; the applicant’s legal status and articles of association; and the address of the applicant’s head office.

The guidelines apply in full to applicants intending to obtain authorisation as a payment institution under the PSD2 but apply only partially to those applicants that intend to provide only account information services. As regards the latter type of applicants, some of the guidelines do not apply.

The deadline for comments on the consultation is 3 February 2017.

View EBA consults on guidelines on authorisation and registration under PSD2, 3 November 2016