In this issue:
1. Law No. 209/2019 on payment services and for the amendment of certain enactments
2. Law No. 210/2019 on electronic money issuance
Law No. 209/2019 on payment services and for the amendment of certain enactments
Law No. 209/2019 on payment services and for the amendment of certain enactments (“Law No. 209/2019”) transposes in the national law Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No. 1093/2010, and repealing Directive 2007/64/EC (“PSD 2”).
Law No. 209/2019 was published in the Official Journal of Romania on 13 November 2019 and came into force on 13 December 2019.
This law is applicable mostly in the banking system and has the following main purposes: (i) to improve the standards based on which payment services are provided; and (ii) to boost innovation on the payment services market. The law is meant both for the incumbent payment service providers (banks, payment institutions, electronic money issuers, etc.) and for new players on the payment services market – payment initiation service providers and account information service providers.
The main amendments / novelties brought by Law No. 209/2019 are as follows:
1. Extension of the scope of application of the law
Law No. 209/2019 extends the scope of application of the provisions on the transparency of conditions and requirements for payment services information, as regards the following:
– Payment transactions in a currency that is not the currency of a Member State where both the payer’s payment service provider and the payee’s payment service provider are, or the sole payment service provider in the payment transaction is, located in a Member State, in respect to those parts of the payments transaction which are carried out in a Member State; and
– Payment transactions in all currencies where only one of the payment service providers is located in a Member State, in respect to those parts of the payment transaction which are carried out in a Member State.
2. Excluded payment services
Law No. 209/2019 brings clarifications as to the services excluded from the application of legal requirements, as follows:
– Commercial agent – the exclusion shall be applicable only to the payment transactions made through a commercial agent authorised to act on behalf of only the payer or only the payee;
– Telecommunications – the exclusion shall be applicable only to payment transactions made for the subscribers of a provider of electronic communications networks or services, in addition to the electronic communication services and charged to the electronic communications services invoice, in order to purchase digital content and voice-based services, regardless of the device used for the purchase or consumption thereof, or in order to purchase travel tickets / access permits or in charitable activities, if an electronic device was used to perform the payment transactions, provided that they cumulatively meet the following conditions: (i) the value of each single payment transaction does not exceed EUR 50; and (ii) the cumulative value of payment transactions for an individual subscriber does not exceed EUR 300 per month or, where a subscriber pre-funds its account with the provider of the electronic communications network or service, the cumulative value of payment transactions does not exceed EUR 300 per month; and
– Limited networks – it restricts the scope of use of payment instruments which are specific to the network to a “very limited” range of goods or services, stipulating at the same time that this category includes payment instruments which can be used only to: (i) purchase goods and services sold in retail by the payment instrument issuer; (ii) purchase goods and services from a network of retailers either operating under the same trademark as the issuer or having a centralized management, business methods and practices which are consistent with the issuer’s; or (iii) purchase a single type of goods or services or a limited number of goods or services which are directly dependent from a functional perspective.
Moreover, Law No. 209/2019 provides for the obligation that the entities carrying out payment services based on the limited network exclusion and for which the total value of payment transactions executed over the preceding 12 months exceeds the amount of EUR 1 million, would ask, by the end of the following month after the one when they exceeded the said value threshold, the National Bank of Romania’s opinion on whether they meet the criteria provided by the law for falling within the scope of a limited network.
3. New activities included within the scope of payment services
Law No. 209/2019 extends the scope of payment services by two new types of activities: (i) payment initiation services; and (ii) account information services.
As regards these services, Law No. 209/2019 introduces new categories of payment service providers, known under the generic name of “third-party service providers”. This category includes:
– Account information service providers; and
– Payment initiation service providers.
Taking over the provisions of PSD 2, Law No. 209/2019 regulates the activity of these new categories of payment service providers, providing for specific conditions for authorisation and operation. For the provision of these services, Law No. 209/2019 stipulates that credit institutions shall ensure that these new categories of providers have access to payment accounts services on an objective, non-discriminatory and proportionate basis.
4. Strong customer authentication
Taking over the provisions of PSD 2, Law No. 209/2019 requires payment service providers to apply strong customer authentication when they access their payment account online, they initiate an electronic payment transaction or carry out any action through a remote channel which may imply a risk of payment fraud or other abuses. Strong customer authentication means an authentication based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others. Such authentication elements should be designed in such a way as to protect the confidentiality of the authentication data. The strong authentication measures are regulated by the Commission Delegated Regulation (EU) 2018/389 adopted by the European Commission to supplement PSD 2 with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication. The Regulation came into force on 14 September 2019, it has direct applicability in Romania and provides for the technical requirements and security measures for the application of strong customer authentication and to ensure secure communication with third-party payment service providers. This allowed the strong customer authentication measures to be implemented by Romanian payment service providers even before Law No. 209/2019 for the implementation of PSD 2 came into force.
5. Confirmation on the availability of funds
The novelty is that Law No. 209/2019 allows payment service providers issuing card-based payment instruments to ask account servicing payment service providers to confirm whether an 3 amount required for the performance of a card-based payment transaction is available in the payer’s payment account. For data privacy reasons, the confirmation consists merely in a simple “yes” or “no” answer, not in a statement of account balance.
6. Prohibition to apply charges to card-based payments
The new law prohibits the payee to request any charges from the payer for using a particular payment instrument.
Law No. 210/2019 on electronic money issuance
Law No. 210/2019 on electronic money issuance (“Law No. 210/2019”) was published in the Official Journal of Romania on 13 November 2019 and came into force on 13 December 2019, repealing the provisions of the current Law No. 127/2011 on electronic money issuance.
Although it fully repeals the former regulation on electronic money issuance, Law No. 210/2019 does not bring major changes. Its main target is to align to Law No. 209/2019 on payment services and for the amendment of certain enactments.
The main novelties / amendments are as follows:
– According to Law No. 210/2019, the creditors of the electronic money issuer, others than electronic money holders, cannot obtain freezing by interim measures and cannot enforce, in any situation, the funds received in consideration for the electronic money, including in the case when the electronic money issuer becomes insolvent. This institutes an additional protection for electronic money holders compared to the previous regulation, which only provided for the rule that electronic money holders had priority before other creditors.
– Law No. 210/2019 limits to 5 years the retention period for the documents related to electronic money issuance and payment service provision. The former regulation provided for a term of at least 5 years.
– It is expressly provided that certain operational functions related to electronic money issuance may be outsourced both to entities located in Romania and to entities from abroad.