NATIONAL LEGISLATOR IN GERMANY
1. The prominence of the EBA
As the title indicates, one of the topics discussed at the conference was EBA’s role within the process of implementing European Directives into national law. With respect to Germany, the legal situation is clear: announcements and opinions of the EBA do not directly affect the implementation of the Directive, given that the EBA has no legislative power. That is not to say that the German legislator does not take EBA’s comments on the interpretation of a Directive into account. It is also acknowledged in Germany that the EBA provides preparatory work that helps specifying the content of the final legal national acts. In addition, the different instruments of the EBA are crucial for the interpretation of the PSD by fine-graining the European financial markets law.3 The EBA’s contributions are of pivotal functional prominence in terms of harmonization, standardization, and legal certainty.4 However, according to the prevailing opinion in Germany and in other Member States, the EBA cannot enact legal instruments with immediate legal effect in domestic law.5 At least from a German law perspective, legislative actions by the EBA with immediate effect would be constitutionally questionable, if not unconstitutional, and it is doubtful whether legislative power for European supervisory
3 J. Schemmel (2019) Journal of Financial Regulation and Compliance, sub.
1.2.3.
4 See in detail E. Cervone, SSRN 3209588, July 2, 2018, p. 5 et seqq. This is especially true for the interbank relationships that are governed by, inter alia, the SEPA Rulebooks.
5 E. Cervone, SSRN 3209588, July 2, 2018, p. 6.
The transposition of the PSD 2: the role of EBA and of the national legislator in Germany
agencies would be in accordance with the European Treaties.6 These doubts also concern the Regulatory Technical Standards on Strong Customer Authentication and common and secure communication (RTS)7 that are devised by EBA. These are in fact binding law in all Member States after the Commission has endorsed them.8
From a German law perspective, it is also particularly remarkable that the EBA published an opinion on the elements of SCA on 21 June 2019,9 in which EBA takes quasi-legislative actions while acknowledging the complexity of the payments markets across the EU and the challenges that arise from the changes that are introduced by the RTS. The EBA conceded that some actors in the payments chain, in particular those that are not payment service providers (PSPs), such as e-merchants, may not be ready to meet by 14 September 2019 all requirements set out by the RTS. In that regard, EBA took the exceptional step of empowering the national competent authorities (NCAs) to provide limited additional time for card-based payment online-transactions to allow card-issuing PSPs to migrate to authentication approaches that comply with SCA.10
6 For further information on the European regulatory and supervisory structure of the financial markets, on the regulatory instruments, and on the dogmatics and legitimacy of EBA's instruments of action see J. Schemmel, Europäische Finanzmarktverwaltung – Dogmatik und Legitimation der Handlungsinstrumente von EBA, EIOPA und ESMA, 2018.
7 Cf. https://eba.europa.eu/regulation-and-policy/payment-services-and-electronic- money/regulatory-technical-standards-on-strong-customer-authentication-and-secure-communication-under-psd2.
8 For the legal basis see, inter alias, art 10 of the Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC.
9 EBA, Opinion on the elements of strong customer authentication (SCA) under PSD2, EBA-Op-2019-06.
10 The same applied to acquiring PSPs to migrate their merchants to solutions that support SCA.
In its additional opinion of 16 October 2019,11 EBA stated that such supervisory flexibility of NCAs should end on 31 December 2020.
In response, the German Financial Supervisory Authority (BaFin) has made use of the leeway provided by the EBA. In its communications published on 21 August 2019 and 17 October 2019, BaFin allowed payment service providers domiciled in Germany to execute card-based payments online without Strong Customer Authentication (SCA).12 Therefore, it is true that the EBA exerts some influence on the implementation of the PSD 2 into national law. However, the EBA’s legislative impact is limited to particular aspects while direct exertion of influence is exceptional considering the aforementioned constitutional and European law concerns.
Having this said, the paper – according to my presentation at the conference – hereafter focuses solely on the role of the national legislator relating to the Directive’s implementation into German law. It is not necessary to highlight the rules of national law in detail since the PSD 2 claims to be a full-harmonization directive. It is rather interesting to analyse the German legislator’s choices made whenever the PSD 2 provided the Member States with a certain degree of regulatory freedom. Conceptually, there is only limited leeway for the legislator since the flexibility clauses contained in the PSD 2 only relate to regulatory niceties and details. Hence, I will turn to the areas of civil and supervisory law that are not explicitly regulated by the Directive. In reference to that, part two of the paper will explain some fundamentals of the German law on payment services, while part three to four will depict three particular decisions of the German rule maker that call for remarks.
11 EBA, Opinion on the deadline for the migration to SCA for e-commerce card based payment transactions, EBA-Op-2019-11.
12 See the press releases „PSD2: BaFin ermöglicht Erleichterungen bei Kundenauthentifizierung, 21.8.2019“ and “PSD2 – BaFin setzt Frist zur Umstellung von Kartenzahlungen im Internet, 17.10.2019“.
The transposition of the PSD 2: the role of EBA and of the national legislator in Germany
2. The basic structure of the Payment Services Law in Germany