Question ID:
2019_4679
Legal Act:
Directive 2015/2366/EU (PSD2)
Topic:
Central register of the EBA
Article:
65, 66, 67
COM Delegated or Implementing Acts/RTS/ITS/GLs:
Regulation (EU) 2018/389 – RTS on strong customer authentication and secure communication
Article/Paragraph:
Article 34 Paragraph 2.
Name of institution / submitter:
Microsec Ltd.
Country of incorporation / residence:
Hungary
Type of submitter:
Other
Subject Matter:
"Authorisation number" in eIDAS certificates
Question:

There are two possible interpretations of the Regulation (EU) 2018/389 (RTS) Article 34 paragraph (2) in the case of payment service providers registered in Member State “A”:

1) The authorisation number is the number of the resolution of the NCA (or its predecessor in title) authorising the provision of payment services for the specific PSP, which is not the same as the Registration number appearing in the NCA’s public register.

2) The authorisation number is the Registration number appearing in the NCA’s public register (which is a reference number formed based on the VAT number).

Please clarify whether interpretation 2) above is in line with the requirements of the RTS? Please clarify whether the 8-digit Registration number (based on the VAT number) appearing in the NCA’s public register, and appearing as “National Identification Number” in the EBA PSD2 register or as “National Reference” in the EBA credit institution register can be used as the “authorisation number” in eIDAS certificates?

Background on the question:

I am writing on behalf of “M” Ltd., a qualified trust service provider (QTSP) in Member State “A”, active member of ETSI TC ESI, issuing qualified eIDAS certificates (QWACs and QSealCs) to payment service providers (PSPs) for identification and securing communication pursuant to PSD2 and the RTS on SCA/CSC.

In order to verify the PSD2-specific information to be included in certificates, we have contacted the national competent authority (NCA) supervising payment services in Member State “A”. During our discussions we have discovered that there are two possible interpretations of the RTS requirement on PSD2 authorisation number. “M” Ltd. kindly asks the European Banking Authority (EBA) for guidance regarding the correct interpretation of the RTS, in order to enable the QTSP to issue certificates conformant to legal requirements and facilitating easy and unambiguous identification of PSPs.

The RTS Article 34 paragraph (2) dictates:

“2. For the purpose of this Regulation, the registration number as referred to in the official records in accordance with Annex III (c) or Annex IV (c) to Regulation (EU) No 910/2014 shall be the authorisation number of the payment service provider issuing card-based payment instruments, the account information service providers and payment initiation service providers, including account servicing payment service providers providing such services, available in the public register of the home Member State pursuant to Article 14 of Directive (EU) 2015/2366 or resulting from the notifications of every authorisation granted under Article 8 of Directive 2013/36/EU of the European Parliament and of the Council in accordance with Article 20 of that Directive.”

In our understanding, the purpose of this authorisation number is to allow unique identification of the PSP, and also to facilitate verification of the authorisation status of the PSP in the public register of the home NCA or the public register of the European Banking Authority. EBA maintains two registers, which publish information provided by all the NCAs, corresponding to the two possible sources of verification mentioned in the RTS:

• EBA PSD2 register publishes a copy of the information “available in the public register of the home Member State pursuant to Article 14 of Directive (EU) 2015/2366” – this includes typically payment institutions and e-money institutions; available at: https://eba.europa.eu/risk-analysis-and-data/register-of-payment-and-e-money-institutions-under-psd2

• EBA credit institution register publishes a copy of the information “resulting from the notifications of every authorisation granted under Article 8 of Directive 2013/36/EU of the European Parliament and of the Council in accordance with Article 20 of that Directive” – this includes credit institutions; available at: https://eba.europa.eu/risk-analysis-and-data/credit-institutions-register

The two possible interpretations in the case of PSPs registered in Member State “A”:

1) The authorisation number is the number of the NCA resolution authorising the provision of payment services, which is not the same as the Registration number appearing in the NCA’s public register.

2) The authorisation number is the Registration number appearing in the NCA’s public register (which is a reference number formed based on the VAT number).  

We have investigated a number of cases in practice (see EXAMPLES in the attached file), the following table (see TABLE properly formatted in the attached file) summarizes our findings about the current situation:

NCA public register institution data page / Number of the resolution (as in interpretation 1)

- does not contain this number

- is not searchable by this number

NCA public register institution data page / Registration number (as in interpretation 2)

- contains this number

- is searchable by this number

- contains all current activity permissions

NCA resolution archives / Number of the resolution (as in interpretation 1)

- contains this number for PSPs authorised since 2010, but only as part of the resolution text (PDF or HTML)

- does not contain this number for PSPs authorised before 2010

- is searchable by this number when it contains it

NCA resolution archives / Registration number (as in interpretation 2)

- does not contain this number

- does not contain current activity permissions (in a compiled list)

EBA PSD2 register / Number of the resolution (as in interpretation 1)

- does not contain this number

- is not searchable by this number

EBA PSD2 register / Registration number (as in interpretation 2)

- contains this number in the field “National Identification Number”

- is searchable by this number

- contains all current activity permissions

EBA credit institution register / Number of the resolution (as in interpretation 1)

- does not contain this number

- is not searchable by this number

EBA credit institution register / Registration number (as in interpretation 2)

- contains this number in the field “National Reference”

- is searchable by name only

- contains the CRD institution type

Based on our findings we concluded that using the number of the NCA resolution (as in interpretation 1) as the authorisation number in eIDAS certificates would cause significant difficulties in verification of authorisations of PSPs, and would also cause unnecessary expenses for NCA (in order to provide the information as required by PSD2) and for ASPSPs (relying on the certificates to verify authorisations against NCA register) as well.

 

Date of submission:
23/04/2019
Published as Final Q&A:
14/06/2019
EBA Answer:

Article 34(2) of the Commission Delegated Regulation EU) 2018/389 specifies that ‘for the purpose of this Regulation, the registration number as referred to in the official records in accordance with Annex III (c) or Annex IV (c) to Regulation (EU) No 910/2014 shall be the authorisation number of the payment service provider issuing card-based payment instruments, the account information service providers and payment initiation service providers, including account servicing payment service providers providing such services, available in the public register of the home Member State pursuant to Article 14 of Directive (EU) 2015/2366 (PSD2) or resulting from the notifications of every authorisation granted under Article 8 of Directive 2013/36/EU (CRDIV) of the European Parliament and of the Council (1) in accordance with Article 20 of that Directive’.

The reference to “authorisation number” in this article includes all forms of national identification numbers that are used by national competent authorities (NCAs) under PSD2 and allow the unequivocal identification of the payment service providers (PSPs) in the national registers under PSD2 and CRDIV as well as in the EBA PSD2 and credit institution registers.

For the purpose of national identification numbers used in PSD2 registers, the Commission Implementing Regulation (EU) 2019/410 states that these could be, among others, national identification number used in the respective Members State (e.g. trade register number, VAT number or another tax number), legal entity identified (LEI) or authorisation/ registration numbers used by the competent authority in the national register.

For the purpose of national identification numbers used in the national and EBA registers for credit institutions, these could be LEIs and/or another national identification number (reference code) used in the respective Member State (similar examples as those highlighted in the previous paragraph for the purpose of national identification numbers used in PSD2 registers).

All of the above identification numbers would allow qualified trust service providers to identify the PSP requesting the issuance of an eIDAS certificate for PSD2 purpose and subsequently to verify the status and scope of the authorisation of the PSP.

 

Status:
Final Q&A
Attachments: