One of the explicit goals of the European Commission is to strengthen the ability of non-banks to provide payment services.2
Payment institutions and electronic money institutions (hereafter collectively referred to as payment institutions) currently rely heavily on banks to provide their services. This is partly the result of historical developments, partly of regulations and partly of economic reality, as banks are generally better capitalised than payment institutions and often also have a larger capital base and better developed risk management. Many payment institutions find it problematic to be dependent on banks because some banks are their competitors, and these banks have specific operational requirements to serve them. Of course, banks also charge money for their services, which comes at the expense of payment institutions' margins.The idea is that "an open and accessible payment ecosystem" promotes effective competition and innovation in the payment systems market. In this regard, a number of concrete steps are now being taken by the European legislator to make payment institutions less dependent on banks. These steps consist of several legislative proposals, some of which will enter into force by April 9, 2025, while others remain at the proposal stage. On the other hand, this is a tough problem involving conflicting regulatory interests. Below I will therefore first explain what this dependency of payment institutions on banks consists of. Then I will explain which recent bills have been adopted or proposed by the European regulator to strengthen the position of payment institutions and how the effectiveness of these bills is at the same time limited by other (regulatory) interests promoted by the ECB and DNB.
Below I explain, in a simplified way, how retail payments typically function.3 In an electronic funds transfer, there is no physical movement of cash (bills or coins) between the payment service providers involved. This is impractical given the enormous volumes of transactions. Electronic funds transfer is an operation that exists only in computer systems. This operation consists of two parts. Authorisation on the one hand and clearing and settlement on the other. These technical processes are facilitated by payment processors - in the terminology of the Wft (Wet op het financieel toezicht/Dutch Financial Supervision Act): settlement companies.4 The picture below shows this schematically.5 I will explain these processes.6
After the initiation of a money transfer by the payer (step 1 in the picture), the process of authorisation begins. Authorisation is step 2 in the picture. The payer's payment service provider verifies that the money transfer has been authenticated by the payer (and not by a fraudster who stole the payer's login credentials) and that there is sufficient balance in the payer's account to execute the money transfer.
The confirmation from the payer's payment service provider to the payee's payment service provider that all requirements for a successful payment have been met is called the authorisation of a funds transfer. With this, the payer's payment service provider provides a guarantee that payment will be made. Depending on the payment scenario, this is more or less complex.
This process is relatively self-explanatory in the scenario that I self-initiate my funds transfer with ABN AMRO's internet banking app, since ABN AMRO will largely perform the authorisation itself. It becomes more complicated, however, if I initiate the payment through the payee. This is the case, for example, with a card payment when I pay with my debit card or smartphone in a store, for example at the bakery when I get a cheese croissant there. Then the organisation behind the ATM - companies that provide the facilities for (online) stores to accept electronic payments are called collecting PSPs 7 - will first have to recognise my debit card as an ABN AMRO debit card and then automatically contact ABN AMRO to authorise the payment, before I get my cheese croissant from the bakery. This authorisation process is a technical process, which takes place behind the scenes. It is important to note that the payment service providers of the payee and payer must be able to reach each other. They must therefore both be affiliated with the same payment scheme, and have the technical infrastructure to communicate with each other via a payment processor. This process of authorisation also immediately explains why it is usually not possible to withdraw money when the internet is down and why the banking app does not work then. After all, then the payer's payment service provider cannot be reached.8 Finally, completing the authorisation, and the resulting guarantee of payment, ensures that the baker gives me the cheese croissant even though he has not yet received the money in his account. That doesn't happen until the next step, clearing and settlement.
Clearing and settlement refers to the actual moving of the money from the payer to the payee. These are steps 3 and 4 in the picture.
The simplest case involves a customer transferring money to another customer at the same payment service provider. If I transfer EUR 50 from my ABN AMRO account to my mother who also banks at ABN AMRO, ABN AMRO notes that my account at ABN AMRO will have EUR 50 less in it and ABN AMRO increases my mother's balance by EUR 50.
However, if I transfer EUR 50 to my brother who banks at ING, things get more complicated. ABN AMRO records minus EUR 50 on my account and ING records plus EUR 50 with my brother, but why would ING do that do? ING does this because it receives money from ABN AMRO. In this case, this is arranged because ING and ABN AMRO both hold accounts at DNB (as part of the Eurosystem).9 Because of my transfer, ABN AMRO's balance at DNB is reduced by EUR 50 and ING's balance at DNB is increased by EUR 50.
In practice, transactions are cleared before they are settled. Clearing implies that all transactions of the parties joined to a clearing system are cleared (and possibly centralised with one counterparty) on a periodic basis (e.g. daily). Instead of all parties involved transferring all individual transactions to each other, only the net balance of all transactions of each party is settled. In the Netherlands, this clearing role for payments between Dutch banks is traditionally fulfilled by equensWorldline NV, but nowadays also by the payment processors affiliated with the Card Schemes.10 The banks then pay from their T2 (formerly TARGET2) account with DNB (as a sub-part of the Eurosystem).11
Payment institutions have indirect access to the payment infrastructure (hereinafter also referred to as payment system). For example, payment institutions themselves maintain a bank account with a bank to receive funds. For example, a payment institution that conducts the business of collecting PSP receives money on an account that it itself maintains with a bank. It is the bank that is connected to the clearing and settlement infrastructure and can receive payments from an-other banks. Therefore, if you buy flowers online, for example, you will see both the name of the collecting PSP (e.g. Mollie or Buckaroo) on the statement and a bank account number at a major bank, e.g. ING. This is where the collecting PSP holds the account and receives the money. Below is a schematic illustration of the role of be- ling institutions (non-banks) in (retail) payment traffic.12 The reason for this cooperation with banks is that these and payment institutions themselves cannot get direct access to the payment infrastructure, about which more in paragraph 6.
Another reason why, in practice, payment institutions are forced to cooperate with banks lies in the asset segregation rules. Payment institutions must safeguard and secure money received from the client.13 After all, this money is meant to make payments with or return to the client. In Dutch practice, most payment institutions have a foundation that holds the money for the clients. With this foundation, they implement the provision in the Bpr Wft (Decree on Prudential Rules under the Financial Supervision Act) that requires payment institutions to keep the money in such a way that other creditors of the payment institution, especially in the event of the payment institution's insolvency, cannot recover their claims from these funds.14 An important issue is what the foundation in turn may do with the funds received. Under PSD2, these funds may either be held in a bank account or invested in safe, liquid, low-risk assets.15 The most common and simplest solution is one in which the foundation holds the funds in an account with a bank. For this, the foundation and thus the underlying payment institution is dependent on this bank.
To strengthen the position of payment institutions, the European regulator has recently taken action in two areas. On the one hand, the European regulator is trying to ensure that payment institutions can gain direct access to that higher-order payment infrastructure that has so far not been accessible to payment institutions (more on this in paragraphs 6 and 7). On the other hand, the European regulator seeks to limit the grounds on which banks can refuse service to payment institutions. I will explain this in paragraph 5.
As explained above, payment institutions will often need an account at a bank. This of course requires cooperation from this bank.
Already in PSD2, the regulator has tried to enforce this cooperation by requiring banks to give payment institutions access to payment services in an objective, non-discriminatory and proportionate manner.16
Notwithstanding this right, there is often discussion about this. In the Netherlands, a refusal to provide access must be reported to the Authority Consumer and Market (ACM). Recently (Oct. 11, 2024), the ACM apparently had discussions with Rabobank about this.17 The ACM writes on its website: "After discussions with the ACM, Rabobank has adjusted its policy in parts and removed entry barriers for payment institutions." The European legislator is proposing measures in the proposal for PSD3, more precisely the Proposal for a Payment Services Regulation (PSR), to improve the position of payment institutions vis-à-vis banks.18 PSD3 and PSR, if handled expeditiously by the European legislature, will be in force by Q4 2026/Q1 2027. Whereas PSD2 only provided for the right to obtain a payment account on an objective, non-discriminatory and proportionate basis, PSR exhaustively defines the circumstances under which a bank may refuse or close a payment account to a payment institution. The limitative list of reasons is:
the bank has serious grounds to suspect that the payment institution is deficient in money laundering or terrorist financing supervision or that the applicant or its customers are engaged in illegal activities;
there is or has been a breach of contract by the payment institution for a payment account;
insufficient information and documents for a checking account were received from the payment institution;
the payment institution or its business model exhibits an excessive risk profile;
the payment institution would impose disproportionately high compliance costs on the bank.
The bank must provide written justification for refusing or closing a payment account and must specifically address the payment institution in question, in accordance with a format to be designed by the EBA. The payment institution can then appeal to the competent authority, expected to be the ACM.19 What is interesting is that a procedure is created here specifically for payment institutions before the ACM as an alternative to the current usual procedure before the civil courts.20 How this administrative law procedure will relate to civil law procedures requires further study.
On the other hand, there are also existing regulatory obligations that make it more difficult for banks to offer payment accounts to payment institutions. In particular, on 12 December 2023, the Dutch Central Bank (De Nederlandsche Bank) published good practices to provide payment institutions and electronic money institutions with guidance on managing risks associated with providing payment services to (customers with) sub-merchants.21 In these DNB stipulates that, in its opinion, payment institutions must manage the risk that they indirectly facilitate money laundering. In concrete terms, this means that if payment institutions provide services to another licensed financial institution, it is not sufficient for them to conduct a superficial investigation into this financial institution, but in their assessment, they must also assess the risks of the underlying customers and the control measures of this financial institution. This logic also applies to a bank offering a payment account to a payment institution.22 In practice, this is often the reason that banks refuse a payment institution or terminate the relationship with a payment institution.23 DNB may require banks to manage money laundering risk through monitoring and KYC also for accounts of licensed payment institutions, provided that banks do not supervise payment institutions in practice, as that is reserved for the supervisor.24 This dual responsibility whereby banks may not rely on the fact that the payment institution holding a payment account with them is also obliged to manage the money laundering risk, actually makes it more difficult to offer this payment account. If banks are too risk-averse in this regard, it may result in payment institutions having insufficient access to the banking system and being curtailed in their services.25 The provision in PSR should be seen as a way to fine-tune this precarious balance.26
A payment institution may also want to play its own role in authorisation, clearing, and settlement of payments, without being dependent on a bank that sits between them and the payment processor. Then this payment institution will need access to the infrastructure that facilitates this. For example, when making an payment at a bakery to buy a cheese croissant, the party providing the pin terminal to the bakery must be able to verify that the authorisation was completed correctly. To do so, this party must be connected to the authorisation network. Next, this party will also want to be able to receive the money on behalf of the baker. If this party wants to do this itself, it must have direct access to the clearing and settlement systems. PSD2 already wanted to help these parties. To achieve this, PSD2 already mandates that authorisation, clearing, and settlement systems must treat all parties licensed as payment institutions (or electonic money institutions or credit unions) equally when requesting access to these payment systems.27 A valid reason for denying access may be that the said party does not meet the risk management requirements of the payment system. PSR makes no major changes to this provision.28
However, this obligation to provide access in PSD2 did not apply to payment systems covered under the Settlement Finality Directive.29 30 This is a significant limitation of this right of access, as the most important payment systems are covered by this Directive. In the Netherlands this includes the T2 (formerly TARGET2) of the Eurosystem and the CSM (Clearing and Settlement Mechanism) of equensWorldline NV.31 The reason that these important systems are exempted from the effect of this access provision from PSD2 is, that the Settlement Finality Directive allows access to these payment systems only for banks and investment firms.32 For the record, the Settlement Finality Directive does not exclude access for other institutions, but requires Member States to facilitate it only for banks and investment firms.33
This will change as of 9 April 2025. The Instant Payments Regulation changes the Settlement Finality Directive so that payment institutions can access major payment systems such as T2 and CSM (Clearing and Settlement Mechanism) of equensWorldline NV.34 The reason for this was that it would probably be more difficult for payment institutions to process instant payments if a bank acted as an intermediary. In the extension of this amendment to the Settlement Finality Directive, the instant payments regulation modifies the already existing obligation in PSD2 of payment systems to provide access to payment institutions. This obligation will now also apply to systems covered by the Settlement Finality irective.35 In addition, the Instant Payments Regulation in PSD2 introduces specific governance and risk management requirements for payment institutions that will use this new capability. The ECB has now published a "Policy on access by non-bank payment service providers to central bank-operated payment systems and to central bank accounts," which elaborates on this possibility for payment systems operated by the ECB or by national central banks that are part of the Eurosystem.36 Although laid down in open standards in PSD2, in practice these may well prove to be onerous financial risk management and operational risk management requirements that only larger payment institutions can meet.
As explained in paragraph 3, payment institutions also depend on banks to keep/secure customer funds. After all, all outstanding customer money must be kept safe. The instant payments regulation also aims to provide more options for payment institutions in this area and is doing so through an amendment of PSD2, which should be implemented by member states by April 2025.37 Payment institutions will also be allowed to secure funds with a central bank "at that central bank's discretion. This would seem like good news for payment institutions, but in fact it is not. The ink of the Instant Payments Regulation of March 13 2024 was not yet dry or the ECB published on July 19, 2024, that it will not offer this possibility.38 The reason given by the ECB is that it would allow payment institutions to offer an overly secure alternative to banks. This would essentially become a synthetic central bank digital currency, in which customers, provided the asset segregation is designed correctly in legal terms, would only run debtor risk on the central bank. This would undermine the role of the banks: in times of uncertainty, customers would be better off depositing their money with a payment institution, which in turn deposits the money with the ECB, rather than with a bank. This could exacerbate the risk of a bank run on banks, thus threatening financial stability. It could also create confusion, as it would no longer be clear to the public how safe their money is at which financial institution. If one payment institution already secures funds with a central bank, but another does not, the customer would have to assess how safe each payment institution is. The ECB is also considering that electronic money institutions that issue e-money tokens cannot secure customer money with the central bank either, although the MiCAR does suggest that they could.39 Payment institutions are therefore allowed by the ECB to hold an account at the central bank with a positive balance, but only to the extent that the size of this balance is directly related to the volume of expected payment transactions. However, they will not be able to secure all the money owed to them by customers at the central bank and will remain dependent on banks for this.
Payment markets continue to move. The (European) legislator tries to strengthen the role of payment institutions (and electronic money institutions) in the interest of competition. However, the legislator is running up against the limits of other legitimate regulatory interests. The question is therefore whether the proposed measures will be effective. Perhaps payment institutions seeking parity with banks may ultimately need to transition into banks.
1. Emanuel van Praag is editor of this journal, an attorney at Kennedy Van der Laan and Professor of Financial Technology and Law at Erasmus University Rotterdam.
2. Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on a Retail Payments Strategy for the EU, Brussels September 24, 2020, COM(2020) 592 final, p. 24 and 25.
3. In this paragraph, I draw somewhat from my book E.J. van Praag, PSD2: towards open banking and banking in an ecosystem, (VDHI No. 169), 2020 8.5 and 11.1 to 11/4.
4. In the Netherlands, the largest settlement companies are equensWorldline NV, Mastercard Europe SA, Visa Europe Limited and CCV. These are the licensed settlement companies in the DNB register. Only settlement companies that exceed certain thresholds in terms of volume require a license (see Wft art. 2: 3ob30b and 2:30g).
5. Retrieved from BIS, Committee on Payments and Market Infrastructures, Non-banks in retail Payments, September 2014, p. 10.
6. Credit card payments follow a slightly different pro-cess. I rest this difference. For this process, see R.E. Van Esch Giraal/Elektronisch betalingsverkeer (R&P No. FR7), 2023/1.5.8.
7. The names of such companies are often on the pin-vending machine. Examples include CCV, Ingenico and Adyen. Adyen has a banking license but conducts the business model of a collecting PSP here.
8. There are fallback mechanisms for such situations whereby authorisations may 0062e made within predetermined limits, locally/offline and/or by equensWorldline NV on behalf of the unreachable entity.
9. Alternatively, they could hold accounts with each other.
10. CPSS - Red Book - 2012, Payment, clearing and settlement systems in the Netherlands, p. 326. The full name is equensWorldline SE. equensWorldline SE holds a DNB (De Nederlandsche Bank) license as a settlement company for this purpose.
11. Hence, equensWorldline NV requires as part of its admissions criteria that the participant provide a T2 account. The document is available at https://worldline.com/content/dam/worldline/global/documents/statements/admission-criteria-and-default-rules.pdf, accessed October 30, 2024.
12. Retrieved from BIS, Committee on Payments and Market Infrastructures, Non-banks in retail Payments, September 2014, p. 13.
13. PSD2, art. 10 and EMD2, art. 7 and art. 3:29a Wft.
14. See further 40a and 40b Pbr Wft and Art. 3:29aa Wft. An alternative possibility is an insurance or guarantee from a bank or insurer, or a quality account, but to my knowledge these alternative possibilities are not used in practice.
15. PSD2, art 10 and Bpr Wft, art 40a paragraph 2 and 40b paragraph 3.
16. PSD2, art. 36 and 5:88a Wft.
17. See ACM, Rabobank removes restrictions on payment institutions after talks with ACM, available at: https://www.acm.nl/en/publications/rabobank-removes-access-restrictions-payment-service-providers-following-discussions-acm, accessed Oct. 29, 2024.
18. Proposal for a Regulation of the European Parliament and of the Council on payment services in the internal market and amending Regulation (EU) No 1093/2010, 28 June 2023, COM(2023) 367 final, 2023/0210(COD), Art. 32.
19. After all, the ACM is now responsible for compliance with PSD2, Art. 36 and 5:88a Wft which provision is now extended and fleshed out in PSR.
20. For examples of civil court proceedings, see Rechtbank Amsterdam 6 July 2023, ECLI:NL:RBAMS:2023:4493, Rechtbank Amsterdam 15 February 2023, ECLI:NL:RBAMS:2023:2975, Rechtbank Amsterdam 7 September 2022, ECLI:NL:RBAMS:2022:5255 and District Court of Amsterdam December 13, 2021, ECLI:NL:RBAMS:2021:7274.
21. Available at: https://www.dnb.nl/media/uuun4vcc/good-practices-sub-merchants-en.pdf, accessed October 29, 2024.
22. In my view, this is also required under the EBA Final Report Guidelines on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions ("The ML/TF Risk Factors Guidelines") under Articles 17 and 18(4) of Directive (EU) 2015/849, p. 60, where EBA addresses correspondent banking.
23. For examples of civil court proceedings, see Amsterdam District Court July 6, 2023, ECLI:NL:RBAMS:2023:4493, Amsterdam District Court Feb. 15, 2023, ECLI:NL:RBAMS:2023:2975, Amsterdam District Court Sept. 7, 2022, ECLI:NL:RBAMS:2022:5255 and Amsterdam District Court Dec. 13, 2021, ECLI:NL:RBAMS:2021:7274.
24. CJEU, March 10, 2016, C 235/14. Although rendered under PSD1, the logic of this judgment, in my opinion, also applies under PSD2.
25. EBA has concerns about this. See EBA Call for input on 'de-risking' and its impact on access to financial services eba.europa.eu/call-input-'de-risking'-and-its-impact-access-financial-services.
26. See also CJEU April 25, 2013, C-212/11, in which the Court commented on this balance.
27. PSD2, art. 35 and preamble 49-51, 5:88 Wft. This does not apply to so-called three-party payment systems. See further CJEU February 7, 2018, C-643/16.
28. PSR, art. 31.
29. Directive 98/26/EU.
30. Nor does this provision apply to payment systems composed exclusively of payment service providers belonging to one group. An example of this is American Express where both the payer and payee deal directly with American Express. PSD2 art. 35(2)(b) and preamble 52, 5: 88(3) Wft and CJEU 7 February 2018, C-643/16 (American Express Company v. Diners Club International Limi-ted,MasterCard Europe SA,).
31. See further the list prepared by ESMA SFD Designated Payment and Securities Settlement Systems, Last update 15 July 2024 available at: https://www.esma.europa.eu/document/list-designated-authorities-payment-systems-and-securities-settlement-systems, last accessed 29 October 2024.
32. Directive 98/26/EU, art 1 sub b. In the Netherlands implemented in the bankruptcy law art 212a. et seq.
33. For example, the Bank of England allowed non-banks to access systems covered by the Finality Directive, while England was still under EU law at the time. See https://www.bankofengland.co.uk/news/2017/july/boe-extends-direct-access-to-rtgs-accounts-to-non-bank-payment-service-providers.
34. Regulation (EU) 2024/886 of the European Parliament and of the Council of 13 March 2024 amending Regulations (EU) 260/2012 and (EU) 2021/1230 and Directives 98/26/EC and (EU) 2015/2366 as regards instant transfers in euro, Art. 4 (amended Art. 2 of Directive 98/26/EU.
35. Regulation (EU) 2024/886 of the European Parliament and of the Council of 13 March 2024 amending Regulations (EU) No 260/2012 and (EU) 2021/1230 and Directives 98/26/EC and (EU) 2015/2366 as regards instant-over-makings in euros, art. 3 (new art. 35a of Directive 2015/2366/EU).
36. ECB Policy on access by non-bank payment service providers to central bank-operated payment systems and to central bank accounts, July 19, 2024.
37. Regulation (EU) 2024/886 of the European Parliament and of the Council of 13 March 2024 amending Regulations (EU) 260/2012 and (EU) 2021/1230 and Directives 98/26/EC and (EU) 2015/2366 as regards instant transfers in euro, Art. 3 (adapted Art. 10(1) of Directive 2015/2366/EU).
38. ECB Policy on access by non-bank payment service providers to central bank-operated payment systems and to central bank accounts, July 19, 2024.
39. Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on cryptoasset markets and amending Regulations (EU) 1093/2010 and (EU) 1095/2010 and Directives 2013/ 36/EU and (EU) 2019/1937, preamble 82.
About Emanuel van Praag
Every day we send out a free e-mail with the most important headlines of the last 24 hours.
Subscribe now