Guideline (EU) 2019/1849 of the European Central Bank of 4 October 2019 amending Guideline ECB/2012/27 on a Trans-European Automated Real-time Gross settlement Express Transfer system (TARGET2) (ECB/2019/30)

L 283/64 E N O f f i c i a l J o u r n a l o f t h e E u r o p e a n Union 5.11.2019 GUIDELINES GUIDELINE (EU) 2019/1849 OF THE EUROPEAN CENTRAL BANK of 4 October 2019 amending Guideline ECB/2012/27 on a Trans-European Automated Real-time Gross settlement Express Transfer system (TARGET2) (ECB/2019/30) THE GOVERNING COUNCIL OF THE EUROPEAN CENTRAL BANK, Having regard to the Treaty on the Functioning of the European Union, and in particular the first and fourth indents of Article 127(2) thereof, Having regard to the Statute of the European System of Central Banks and of the European Central Bank, and in particular Article 3.1 and Articles 17, 18 and 22 thereof, Whereas: (1) On 26 April 2007, the Governing Council of the European Central Bank adopted Guideline ECB/2007/2 (1) governing TARGET2, which is characterised by a single technical platform, the Single Shared Platform (SSP). That Guideline was amended and recast as Guideline ECB/2012/27 (2). (2) A new SSP functionality has been established, enabling the processing of very critical and critical payments in a contingency, to which Eurosystem central banks must adhere. (3) There is a need to clarify the conditions under which investment firms may participate in TARGET2, including the requirement for a legal opinion regarding investment firms established outside the European Economic Area (EEA) and applying for direct participation in a TARGET2 component system. (4) It is necessary to clarify that participants in TARGET2 component systems must adhere to the TARGET2 self- certification requirement and to the endpoint security requirements of TARGET2 network service providers, and inform the relevant Eurosystem central bank of any crisis prevention or management measures to which they are subject. (5) It is also necessary to clarify and update certain other aspects of Guideline ECB/2012/27. (6) Therefore, Guideline ECB/2012/27 should be amended accordingly, HAS ADOPTED THIS GUIDELINE: Article 1 Amendments Guideline ECB/2012/27 is amended as follows: 1. Article 2 is amended as follows: (a) point (44) is replaced by the following: ‘(44) “Information and Control Module (ICM)” means the SSP module that allows PM account holders to obtain online information and gives them the possibility to submit liquidity transfer orders, manage liquidity and, if applicable, initiate backup payment orders or payment orders to the Contingency Solution in a contingency;’; (1) Guideline ECB/2007/2 of 26 April 2007 on a Trans-European Automated Real-time Gross settlement Express Transfer system (TARGET2) (OJ L 237, 8.9.2007, p. 1). (2) Guideline ECB/2012/27 of 5 December 2012 on a Trans-European Automated Real-time Gross settlement Express Transfer system (TARGET2) (OJ L 30, 30.1.2013, p. 1).5.11.2019 E N O f f i c i a l J o u r n a l o f t h e E u r o p e a n Union L 283/65 (b) the following point (86) is added: ‘(86) “Contingency Solution” means the SSP functionality that processes very critical and critical payments in contingency.’; 2. in Article 21, the following paragraph 6 is added: ‘6. The Eurosystem CBs shall connect to the Contingency Solution.’; 3. Annexes II, IIa, IIb, III, IV and V are amended in accordance with the Annex to this Guideline. Article 2 Taking effect and implementation 1. This Guideline shall take effect on the day of its notification to the national central banks of the Member States whose currency is the euro. 2. The national central banks of the Member States whose currency is the euro shall take the necessary measures to comply with this Guideline and apply them from 17 November 2019. They shall notify the ECB of the texts and means relating to those measures by 17 October 2019 at the latest. Article 3 Addressees This Guideline is addressed to all Eurosystem central banks. Done at Frankfurt am Main, 4 October 2019. For the Governing Council of the ECB The President of the ECB Mario DRAGHIL 283/66 E N O f f i c i a l J o u r n a l o f t h e E u r o p e a n Union 5.11.2019 ANNEX Annexes II, IIa, IIb, III, IV and V to Guideline ECB/2012/27 are amended as follows: 1. Annex II is amended as follows: (a) in Article 1, the definition of Contingency Module is deleted; (b) in Article 1, the definition of ‘Information and Control Module (ICM)’ is replaced by the following: — ‘“Information and Control Module (ICM)” means the SSP module that allows PM account holders to obtain online information and gives them the possibility to submit liquidity transfer orders, manage liquidity and, if applicable, initiate backup payment orders or payment orders to the Contingency Solution in a contingency,’; (c) in Article 1, the following definition is added: — ‘“Contingency Solution” means the SSP functionality that processes very critical and critical payments in contingency,’; (d) in Article 4(2), point (a) is replaced by the following: ‘(a) treasury departments of central or regional governments of Member States;’; (e) in Article 4(2), point (c) is replaced by the following: ‘(c) (i) investment firms established in the Union or the EEA, including when they act through a branch established in the Union or the EEA; and (ii) investment firms established outside the EEA, provided that they act through a branch established in the Union or the EEA;’; (f) in Article 8(1)(b), point (ii) is replaced by the following: ‘(ii) for the entities referred to in Article 4(1)(b) and in Article 4(2)(c)(ii), provide a country opinion in the form specified in Appendix III, unless the information and representations to be provided in such country opinion have already been obtained by the [insert name of CB] in another context.’; (g) Article 11(9) is replaced by the following: ‘9. Participants shall immediately inform the [insert name of CB] if an event of default occurs in relation to themselves or if they are subject to crisis prevention measures or crisis management measures within the meaning of Directive 2014/59/EU of the European Parliament and of the Council (1) or any other equivalent applicable legislation.’; (h) Article 27 is replaced by the following: ‘Article 27 Business continuity and contingency procedures 1. In the event of an abnormal external event or any other event which affects the operation of the SSP, the business continuity and contingency procedures described in Appendix IV shall apply. 2. The Eurosystem provides a Contingency Solution if the events described in paragraph 1 occur. Connection to and use of the Contingency Solution shall be mandatory for participants considered by the [insert name of CB] to be critical. Other participants may, on request, connect to the Contingency Solution.’; (i) Article 28 is amended as follows: (i) paragraph 3 is replaced by the following: ‘3. The [insert name of CB] may impose additional security requirements, in particular with regard to cybersecurity or the prevention of fraud, on all participants and/or on participants that are considered critical by the [insert name of CB].’; (1) Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012, of the European Parliament and of the Council (OJ L 173, 12.6.2014, p. 190).5.11.2019 E N O f f i c i a l J o u r n a l o f t h e E u r o p e a n Union L 283/67 (ii) the following paragraphs 4 and 5 are added: ‘4. Participants shall provide the [insert name of CB] with their TARGET2 self-certification and their attestation of adherence to the TARGET2 network service provider’s endpoint security requirements. In the event of non-adherence to the latter, participants shall provide a document describing alternative mitigating measures to the satisfaction of the [insert name of CB]. 5. Participants allowing access to their PM account by third parties as set out in Article 5(2), (3) and (4) shall address the risk stemming from allowing such access in accordance with the security requirements set out in paragraphs 1 to 4. The self-certification referred to in paragraph (4) shall specify that the participant imposes the TARGET2 network service provider’s endpoint security requirements on third parties who have access to that participant’s PM account.’; (j) in Article 29(1), point (c) is replaced by the following: ‘(c) allows participants to initiate backup liquidity redistribution and backup contingency payments or payment orders to the Contingency Solution in the event of a failure of the participant’s payment infrastructure.’; (k) in Article 38(2), in the first sentence, point (c) is replaced by the following: ‘(c) supervisory, resolution and oversight authorities of Member States and the Union, including CBs, to the extent that this is necessary for the performance of their public tasks, and provided in all such cases that the disclosure is not in conflict with the applicable law.’; (l) in Appendix I, the fifth line of the table in point 2(1) is replaced by the following: ‘MT 202COV Mandatory Cover payment’; (m) in Appendix III, under the heading ‘Terms of reference for country opinions for non-EEA participants in TARGET2’, paragraph 3.2 is replaced by the following: ‘3.2. General insolvency and crisis management issues 3.2.a. Types of insolvency and crisis management proceedings The only types of insolvency proceedings (including composition or rehabilitation) which, for the purpose of this Opinion, shall include all proceedings in respect of the Participant’s assets or any branch it may have in [jurisdiction] to which the Participant may become subject in [jurisdiction], are the following: [list proceedings in original language and English translation] (together collectively referred to as ‘Insolvency Proceedings’). In addition to Insolvency Proceedings, the Participant, any of its assets, or any branch it may have in [jurisdiction] may become subject in [jurisdiction] to [list any applicable moratorium, receivership, or any other proceedings as a result of which payments to and/or from the Participant may be suspended, or limitations can be imposed in relation to such payments, or similar proceedings, including crisis prevention and crisis management measures equivalent to those defined in Directive 2014/59/EU, in original language and English translation] (hereinafter collectively referred to as ‘Proceedings’). 3.2.b. Insolvency treaties [jurisdiction] or certain political subdivisions within [jurisdiction], as specified, is/are party to the following insolvency treaties: [specify, if applicable which have or may have an impact on this Opinion].’; (n) in Appendix IV, paragraph 6 is amended as follows: (i) points (a) and (b) are replaced by the following: ‘(a) If [insert name of CB] deems it necessary to do so, it shall initiate the contingency processing of payment orders using the Contingency Solution of the SSP. In such cases, only a minimum service level shall be provided to participants and ancillary systems. The [insert name of CB] shall inform its participants and ancillary systems of the start of contingency processing by any available means of communication. (b) In contingency processing, payment orders shall be submitted by the participants and authorised by the [insert name of CB]. In addition, the ancillary systems may submit files containing payment instructions, which may be uploaded into the Contingency Solution by [insert name of CB].’; (ii) points (d) and (e) are replaced by the following: ‘(d) Payments required to avoid systemic risk shall be considered as ‘critical’ and the [insert name of CB] may decide to initiate contingency processing in relation to them.L 283/68 E N O f f i c i a l J o u r n a l o f t h e E u r o p e a n Union 5.11.2019 (e) Participants shall submit payment orders for contingency processing directly into the Contingency Solution and information to payees shall be provided through [insert communication means]. Ancillary systems shall submit files which contain payment instructions to [insert name of CB] for uploading into the Contingency Solution and which authorise [insert name of CB] to do so. [insert name of CB] may, exceptionally, also manually input payments on behalf of participants. Information concerning account balances and debit and credit entries may be obtained via the [insert name of CB].’; (o) in Appendix IV, point (a) of paragraph 7 is replaced by the following: ‘(a) In the event that a participant has a problem that prevents it from settling payments in TARGET2 it shall be its responsibility to resolve the problem. In particular, a participant may use in-house solutions or the ICM functionality, i.e. backup liquidity redistribution payments and backup contingency payments (e.g. CLS, EURO1).’; (p) in Appendix VI, the third and fourth lines of the table in point 13 are replaced by the following: ‘T2S DCA to T2S DCA liquidity transfer orders 14,1 euro cent per transfer Intra-balance movement (i.e. blocking, unblock­ 9,4 euro cent per transaction’; ing, reservation of liquidity etc.) 2. Annex IIa is amended as follows: (a) Article 1 is amended as follows: (i) the definition of ‘Information and Control Module (ICM)’ is replaced by the following: — ‘“Information and Control Module (ICM)” means the SSP module that allows PM account holders to obtain online information and gives them the possibility to submit liquidity transfer orders, manage liquidity and, if applicable, initiate backup payment orders or payment orders to the Contingency Solution in a contingency,’; (ii) the following definitions are added: — ‘“investment firm” means an investment firm within the meaning of [insert national law provisions implementing Article 4(1)(1) of Directive 2014/65/EU], excluding the institutions specified in [insert national law provisions implementing Article 2(1) of Directive 2014/65/EU], provided that the investment firm in question is: (a) authorised and supervised by a recognised competent authority, which has been designated as such under Directive 2014/65/EU; and (b) entitled to carry out the activities referred to under [insert national law provisions implementing items 2, 3, 6 and 7 of Section A of Annex I to Directive 2014/65/EU],’; — ‘“Contingency Solution” means the SSP functionality that processes very critical and critical payments in contingency,’; (b) in Article 5(2), point (a) is replaced by the following: ‘(a) treasury departments of central or regional governments of Member States;’; (c) in Article 5(2), point (c) is replaced by the following: ‘(c) (i) investment firms established in the Union or the EEA, including when they act through a branch established in the Union or the EEA; and (ii) investment firms established outside the EEA, provided that they act through a branch established in the Union or the EEA;’; (d) in Article 6(1)(b), point (ii) is replaced by the following: ‘(ii) for credit institutions or investment firms established outside the EEA, acting through a branch established in the Union or the EEA, provide a country opinion in the form specified in Appendix III, unless the information and representations to be provided in such country opinion have already been obtained by the [insert name of CB] in another context.’;5.11.2019 E N O f f i c i a l J o u r n a l o f t h e E u r o p e a n Union L 283/69 (e) Article 10(9) is replaced by the following: ‘9. T2S DCA holders shall immediately inform the [insert name of CB] if an event of default occurs in relation to themselves or if they are subject to crisis prevention measures or crisis management measures within the meaning of Directive 2014/59/EU or any other equivalent applicable legislation.’ (f) Article 18(3) is replaced by the following: ‘3. The [insert name of CB] may impose additional security requirements, in particular with regard to cybersecurity or the prevention of fraud, on all T2S DCA holders and/or on T2S DCA holders that are considered critical by the [insert name of CB].’; (g) in Article 27(2), in the first sentence, point (c) is replaced by the following: ‘(c) supervisory, resolution and oversight authorities of Member States and the Union, including CBs, to the extent that this is necessary for the performance of their public tasks, and provided in all such cases that the disclosure is not in conflict with the applicable law.’; (h) in Appendix III, under the heading ‘Terms of reference for country opinions for non-EEA T2S DCA holders in TARGET2’, paragraph 3.2 is replaced by the following: ‘3.2. General insolvency and crisis management issues 3.2.a. Types of insolvency and crisis management proceedings The only types of insolvency proceedings (including composition or rehabilitation) which, for the purpose of this Opinion, shall include all proceedings in respect of the T2S DCA holder’s assets or any branch it may have in [jurisdiction] to which the T2S DCA holder may become subject in [jurisdiction], are the following: [list proceedings in original language and English translation] (together collectively referred to as ‘Insolvency Proceedings’). In addition to Insolvency Proceedings, the T2S DCA holder, any of its assets, or any branch it may have in [jurisdiction] may become subject in [jurisdiction] to [list any applicable moratorium, receivership, or any other proceedings as a result of which payment orders to and/or from the T2S DCA holder may be suspended, or limitations can be imposed in relation to such payment orders, or similar proceedings, including crisis prevention and crisis management measures equivalent to those defined in Directive 2014/59/EU, in original language and English translation] (hereinafter collectively referred to as ‘Proceedings’). 3.2.b. Insolvency treaties [jurisdiction] or certain political subdivisions within [jurisdiction], as specified, is/are party to the following insolvency treaties: [specify, if applicable which have or may have an impact on this Opinion].’; (i) in Appendix VI, the third and fourth lines of the table are replaced by the following: ‘T2S DCA to T2S DCA liquidity transfer orders 14,1 euro cent per transfer Intra-balance movement (i.e. blocking, unblock­ 9,4 euro cent per transaction’; ing, reservation of liquidity etc.) 3. Annex IIb is amended as follows: (a) in Article 5(2), point (a) is replaced by the following: ‘(a) treasury departments of central or regional governments of Member States;’; (b) in Article 5(2), point (c) is replaced by the following: ‘(c) (i) investment firms established in the Union or the EEA, including when they act through a branch established in the Union or the EEA; and (ii) investment firms established outside the EEA, provided that they act through a branch established in the Union or the EEA;’; (c) in Article 6(1)(b), point (ii) is replaced by the following: ‘(ii) for credit institutions or investment firms established outside the EEA, acting through a branch established in the Union or the EEA, provide a country opinion in the form specified in Appendix II, unless the information and representations to be provided in such country opinion have already been obtained by the [insert name of CB] in another context; and’;L 283/70 E N O f f i c i a l J o u r n a l o f t h e E u r o p e a n Union 5.11.2019 (d) Article 14(8) is replaced by the following: ‘8. TIPS DCA holders shall immediately inform the [insert name of CB] if an event of default occurs in relation to themselves or if they are subject to crisis prevention measures or crisis management measures within the meaning of Directive 2014/59/EU or any other equivalent applicable legislation.’; (e) Article 21 is amended as follows: (i) paragraph 5 is replaced by the following: ‘5. The [insert name of CB] may impose additional security requirements, in particular with regard to cybersecurity or the prevention of fraud, on all TIPS DCA holders.’; (ii) the following paragraph 6 is added: ‘6. TIPS DCA holders using instructing parties in line with Article 7(2) or (3), or allowing access to their TIPS DCA as set out in Article 8(1), shall be deemed to have addressed the risk stemming from such use or access in accordance with the additional security requirements imposed upon them.’; (f) Article 26(4) is replaced by the following: ‘4. In the event that the [insert name of CB] suspends or terminates a TIPS DCA holder’s participation in TARGET2-[insert CB/country reference] under paragraph 1 or 2, the [insert name of CB] shall immediately inform, by means of a ICM broadcast message, other CBs and PM account holders in all of the TARGET2 component systems of such suspension or termination. Such message shall be deemed to have been issued by the home CB of the PM account holder that received the message. Linked PM account holders shall have the responsibility to inform their Linked TIPS DCA holders of the suspension or termination of any TIPS DCA holder’s participation in TARGET2-[insert CB/country reference]. In the event that the suspension or termination of a TIPS DCA holder’s participation in TARGET2-[insert CB/ country reference] occurs during the technical maintenance window, the ICM broadcast message shall be sent after the start of daytime processing on the next TARGET2 business day.’; (g) in Article 29(3), point (c) is replaced by the following: ‘(c) supervisory, resolution and oversight authorities of Member States and the Union, including CBs, to the extent that this is necessary for the performance of their public tasks, and provided in all such cases that the disclosure is not in conflict with the applicable law.’; (h) in Appendix II, under the heading ‘Terms of reference for country opinions for non-EEA TIPS DCA holders in TARGET2, paragraph 3.2 is replaced by the following: ‘3.2. General insolvency and crisis management issues 3.2.a. Types of insolvency and crisis management proceedings The only types of insolvency proceedings (including composition or rehabilitation) which, for the purpose of this Opinion, shall include all proceedings in respect of the TIPS DCA holder’s assets or any branch it may have in [jurisdiction] to which the TIPS DCA holder may become subject in [jurisdiction], are the following: [list proceedings in original language and English translation] (together collectively referred to as ‘Insolvency Proceedings’). In addition to Insolvency Proceedings, the TIPS DCA holder, any of its assets, or any branch it may have in [jurisdiction] may become subject in [jurisdiction] to [list any applicable moratorium, receivership, or any other proceedings as a result of which payment orders to and/or from the TIPS DCA holder may be suspended, or limitations can be imposed in relation to such payment orders, or similar proceedings, including crisis prevention and crisis management measures equivalent to those defined in Directive 2014/59/EU, in original language and English translation] (hereinafter collectively referred to as ‘Proceedings’). 3.2.b. Insolvency treaties [jurisdiction] or certain political subdivisions within [jurisdiction], as specified, is/are party to the following insolvency treaties: [specify, if applicable which have or may have an impact on this Opinion].’; 4. Annex III is amended as follows: in paragraph 2, point (c) is replaced by the following: ‘(c) treasury departments of central or regional governments of Member States and public sector bodies of Member States authorised to hold accounts for customers;’;5.11.2019 E N O f f i c i a l J o u r n a l o f t h e E u r o p e a n Union L 283/71 5. Annex IV is amended as follows: (a) in paragraph 1 (Definitions), point (7) is replaced by the following: ‘(7) “Information and Control Module (ICM)” means the SSP module that allows PM account holders to obtain online information and gives them the possibility to submit liquidity transfer orders, manage liquidity and, if applicable, initiate backup payment orders or payment orders to the Contingency Solution in a contingency,’; (b) in paragraph 1 (Definitions), the following point (15) is added: ‘(15) “Contingency Solution” means the SSP functionality that processes very critical and critical payments in contingency.’; (c) in point (1)(d)(iii) of paragraph 18, the third and fourth lines of the table are replaced by the following: ‘T2S DCA to T2S DCA liquidity transfer orders 14,1 euro cent per transfer Intra-balance movement (i.e. blocking, unblock­ 9,4 euro cent per transaction’; ing, reservation of liquidity etc.) 6. Annex V is amended as follows: (a) in Article 4, point (14) is replaced by the following: ‘(14) Article 28 is modified as follows: (a) paragraph 1 is replaced by the following: ‘1. Participants using internet-based access shall implement adequate security controls, in particular those specified in Appendix IA to Annex V, to protect their systems from unauthorised access and use. Participants shall be exclusively responsible for the adequate protection of the confidentiality, integrity and availability of their systems.’; (b) paragraph 4 is replaced by the following: ‘4. Participants using internet-based access shall provide the [insert name of CB] with their TARGET2 self-certification.’; and (c) the following paragraph 6 is added: ‘6. Participants using internet-based access shall inform [insert name of CB] immediately of any event that may affect the validity of the certificates, in particular those events specified in Appendix IA to Annex V, including, without limitation, any loss or improper use.’..