Akt prawny
archiwalny
Wersja archiwalna od 2021-10-11 do 2023-03-20
Wersja archiwalna od 2021-10-11 do 2023-03-20
archiwalny
Alerty
DECYZJA EUROPEJSKIEGO BANKU CENTRALNEGO (UE) 2021/1758
z dnia 21 września 2021 r.
zmieniająca decyzję EBC/2007/7 w sprawie warunków uczestnictwa w systemie TARGET2-ECB (EBC/2021/43)
ZARZĄD EUROPEJSKIEGO BANKU CENTRALNEGO,
uwzględniając Traktat o funkcjonowaniu Unii Europejskiej, w szczególności art. 127 ust. 2 tiret pierwsze i czwarte,
uwzględniając Statut Europejskiego Systemu Banków Centralnych i Europejskiego Banku Centralnego, w szczególności art. 11 ust. 6 oraz art. 17, 22 i 23,
a także mając na uwadze, co następuje:
| (1) | W dniu 20 lipca 2021 r. Rada Prezesów zmieniła (1) wytyczne Europejskiego Banku Centralnego EBC/2012/27 (2) w celu: a) doprecyzowania, że posiadacze rachunków TIPS DCA i posiadacze rachunków T2S DCA będą podłączeni do TARGET2 za pośrednictwem jednolitego punku dostępu do infrastruktur rynkowych Eurosystemu odpowiednio od listopada 2021 r. i czerwca 2022 r.; b) doprecyzowania i rozszerzenia zasad dotyczących przestrzegania wymogów TARGET2 w zakresie ochrony punktów końcowych, tak aby zapewnić dalszą ewolucję systemu TARGET2 w odpowiedzi na zagrożenia dla bezpieczeństwa cybernetycznego; c) nałożenia na posiadaczy rachunków w PM, ich uczestników pośrednich i adresowalnych posiadaczy BIC, którzy przystąpili do schematu SCT Inst poprzez podpisanie porozumienia o zachowaniu zgodności ze schematem polecenia przelewu natychmiastowego SEPA, obowiązku bycia osiągalnym w ramach platformy TIPS za pośrednictwem rachunku TIPS DCA, tak aby zapewnić dostępność płatności natychmiastowych w całej Unii; d) zachowania przejrzystości w zakresie sposobów przesuwania sald z rachunków uczestników w TARGET2 na odpowiednie rachunki następcze w przyszłym systemie TARGET, tak aby zagwarantować pewność prawną; oraz e) doprecyzowania i uaktualnienia niektórych aspektów wytycznych EBC/2012/27. |
| (2) | Po uruchomieniu projektu konsolidacyjnego T2-T2S konieczne będzie zachowanie przejrzystości w zakresie sposobów przesuwania sald z rachunków uczestników w TARGET2-ECB na odpowiednie rachunki następcze, tak aby zagwarantować pewność prawną. |
| (3) | W decyzji Europejskiego Banku Centralnego EBC/2007/7 należy uwzględnić zmiany wprowadzone do wytycznych EBC/2012/27, które mają wpływ na warunki uczestnictwa w systemie TARGET2-ECB (3). |
| (4) | Decyzja EBC/2007/7 powinna zatem zostać odpowiednio zmieniona, |
PRZYJMUJE NINIEJSZĄ DECYZJĘ:
Artykuł 1
Zmiany
W załącznikach I, II i III do decyzji EBC/2007/7 wprowadza się zmiany zgodnie z załącznikami do niniejszej decyzji.
Artykuł 2
Przepisy końcowe
Niniejsza decyzja wchodzi w życie piątego dnia po dniu jej opublikowania w Dzienniku Urzędowym Unii Europejskiej.
Niniejszą decyzję stosuje się od dnia 21 listopada 2021 r., z wyjątkiem pkt 1 lit. c), pkt 7 oraz pkt 9 załącznika II do niniejszej decyzji, które stosuje się od dnia 13 czerwca 2022 r.
Sporządzono we Frankfurcie nad Menem dnia 21 września 2021 r.
Christine LAGARDE
Prezes EBC
(1) Wytyczne Europejskiego Banku Centralnego (UE) 2021/1759 z dnia 20 lipca 2021 r. zmieniające wytyczne EBC/2012/27 w sprawie transeuropejskiego automatycznego błyskawicznego systemu rozrachunku brutto w czasie rzeczywistym (TARGET2) (EBC/2021/30) (zob. s. 45 niniejszego Dziennika Urzędowego).
(2) Wytyczne Europejskiego Banku Centralnego EBC/2012/27 z dnia 5 grudnia 2012 r. w sprawie transeuropejskiego automatycznego błyskawicznego systemu rozrachunku brutto w czasie rzeczywistym (TARGET2) (Dz.U. L 30 z 30.1.2013, s. 1).
(3) Decyzja Europejskiego Banku Centralnego EBC/2007/7 z dnia 24 lipca 2007 r. w sprawie warunków uczestnictwa w systemie TARGET2-ECB (Dz.U. L 237 z 8.9.2007, s. 71).
ZAŁĄCZNIK I
W załączniku I do decyzji EBC/2007/7 wprowadza się następujące zmiany:
| 1) | w art. 1 wprowadza się następujące zmiany:
|
| 2) | w art. 2 ust. 1 dodaje się następujący tekst:
|
| 3) | w art. 3 wprowadza się następujące zmiany:
|
| 4) | art. 5 otrzymuje brzmienie: „Article 5 Direct participants PM account holders in TARGET2-ECB are direct participants and shall comply with the requirements set out in Article 8(1) and (2). They shall have at least one PM account with the ECB. PM account holders that have adhered to the SCT Inst scheme by signing the SEPA Instant Credit Transfer Adherence Agreement shall be and shall remain reachable in the TIPS Platform at all times, either as a TIPS DCA holder or as a reachable party via a TIPS DCA holder.”; |
| 5) | art. 22 otrzymuje brzmienie: „Article 22 Security Requirements and Control Procedures 1. Participants shall implement adequate security controls to protect their systems from unauthorised access and use. Participants shall be exclusively responsible for the adequate protection of the confidentiality, integrity and availability of their systems. 2. Participants shall inform the ECB of any security-related incidents in their technical infrastructure and, where appropriate, security-related incidents that occur in the technical infrastructure of the third party providers. The ECB may request further information about the incident and, if necessary, request that the participant take appropriate measures to prevent a recurrence of such an event. 3. The ECB may impose additional security requirements, in particular with regard to cybersecurity or the prevention of fraud, on all participants and/or on participants that are considered critical by the ECB. 4. Participants shall provide the ECB with: (i) permanent access to their attestation of adherence to their chosen network service provider's endpoint security requirements, and (ii) on an annual basis the TARGET2 self-certification statement as published on the ECB's website in English. 4a. The ECB shall assess the participant's self-certification statement(s) on the participants level of compliance with each of the requirements set out in the TARGET2 self-certification requirements. These requirements are listed in Appendix VII, which in addition to the other Appendices listed in Article 2(1), shall form an integral part of these Conditions. 4b. The participant's level of compliance with the requirements of the TARGET2 self-certification shall be categorised as follows, in increasing order of severity: “full compliance”; “minor non-compliance”; or “major non-compliance”. The following criteria apply: full compliance is reached where participants satisfy 100% of the requirements; minor non-compliance is where a participant satisfies less than 100% but at least 66% of the requirements and major non-compliance where a participant satisfies less than 66% of the requirements. If a participant demonstrates that a specific requirement is not applicable to it, it shall be considered as compliant with the respective requirement for the purposes of the categorisation. A participant which fails to reach “full compliance” shall submit an action plan demonstrating how it intends to reach full compliance. The ECB shall inform the relevant supervisory authorities of the status of such participant's compliance. 4c. If the participant refuses to grant permanent access to its attestation of adherence to their chosen NSPs endpoint security requirements or does not provide the TARGET2 self-certification the participant's level of compliance shall be categorised as “major non-compliance”. 4d. The ECB shall reassess compliance of participants on an annual basis. 4e. The ECB may impose the following measures of redress on participants whose level of compliance was assessed as minor or major non-compliance, in increasing order of severity:
|
| 6) | w art. 33 ust. 1 otrzymuje brzmienie: „1. Participants shall be deemed to be aware of, shall comply with, and shall be able to demonstrate that compliance to the relevant competent authorities with all obligations on them relating to legislation on data protection. They shall be deemed to be aware of, and shall comply with all obligations on them relating to legislation on prevention of money laundering and the financing of terrorism, proliferation-sensitive nuclear activities and the development of nuclear weapons delivery systems, in particular in terms of implementing appropriate measures concerning any payments debited or credited on their PM accounts. Participants shall ensure that they are informed about the TARGET2 network service provider's data retrieval policy prior to entering into the contractual relationship with the TARGET2 network service provider.”; |
| 7) | dodaje się art. 39a w brzmieniu: „Article 39a Transitional provisions 1. Once the TARGET system is operational and TARGET2 has ceased operation, PM account balances shall be transferred to the account holder's corresponding successor accounts in the TARGET system. 2. The requirement that PM account holders, indirect Participants and addressable BIC holders adhering to the SCT Inst scheme be reachable in the TIPS Platform pursuant to Article 5 shall apply as of 25 February 2022.”; |
| 8) | w dodatku I pkt 8 ust. 4 lit. b) otrzymuje brzmienie:
|
| 9) | w dodatku IV pkt 6 lit. g) otrzymuje brzmienie:
|
| 10) | dodaje się dodatek VII w brzmieniu: „Appendix VII Requirements regarding information security management and business continuity management Information security management These requirements are applicable to each participant, unless the participant demonstrates that a specific requirement is not applicable to it. In establishing the scope of application of the requirements within its infrastructure, the participant should identify the elements that are part of the Payment Transaction Chain (PTC). Specifically, the PTC starts at a Point of Entry (PoE), i.e. a system involved in the creation of transactions (e.g. workstations, front-office and back-office applications, middleware), and ends at the system responsible to send the message to SWIFT (e.g. SWIFT VPN Box) or Internet (with the latter applicable to Internet-based Access). Requirement 1.1: Information security policy The management shall set a clear policy direction in line with business objectives and demonstrate support for and commitment to information security through the issuance, approval and maintenance of an information security policy aiming at managing information security and cyber resilience across the organisation in terms of identification, assessment and treatment of information security and cyber resilience risks. The policy should contain at least the following sections: objectives, scope (including domains such as organisation, human resources, asset management etc.), principles and allocation of responsibilities. Requirement 1.2: Internal organisation An information security framework shall be established to implement the information security policy within the organisation. The management shall coordinate and review the establishment of the information security framework to ensure the implementation of the information security policy (as per Requirement 1.1) across the organisation, including the allocation of sufficient resources and assignment of security responsibilities for this purpose. Requirement 1.3: External parties The security of the organisation's information and information processing facilities should not be reduced by the introduction of, and/or the dependence on, an external party/parties or products/services provided by them. Any access to the organisation's information processing facilities by external parties shall be controlled. When external parties or products/services of external parties are required to access the organisation's information processing facilities, a risk assessment shall be carried out to determine the security implications and control requirements. Controls shall be agreed and defined in an agreement with each relevant external party. Requirement 1.4: Asset management All information assets, the business processes and the underlying information systems, such as operating systems, infrastructures, business applications, off-the-shelf products, services and user-developed applications, in the scope of the Payment Transaction Chain shall be accounted for and have a nominated owner. The responsibility for the maintenance and the operation of appropriate controls in the business processes and the related IT components to safeguard the information assets shall be assigned. Note: the owner can delegate the implementation of specific controls as appropriate, but remains accountable for the proper protection of the assets. Requirement 1.5: Information assets classification Information assets shall be classified in terms of their criticality to the smooth delivery of the service by the participant. The classification shall indicate the need, priorities and degree of protection required when handling the information asset in the relevant business processes and shall also take into consideration the underlying IT components. An information asset classification scheme approved by the management shall be used to define an appropriate set of protection controls throughout the information asset lifecycle (including removal and destruction of information assets) and to communicate the need for specific handling measures. Requirement 1.6: Human resources security Security responsibilities shall be addressed prior to employment in adequate job descriptions and in terms and conditions of employment. All candidates for employment, contractors and third party users shall be adequately screened, especially for sensitive jobs. Employees, contractors and third party users of information processing facilities shall sign an agreement on their security roles and responsibilities. An adequate level of awareness shall be ensured among all employees, contractors and third party users, and education and training in security procedures and the correct use of information processing facilities shall be provided to them to minimise possible security risks. A formal disciplinary process for handling security breaches shall be established for employees. Responsibilities shall be in place to ensure that an employee's, contractor's or third party user's exit from or transfer within the organisation is managed, and that the return of all equipment and the removal of all access rights are completed. Requirement 1.7: Physical and environmental security Critical or sensitive information processing facilities shall be housed in secure areas, protected by defined security perimeters, with appropriate security barriers and entry controls. They shall be physically protected from unauthorised access, damage and interference. Access shall be granted only to individuals who fall within the scope of Requirement 1.6. Procedures and standards shall be established to protect physical media containing information assets when in transit. Equipment shall be protected from physical and environmental threats. Protection of equipment (including equipment used off-site) and against the removal of property is necessary to reduce the risk of unauthorised access to information and to guard against loss or damage of equipment or information. Special measures may be required to protect against physical threats and to safeguard supporting facilities such as the electrical supply and cabling infrastructure. Requirement 1.8: Operations management Responsibilities and procedures shall be established for the management and operation of information processing facilities covering all the underlying systems in the Payment Transaction Chain end-to-end. As regards operating procedures, including technical administration of IT systems, segregation of duties shall be implemented, where appropriate, to reduce the risk of negligent or deliberate system misuse. Where segregation of duties cannot be implemented due to documented objective reasons, compensatory controls shall be implemented following a formal risk analysis. Controls shall be established to prevent and detect the introduction of malicious code for systems in the Payment Transaction Chain. Controls shall be also established (including user awareness) to prevent, detect and remove malicious code. Mobile code shall be used only from trusted sources (e.g. signed Microsoft COM components and Java Applets). The configuration of the browser (e.g. the use of extensions and plugins) shall be strictly controlled. Data backup and recovery policies shall be implemented by the management; those recovery policies shall include a plan of the restoration process which is tested at regular intervals at least annually. Systems that are critical for the security of payments shall be monitored and events relevant to information security shall be recorded. Operator logs shall be used to ensure that information system problems are identified. Operator logs shall be regularly reviewed on a sample basis, based on the criticality of the operations. System monitoring shall be used to check the effectiveness of controls which are identified as critical for the security of payments and to verify conformity to an access policy model. Exchanges of information between organisations shall be based on a formal exchange policy, carried out in line with exchange agreements among the involved parties and shall be compliant with any relevant legislation. Third party software components employed in the exchange of information with TARGET2 (like software received from a Service Bureau in scenario 2 of the scope section of the TARGET2 self-certification arrangement document) must be used under a formal agreement with the third party. Requirement 1.9: Access control Access to information assets shall be justified on the basis of business requirements (need-to-know (1)) and according to the established framework of corporate policies (including the information security policy). Clear access control rules shall be defined based on the principle of least privilege (2) to reflect closely the needs of the corresponding business and IT processes. Where relevant (e.g. for backup management) logical access control should be consistent with physical access control unless there are adequate compensatory controls in place (e.g. encryption, personal data anonymisation). Formal and documented procedures shall be in place to control the allocation of access rights to information systems and services that fall within the scope of the Payment Transaction Chain. The procedures shall cover all stages in the lifecycle of user access, from the initial registration of new users to the final deregistration of users that no longer require access. Special attention shall be given, where appropriate, to the allocation of access rights of such criticality that the abuse of those access rights could lead to a severe adverse impact on the operations of the participant (e.g. access rights allowing system administration, override of system controls, direct access to business data). Appropriate controls shall be put in place to identify, authenticate and authorise users at specific points in the organisation's network, e.g. for local and remote access to systems in the Payment Transaction Chain. Personal accounts shall not be shared in order to ensure accountability. For passwords, rules shall be established and enforced by specific controls to ensure that passwords cannot be easily guessed, e.g. complexity rules and limited-time validity. A safe password recovery and/or reset protocol shall be established. A policy shall be developed and implemented on the use of cryptographic controls to protect the confidentiality, authenticity and integrity of information. A key management policy shall be established to support the use of cryptographic controls. There shall be policy for viewing confidential information on screen or in print (e.g. a clear screen, a clear desk policy) to reduce the risk of unauthorised access. When working remotely, the risks of working in an unprotected environment shall be considered and appropriate technical and organisational controls shall be applied. Requirement 1.10: Information systems acquisition, development and maintenance Security requirements shall be identified and agreed prior to the development and/or implementation of information systems. Appropriate controls shall be built into applications, including user-developed applications, to ensure correct processing. These controls shall include the validation of input data, internal processing and output data. Additional controls may be required for systems that process, or have an impact on, sensitive, valuable or critical information. Such controls shall be determined on the basis of security requirements and risk assessment according to the established policies (e.g. information security policy, cryptographic control policy). The operational requirements of new systems shall be established, documented and tested prior to their acceptance and use. As regards network security, appropriate controls, including segmentation and secure management, should be implemented based on the criticality of data flows and the level of risk of the network zones in the organisation. There shall be specific controls to protect sensitive information passing over public networks. Access to system files and program source code shall be controlled and IT projects and support activities conducted in a secure manner. Care shall be taken to avoid exposure of sensitive data in test environments. Project and support environments shall be strictly controlled. Deployment of changes in production shall be strictly controlled. A risk assessment of the major changes to be deployed in production shall be conducted. Regular security testing activities of systems in production shall also be conducted according to a predefined plan based on the outcome of a risk assessment, and security testing shall include, at least, vulnerability assessments. All of the shortcomings highlighted during the security testing activities shall be assessed and action plans to close any identified gap shall be prepared and followed up in a timely fashion. Requirement 1.11: Information security in supplier (3) relationships To ensure protection of the participant's internal information systems that are accessible by suppliers, information security requirements for mitigating the risks associated with supplier's access shall be documented and formally agreed upon with the supplier. Requirement 1.12: Management of information security incidents and improvements To ensure a consistent and effective approach to the management of information security incidents, including communication on security events and weaknesses, roles, responsibilities and procedures, at business and technical level, shall be established and tested to ensure a quick, effective and orderly and safely recover from information security incidents including scenarios related to a cyber-related cause (e.g. a fraud pursued by an external attacker or by an insider). Personnel involved in these procedures shall be adequately trained. Requirement 1.13: Technical compliance review A participant's internal information systems (e.g. back office systems, internal networks and external network connectivity) shall be regularly assessed for compliance with the organisation's established framework of policies (e.g. information security policy, cryptographic control policy). Requirement 1.14: Virtualisation Guest virtual machines shall comply with all the security controls that are set for physical hardware and systems (e.g. hardening, logging). Controls relating to hypervisors must include: hardening of the hypervisor and the hosting operating system, regular patching, strict separation of different environments (e.g. production and development). Centralised management, logging and monitoring as well as managing of access rights, in particular for high privileged accounts, shall be implemented based on a risk assessment. Guest virtual machines managed by the same hypervisor shall have a similar risk profile. Requirement 1.15: Cloud computing The usage of public and/or hybrid cloud solutions in the Payment Transaction Chain must be based on a formal risk assessment, taking into account the technical controls and the contractual clauses related to the cloud solution. If hybrid cloud solutions are used, it is understood that the criticality level of the overall system is the highest one of the connected systems. All on-premises components of the hybrid solutions must be segregated from the other on-premises systems. Business continuity management (applicable only to critical participants) The following requirements (2.1 to 2.6) relate to business continuity management. Each TARGET2 participant classified by the Eurosystem as being critical for the smooth functioning of the TARGET2 system shall have a business continuity strategy in place comprising the following elements.
|
(1) The need-to-know principle refers to the identification of the set of information that an individual needs access to in order to carry out her/his duties.
(2) The principle of least privilege refers to tailoring a subject's access profile to an IT system in order to match the corresponding business role.
(3) A supplier in the context of this exercise should be understood as any third party (and its personnel) which is under contract (agreement), with the institution, to provide a service and under the service agreement the third party (and its personnel) is granted access, either remotely or on-site, to information and/or information systems and/or information processing facilities of the institution in scope or associated to the scope covered under the exercise of the TARGET2 self-certification.
ZAŁĄCZNIK II
W załączniku II do decyzji EBC/2007/7 wprowadza się następujące zmiany:
| 1) | w art. 1 wprowadza się następujące zmiany:
|
| 2) | w art. 4 ust. 2 lit. fc) otrzymuje brzmienie:
|
| 3) | w art. 4 ust. 2 dodaje sie lit. fd) w brzmieniu:
|
| 4) | w art. 4 ust. 3 otrzymuje brzmienie: „3. TARGET2 provides real-time gross settlement for payments in euro, with settlement in central bank money across PM accounts, T2S DCAs and TIPS DCAs. TARGET2 is established and functions on the basis of the SSP through which payment orders are submitted and processed and through which payments are ultimately received in the same technical manner. As far as the technical operation of the T2S DCAs is concerned, TARGET2 is technically established and functions on the basis of the T2S Platform. As far as the technical operation of the TIPS DCAs and TIPS AS technical accounts is concerned, TARGET2 is technically established and functions on the basis of the TIPS Platform. The ECB is the provider of services under these Conditions. Acts and omissions of the SSP-providing NCBs and the 4CBs shall be considered acts and omissions of the ECB, for which it shall assume liability in accordance with Article 21 of this Annex. Participation pursuant to these Conditions shall not create a contractual relationship between T2S DCA holders and the SSP-providing NCBs or the 4CBs when any of the latter acts in that capacity. Instructions, messages or information which a T2S DCA holder receives from, or sends to, the SSP or T2S Platform in relation to the services provided under these Conditions are deemed to be received from, or sent to, the ECB.”; |
| 5) | w art. 8 ust. 3 otrzymuje brzmienie: „3. Where the ECB has granted a request by a T2S DCA holder pursuant to paragraph 1, that T2S DCA holder is deemed to have given the participating CSD(s) a mandate to debit the T2S DCA with the amounts relating to securities transactions executed on those securities accounts.”; |
| 6) | w art. 28 ust. 1 otrzymuje brzmienie: „1. T2S DCA holders shall be deemed to be aware of, shall comply with, and shall be able to demonstrate that compliance to the relevant competent authorities with all obligations on them relating to legislation on data protection. They shall be deemed to be aware of, and shall comply with all obligations on them relating to legislation on prevention of money laundering and the financing of terrorism, proliferation-sensitive nuclear activities and the development of nuclear weapons delivery systems, in particular in terms of implementing appropriate measures concerning any payments debited or credited on their T2S DCAs. Prior to entering into the contractual relationship with its T2S network service provider, T2S DCA holders shall ensure that they are informed about its data retrieval policy.”; |
| 7) | art. 30 otrzymuje brzmienie: „Article 30 Contractual relationship with an NSP 1. T2S DCA holders shall either:
2. The legal relationship between a T2S DCA holder and the NSP shall be exclusively governed by the terms and conditions of the separate contract concluded with an NSP as referred to in paragraph 1(a). 3. The services to be provided by the NSP shall not form part of the services to be performed by the ECB in respect of TARGET2. 4. The ECB shall not be liable for any acts, errors or omissions of the NSP (including its directors, staff and subcontractors), or for any acts, errors or omissions of third parties selected by participants to gain access to the NSP's network.”; |
| 8) | dodaje się art. 34a w brzmieniu: „Article 34a Transitional provisions Once the TARGET system is operational and TARGET2 has ceased operation, T2S DCA holders shall become T2S DCA holders in the TARGET system.”; |
| 9) | termin „T2S network service provider” (w liczbie pojedynczej oraz w liczbie mnogiej) w art. 6 ust. 1 lit. a) pkt (i), art. 9 ust. 5, art. 10 ust. 6, art. 14 ust. 1 lit. a), art. 22 ust. 1, art. 22 ust. 2, art. 22 ust. 3, art. 27 ust. 5, art. 28 ust. 1, art. 29 ust. 1 załącznika II oraz w pkt 1 dodatku I zastępuje się terminem „NSP”; |
| 10) | w dodatku I pkt 8 ust. 4 lit. b) otrzymuje brzmienie:
|
ZAŁĄCZNIK III
W załączniku III do decyzji EBC/2007/7 wprowadza się następujące zmiany:
| 1) | Termin „TIPS network service provider” (w liczbie pojedynczej oraz w liczbie mnogiej) w załączniku III zastępuje się terminem „NSP”; |
| 2) | w art. 1 wprowadza się następujące zmiany:
|
| 3) | w art. 3 ust. 1 skreśla się odniesienia do terminu „Appendix V: TIPS connectivity technical requirements”; |
| 4) | w art. 4 wprowadza się następujące zmiany:
|
| 5) | w art. 6 ust. 1 lit. a) ppkt (i) otrzymuje brzmienie:
|
| 6) | art. 9 otrzymuje brzmienie: „Article 9 Contractual relationship with an NSP 1. Participants shall either:
2. The legal relationship between a participant and the NSP shall be exclusively governed by the terms and conditions of their separate contract as referred to in paragraph 1(a). 3. The services to be provided by the NSP shall not form part of the services to be performed by the ECB in respect of TARGET2. 4. The ECB shall not be liable for any acts, errors or omissions by the NSP (including its directors, staff and subcontractors), or for any acts, errors or omissions by third parties selected by participants to gain access to the NSP's network.”; |
| 7) | skreśla się art. 10; |
| 8) | dodaje się art. 11a w brzmieniu: „Article 11a MPL repository 1. The central MPL repository contains the proxy - IBAN mapping table for the purposes of the MPL service. 2. Each proxy may be linked to only one IBAN. An IBAN may be linked to one or multiple proxies. 3. Article 29 shall apply to the data contained in the MPL repository.”; |
| 9) | skreśla się art. 12 ust. 9; |
| 10) | art. 16 otrzymuje brzmienie: „Article 16 Types of payment orders in TIPS DCA The following are classified as payment orders for the purposes of the TIPS service:
|
| 11) | w art. 18 ust. 6 otrzymuje brzmienie: „6. After a TIPS DCA to PM liquidity transfer order, a TIPS DCA to TIPS AS technical account liquidity transfer order or a TIPS AS technical account to TIPS DCA liquidity transfer order has been accepted as referred to in Article 17, the TARGET2-ECB shall check whether sufficient funds are available on the payer''s account. If sufficient funds are not available the liquidity transfer order shall be rejected. If sufficient funds are available the liquidity transfer order shall be settled immediately.”; |
| 12) | w art. 20 ust. 1 lit. b) otrzymuje brzmienie:
|
| 13) | w art. 30 ust. 1 otrzymuje brzmienie: „1. TIPS DCA holders shall be deemed to be aware of, shall comply with and shall be able to demonstrate that compliance to the relevant competent authorities with all obligations on them relating to legislation on data protection. They shall be deemed to be aware of, and shall comply with all obligations on them relating to legislation on prevention of money laundering and the financing of terrorism, proliferation-sensitive nuclear activities and the development of nuclear weapons delivery systems, in particular in terms of implementing appropriate measures concerning any payments debited or credited on their TIPS DCAs. TIPS DCA holders ensure that they are informed about their chosen NSP''s data retrieval policy prior to entering into a contractual relationship with that NSP.”; |
| 14) | dodaje się art. 35a w brzmieniu: „Article 35a Transitional provision Once the TARGET system is operational and the TARGET2 has ceased operation, TIPS DCA holders shall become TIPS DCA holders in the TARGET system.”; |
| 15) | w dodatku I tabela w pkt 2 otrzymuje brzmienie:
|
| 16) | w dodatku I pkt 6 ust. 1 lit. b) otrzymuje brzmienie:
|
| 17) | w dodatku IV skreśla się pkt 2; |
| 18) | uchyla się dodatek V. |
