Legal alert no. 75

Decrete-Law 91/2018, of 12.11

On November 12^th, 2018, the Decree-Law 91/2018 (hereinafter "DL" or "DL 91/2018") was published in the Official Gazette of the Republic of Portugal, which approves the new Legal Regime of Payment Services and Electronic Currency, transposing Directive (EU) 2015/2366 (hereinafter "PSD2").

The referred DL aims to fulfill the objectives foreseen by PSD2:

•      Respond to the challenges of the dynamic reality of payment services, with a view to the widespread deployment of new means of payment;

•      Address concerns about consumer protection and safety;

•      Provide for the security of electronic payments; and

•      Introduce improvements to the regime, in particular regarding the systematic organization of the diploma and the introduction of measures implementing three European regulations.

The DL 91/2018 regulates two new payment services:

•      Payment Initiation Services (PIS),  means a service to initiate a payment order at the request of the payment service user with respect to a payment account held at another payment service provider; and

•      Account Information Services (AIS), means an online service to provide consolidated information on one or more payment accounts held by the payment service user either with another payment service provider or with more than one payment service provider.

New rules are also introduced on:

·         Access to payment systems and payment accounts (chapter VIII), and

·         Operational and safety risks management (chapter IX).

The Bank of Portugal is empowered to carry out the prudential and behavioral supervision of payment institutions and electronic money, as well as the withdrawal of authorization of its activity, with a provision of a single regime for the wound up of both institutions.

The appointment of a central contact point shall be required for payment institutions and for electronic money institutions established in another Member State.

The transparency objectives are reinforced by the provision by the Bank of Portugal of a public register listing the entities providing payment services and issuers of electronic money.

Title III of the DL provides rules for the operationalization of payments, with particular regard to security and the avoidance of unjustified obstacles.

It may be agreed, by way of derogation from payment service provider's obligations related to the transparency of conditions, as well as information requirements, in cases of pre-paid payment instruments that have a limit to store funds that do not exceed 250€ (compared with the previous limit of €150).

The new DL also emphasises the following key points:

·         The enforceability of mechanisms that focus on the remuneration practices of employees who deal directly with clients, or by those performing management functions;

·         The equivalence of micro-enterprises with consumers, enabling them to benefit from the same level of protection, particularly in terms of information and rules applicable to the execution of payment transactions (with exceptions, allowing micro-enterprises access to SEPA B2B direct debits);

·         The requirement for a strong client authentication based on the use of 2 or more elements belonging to the knowledge category (something that only the user knows), possession (something that only the user has) and inherence (something that the user is) which are independent, as far as the violation of one of them does not compromise the reliability of others, in order to protect the confidentiality and integrity of users' custom security credentials;

·         The inclusion, in remote payment transactions, of user authentication that includes elements that dynamically associate the operation with a specific amount and beneficiary, so that the user is always informed of what he is authorizing;

·         The reduction of the maximum amount (from €150 to €50) for which the sender may be liable, also limiting that responsibility to the available balance or to the limit of the line of credit associated with the account or the payment instrument, except in case of fraudulent action or gross negligence on your part.

Title VI of the DL also provides for implementing measures for three European regulations:

·         Reg. (EC) 924/2009, of 16.09.2009, on cross-border payments in the Community;

·         Reg. (EU) 260/2012, of 14.03.2012, establishing technical and business requirements for credit transfers and direct debits in euro; and

·         Reg. (EU) 2015/751, of 29.04.2015, on interchange fees for card-based payment transactions.

The diploma should also be read in conjunction with the Commission Delegated Regulations, which complement PSD2:

·         (EU) 2018/389, of 27.11.2017 – with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication; and

·         (EU) 2017/2055, of 23.06.2017 - with regard to regulatory technical standards for the cooperation and exchange of information between competent authorities relating to the exercise of the right of establishment and the freedom to provide services of payment institutions.

It revokes the following provisions:

·         DL 317/2009, of 30.10 – the previous legal regime concerning access to the activity of payment institutions and the provision of payment services, which transposed the Directive 2007/64/CE (known as “PSD1”);

·         DL 141/2013, of 18.10 – with regard to national measures necessary for the implementation of the provisions of the Reg. UE 260/2012, of 14.03.2012;

·         Article 4 of DL 18/2007, of 22.01.

As a transitional provision, to the contracts in force concerning payment services will be applied to the most favorable provisions for the users of the services.

The diploma also requires an up to date interpretation of the legislation in force:

·         All references made to DL 317/2009, of 30.10 and to the DL 242/2012, of 7.11, considered made to the norms of the present diploma; and

·         All references made to the Directive 2007/64/CE, of 13.11 (PSD1), shall be deemed to have been made to Directive 2015/2366 of 25.11 (PSD2).

Finally, the DL 91/2018, of 12.11, entered into force on the day after its publication, that is, on November 13^rd, 2018.

Access here the full version of DL 91/2018.