Renewed oversight framework and new oversight tasks
4.2 Transposition of recommendations for the security of Internet payments and compliance assessment as part of the oversight of payment instruments
The purpose of payment instruments oversight is to manage the risks of modern and novel technical solutions applied in payments and payment systems, and to maintain the trust in payment methods. Although payment instruments oversight has not yet emerged as a separate activity in Hungary, some of its elements have already been incorporated into the oversight of payment systems, legislation concerning the execution of payments, and payment inspections. In order to ensure that the use of innovative technical solutions in payments does not pose any risk to the efficient and secure operations of payment services and payment and settlement systems, oversight must be adjusted to such solutions. In the oversight of payment instruments, the MNB plans to use a standardised framework to assess the execution rules of payment methods and the infrastructure used for the submission and execution of transactions, including the IT tools and communication channels used. Once payment instruments oversight is integrated into the domestic oversight framework, payment inspections and oversight will cover the entire execution process of payments, including access to payment methods, the methods and channels of the submission of orders, as well as clearing and settlement. Due to the rapid development of the payment solutions available on the Internet, it is essential that the relevant security requirements are established, regulated and controlled as part of payment instruments oversight. To that end, the SecuRe Pay forum54 on the security of retail payments established in 2011 at the initiative of the European Central Bank 54 55
has established recommendations for the security of Internet payments and criteria for the assessment of compliance with the recommendations. As a result of the efforts of the forum, the ECB and the European Banking Authority (EBA) cooperated to develop specific control and security measures for Internet payments, as well as standard recommendations and guidelines on customer information and communication with customers (Box 6).55 The recommendations and guidelines are based on the provisions of the Payment Services Directive on information requirements and obligations relating to the provision of payment services. The guidelines cover credit transfers and card payment transactions on the Internet, the issuance and amendment of direct debit electronic mandates on the Internet, as well as transfers of electronic money between e-money accounts via the Internet. As a central theme of the guidelines, strong customer authentication will also be regulated by PSD2, which is currently being developed. As of 1 August 2015, domestic payment methods and payment service providers operating in Member States are required to meet the new guidelines. As a competent authority, in early May the MNB was required to submit a report to the EBA on whether it intends to comply with the guidelines. In fulfilment of its reporting obligation, the MNB indicated its intention to comply with the guidelines. In order to prepare the implementation of the guidelines, it carried out a survey on the current level of compliance in the sector. For the purpose of the survey, the MNB sent self-assessment questionnaires to all stakeholders concerned, requesting their statements on whether they complied with the
European Forum on the Security of Retail Payments. ecommendations for the security of Internet payments: R https://www.ecb.europa.eu/pub/pdf/other/recommendationssecurityinternetpaymentsoutcomeofpcfinalversionafterpc201301en.pdf Assessment guide for the security of internet payments: http://www.ecb.europa.eu/pub/pdf/other/assessmentguidesecurityinternetpayments201402en.pdf Final guidelines on the security of internet payments: http://www.eba.europa.eu/documents/10180/934179/EBA-GL-2014-12+%28Guidelines+on+the+security+of+internet+payments%29.pdf
Payment Systems report • June 2015
53
