FinTech companies have recently challenged the traditional forms of payment, offering cheaper and easy to use services. These new and so far unregulated payment service providers challenged European legislation that is aiming to bring such companies under the PSD2 regime. The activities of payment initiation service providers or account information service providers were outside the control of national supervision. Unlike banks and financial institutions that face severe regulatory and compliance control, such companies could operate without any authorization. Now PSD2, that shall be transposed into national law by January 13, 2018 will bring a consumer-focused legislation fostering innovation and the opening up of the market.
Picture: www.digitalmarketingbd.com
Sofort enters the Hungarian e-commerce market
In 2014 the National Bank of Hungary (\"NBH\") published an article, in which it warned customers about the risks of a new online payment transfer system. The article did not name the company, but the target was without a doubt the German Sofort.
The NBH put forward that using such services could lead to the abusive use of client data since the customer has to give his internet banking credentials to a third party service provider. The customer does not use netbanking on the account servicing company\'s (his bank\'s) interface but on the interface of such third party payment service provider. Thus such service providers can dispose of the customer\'s payment account. Furthermore, the company\'s website shows the TÜV certificate that could be misleading for consumers as it suggests that the company is under an increased financial supervision. However such companies are not regarded as payment institutions therefore they fall outside the scope of financial supervision.
By giving the secret internet banking codes to such third party payment service providers, the customer violates the bank\'s obligation to keep banking secrecy.
How to set up a Payment Initiation Service Provider (PISP) before PSD2 enters into force
If you would like to pursue online payment services in Hungary, first you need a limited liability company or a company limited by shares that would carry out such services.
If such a company does not provide money transmission services as described by Act CCXXXVII of 2013 on credit institutions and financial institutions (“CFA”), the company does not have to apply either for a license of establishment or operation from the NBH acting as a supervisory body of financial, payment and credit institutions.
According to the CFA, an activity is regarded a money transmission service if it enables
a) cash to be placed on a payment account including all the operations required for operating a payment account,
b) cash withdrawals from a payment account including all the operations required for operating a payment account
c) the execution of payment transactions between payment accounts,
d) the execution of payment transactions between payment accounts where the funds are covered by a credit line for a payment service user,
e) covers the issuing, and accepting cash-substitute payment instruments, excluding checks and electronic money,
f) money remittance service,
g) the execution of payment transactions where the consent of the payer to execute a payment transaction is given by means of any telecommunication, digital or IT device and the payment is made to the telecommunication, IT system or network operator, acting only as an intermediary between the payment service user and the supplier of the goods and services.
Only payment institutions can carry out money transmission services provided that they have the necessary licenses from the NBH. Such a licensing procedure is quite long, requiring 6 to 12 months, but we know cases where it took two years to receive the license.
If the company\'s activities fall outside the above activities of the CFA, and the company is not regarded as a payment institution, an NBH license is not required.
As an example, PayU and Simplepay operate in Hungary in the form of limited liability companies, without holding an NBH license. These providers carry out Card Not Present transactions, where the physical presence of a bank card is not necessary; the transaction is executed via the web or a mobile web browser using internet communication. Such online systems are set-in the payment acceptor’s online platform but operating on the service provider’s own server through which the online payment service is operated. Another example is Sofort that also operates in Hungary without holding a NBH license.
The above referred online payment services ensure the possibility of online payments via the internet so that the service ensures online money transfer between the customer and the merchant through the service provider’s platform. Such services are not transactional services (money transmission services) so these services shall not require authorization from the NBH.
Notwithstanding the above, the NBH informed customers in 2014 that the operation of such service providers is subject to change and customers should be aware that such services could be risky .[1]
The above mentioned services will definitely be subject to change in the near future. PSD2 will establish increased certainty and efficiency within the EU payments market and increase the level of consumer protection through security measures including strong customer authentication and secure communication to limit abuses and fraudulent activity.
At present Hungarian legislation regarding the transposition of PSD2 is not known.
Before the company starts providing online payment services, it is advisable to apply for a statement from the NBH establishing that the company does not qualify a payment institution.
The company shall have the necessary bylaws and general terms and conditions applicable for the services provided in accordance with Hungarian law, e.g. Act CXII of 2011 on the right of information self-determination and on the information liberty, Act CVIII of 2001 on electronic commerce and services related to the information society, etc. The company also have to be registered into the register of the Hungarian National Authority for Data Protection and Freedom of Information.
In our next article we will describe how to set up a company providing online payment services under the PSD2 regime. Although national regulation is not known yet, we try to analyse regulatory implications on the basis of the PSD2 directive.
Andrea Egertz attorney at law, Hungary Budapest
[1]http://www.mnb.hu/felugyelet/felugyeleti-keretrendszer/felugyeleti-hirek/hirek-ujdonsagok/mnb-nfh-sajtokozlemeny-jelentos-kockazatokat-rejthet-egy-ujfajta-online-atutalasi-szolgaltatas
[2]http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015L2366&from=HU
