SUP 15.14 Notifications under the Payment Services Regulations
Application
1This section applies to payment service providers.
Purpose
The purpose of this section is to give directions and guidance to payment service providers relating to the form, content and timing of notifications required under the Payment Services Regulations.
Notification by credit institutions under regulation 105
A full credit institution to which regulation 105 of the Payment Services Regulations applies must notify the FCA if it refuses a request for access to payment account services from:
- (1)
a person falling within paragraphs (1)(a) to (e) (excluding (1)(d)) of the Glossary definition of payment service provider; or
- (2)
an applicant for authorisation or registration as such a payment service provider.
References in this section to a refusal of a request for access to payment account services include a withdrawal or termination of access to such services.
A notification required by regulation 105(3) of the Payment Services Regulations and SUP 15.14.3D must include duly motivated reasons for the refusal.
Unless the FCA directs otherwise, a notification required by regulation 105(3) of the Payment Services Regulations and SUP 15.14.3D must be submitted by the full credit institution to the FCA:
- (1)
in the form specified in SUP 15 Annex 9D;
- (2)
by electronic means made available by the FCA; and
- (3)
at the same time as it informs the person referred to in SUP 15.14.3D(1) or (2) of its refusal.
If for any reason the full credit institution does not notify the person referred to in SUP 15.14.3D(1) or (2) of its refusal, the full credit institution must submit the notification required by SUP 15.14.3D immediately following the decision by the full credit institution to refuse access.
The direction in SUP 15.14.6D will not apply if the FCA gives a different direction to a specific credit institution, in the light of the particular circumstances surrounding a refusal of access to payment account services, about how to notify the FCA. The FCA is likely to be minded to do so where a credit institution decides to withdraw access to a large number of persons falling within paragraphs (1)(a) to (e) (excluding (1)(d)) of the Glossary definition of payment service provider simultaneously, such that complying with SUP 15.14.6D becomes impractical, and provides advance notice of the proposed withdrawal to their usual supervisory contact at the FCA. For these purposes, fewer than ten persons is unlikely to be considered a large number.
Credit institutions are reminded of the general notification requirements in SUP 15.3, including the obligation to notify the FCA as soon as they become aware of any matter (including a matter which may occur in the foreseeable future) which could affect their ability to continue to provide adequate services to their customers and which could result in serious detriment to a customer of the credit institution (SUP 15.3.1R(3)).
Notification by account servicing payment service providers under regulation 71
An account servicing payment service provider to which regulation 71(8)(c) of the Payment Services Regulations applies must notify the FCA if it denies an account information service provider or a payment initiation service provider access to a payment account under regulation 71(7).
A notification required by regulation 71(8)(c) of the Payment Services Regulations and SUP 15.14.10D must include details of the case and the reasons for denying access.
A notification required by regulation 71(8)(c) of the Payment Services Regulations and SUP 15.14.10D must be submitted by the account servicing payment service provider to the FCA:
- (1)
in the form specified in SUP 15 Annex 10
- (2)
by electronic means made available by the FCA; and
- (3)
immediately after the first occasion on which it denies the account information service provider or the payment initiation service provider in question access to a payment account.
Where:
- (1)
an account servicing payment service provider denies access to more than one payment account or to a payment account on multiple consecutive occasions; and
- (2)
these denials of access:
- (a)
are in respect of the same account information service provider or payment initiation service provider; and
- (b)
arise out of the same facts and happen for the same reasons,
the account servicing payment service provider is required to submit only a single notification in respect of them under regulation 71(8)(c) of the Payment Services Regulations and SUP 15.14.10D.
- (a)
Where an account servicing payment service provider has already submitted a notification in accordance with regulation 71(8)(c) of the Payment Services Regulations and SUP 15.14.10D and continues to deny access to a payment account, it is not required to notify the FCA of a consecutive denial of access that happens after the original notification was sent if it:
- (1)
is in respect of the same account information service provider or payment initiation service provider; and
- (2)
arises out of the same facts and happens for the same reasons.
An account servicing payment service provider that has previously submitted a notification in accordance with regulation 71(8)(c) of the Payment Services Regulations and SUP 15.14.10D must notify the FCA if it subsequently restores access to the payment account for the account information service provider or payment initiation service provider that was the subject of the original notification, unless it indicated in the first notification that it intended to immediately restore access and access was so restored.
A notification required under SUP 15.14.15D must be submitted by the account servicing payment service provider to the FCA:
- (1)
in the form specified in SUP 15 Annex 10;
- (2)
by electronic means made available by the FCA; and
- (3)
immediately after it restores access to the payment account(s) for the account information service provider or payment initiation service provider.
For the purposes of SUP 15.14.12D and SUP 15.14.16D we would expect the account servicing payment service provider to complete and submit the notification as quickly as possible.
Notification of major operational or security incidents under regulation 99
Regulation 99(1) of the Payment Services Regulations provides that, if a payment service provider becomes aware of a major operational or security incident, the payment service provider must, without undue delay, notify the FCA. The purpose of this section is to direct the form and manner in which such notifications must made and the information they must contain, in exercise of the power in regulation 100(2) of the Payment Services Regulations.
The EBA has issued Guidelines on incident reporting under the Payment Services Directive that specify the criteria a payment service provider should use to assess whether an operational or security incident is major and needs to be reported to the FCA. These Guidelines also specify the format for the notification and the procedures the payment service provider should follow.
Payment service providers must comply with the EBA’s Guidelines on incident reporting under the Payment Services Directive as issued on 27 July 2017 where they are addressed to payment service providers.
In particular, a notification required by regulation 99(1) of the Payment Services Regulations must be submitted by the payment service provider to the FCA:
- (1)
within the timescales and at the frequencies specified in the EBA’s Guidelines on incident reporting under the Payment Services Directive;
- (2)
in writing on the form specified in SUP 15 Annex 11D; and
- (3)
by such electronic means as the FCA may specify.
Payment service providers should note that article 16(3) of Regulation (EU) No 1093/2010 also requires them to make every effort to comply with the EBA’s Guidelines on incident reporting under the Payment Services Directive.
Where the electronic means of submission of notifications is known not to be available or operated at the time the incident is first detected, the notification should be sent to the FCA as soon as the electronic means of submission becomes available and operational again. Unless the FCA has informed a specific payment service provider that electronic means of submission are also available to it and operated at other times, the electronic means of submission are available and operated during normal operating hours, as specified by the FCA.
The EBA’s Guidelines on incident reporting under the Payment Services Directive contain guidelines on the completion of the form specified in SUP 15 Annex 11D. Payment service providers should use the same form in all reports concerning the same incident. Payment service providers may not have sufficient information to complete all parts of the form in the initial report. They should complete the form in an incremental manner and on a best effort basis as more information becomes readily available in the course of their internal investigations.
General provisions
SUP 15.6.1R to SUP 15.6.6G (Inaccurate, false or misleading information) apply to payment service providers that are required to make notifications in accordance with this section as if a reference to firm in SUP 15.6.1R to SUP 15.6.6G were a reference to the relevant category of payment service provider and a reference to a rule were a reference to the directions in this section.
Payment service providers are reminded that regulation 142 of the Payment Services Regulations (Misleading the FCA or the Payment Systems Regulator) makes it an offence for a person to knowingly or recklessly provide the FCA with information which is false or misleading in a material particular in purported compliance with the directions given in this section or any other requirement imposed by or under the Payment Services Regulations.
If a payment service provider fails to comply with the directions in this section then the notification is invalid and there may be a breach of the regulation of the Payment Services Regulations or the direction that required the notification to be given.
The Financial Services and Markets Act 2000 (Service of Notices) Regulations 2001 (SI 2001/1420) contain provisions relating to the service of documents on the FCA. They do not apply to notifications required under this section because of the specific directions given in this section.