Decree-Law no. 91/2018

APPROVES THE LEGAL FRAMEWORK ON PAYMENT SERVICES AND ELECTRONIC MONEY, TRANSPOSING INTO DOMESTIC LAW DIRECTIVE (EU) 2015/2366 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL OF 25 NOVEMBER 2015, ON PAYMENT SERVICES IN THE INTERNAL MARKET.

Decree-Law no. 91/2018, of 12 November (“Decree-Law”) approves the Legal Framework on Payment Services and
Electronic Money, transposing into domestic law Directive (EU) 2015/2366 of the European Parliament and of the
Council, of 25 November (also known as PSD2). This piece of legislation entered into force on 13 November (the day
following its publication) and institutions now have 90 days to forward to Bank of Portugal the elements concerning
their compliance of the new requirements. The new reinforced security measures must be in place 18 months after
the entry into force of the European Commission statute adopting the applicable regulatory technical standards.
This Decree-Law regulates the access to the activity by payment institutions and electronic money institutions, the
provision of payment services and issue of electronic money services, and relevant prudential supervision, repealing
the former legal framework which was in force until 12 November 2018.

PSD2 widens the scope of the previous directive, setting out as sufficient requirement that the service provider be
domiciled within the EU, that is, it will apply, for instance, to a transfer from a Portuguese bank account, regardless
of the currency, to an account with a bank in Switzerland.

Overall, this Decree-Law allows new payment service providers, imposing on the financial institutions the obligation
to share with such new service providers information about their customers in respect for the principle of nondiscrimination and the charge provided for in the regulations.

All the changes arising therefrom seek to address challenges imposed by the current economic-financial climate and
fostered by the development of technology. This way, the new regime deriving from the transposition of PSD2, which
also includes European regulations¹ in our legal system, seeks to address the challenges posed by the dynamic reality
associated with the payment services, with a view to an increase in complexity and volume of electronic payments
and the emergence of new techniques in the payment services market.

To this end, the Decree-Law will allow new payment service providers to enter the market, upon compliance with
certain requirements, in particular, registration with Bank of Portugal. It also introduces basically two new services:
(i) Payment Initiation service and (ii) the Account Information service. The first is a payment order on a payment
account held directly at the payee without interaction with the bank, and the second is the provision of consolidated
information on one or more payment accounts held by the user with one or several banks. For instance, the user will
be able to access, on the same platform, information on his/her different bank accounts, with one bank or multiple
banks, while banks will have to share information among them in respect of the same user (provided that the user
authorizes the banks to transmit his/her data to the new payment services providers) – known as open banking. The
user may also authorise a payment service provider on an online purchase (which can even be Amazon provided that
it complies with the requirements set forth in the Decree-Law) to access information on the availability of funds with
his/her bank and initiate payment on behalf of its customer.

The payment service provider shall furthermore be required to, at the request of the customer, provide information
on the maximum period of the payment operation and associated costs. As far as the execution of transactions is
concerned, the user must also be informed of the transactions that have been made or that will be made, without
extra charge (on paper or on another durable medium).

To ensure safe money transactions, this law introduces a reinforced authentication which must have at least two
different security factors. The purpose is to make these payment services more secure through strong customer
authentication mechanisms in not-present transactions. Payment service providers must make available two options
for authentication and certification of transactions by the user that must include two different ways to be used at the
same time, whether passwords (something which is known only to the user), temporary or dynamic codes (something
which is held only by the user) or biometric data (a defining feature of the customer).

This Decree-Law also reinforces the safeguard mechanisms of the users of payment services by reducing from 150€
to 50€ the maximum amount they will have to bear in case of non-authorised payment transactions (except in case
of fraud or gross negligence).

The Bank of Portugal is still the primary responsible for the supervision and will lead the applications for the setting
up of payment and electronic money institutions in Portugal. Upon the issue of an authorisation, the payment service
provider is entered in a public register containing information on the authorised payment institutions. Likewise,
institutions headquartered in another Member State, duly registered, will be able to provide services in Portugal,
provided that such services are covered by the authorisation. Bank of Portugal is also responsible for imposing
penalties and has the authority to demand the necessary assistance of police authorities.

It is worth noting that payment services providers will be defining a remuneration and assessment policy specifically
for (a) natural persons who contact directly the users of payment services when marketing such payment services;
and for (b) the persons involved in managing and supervising the latter.

The payment and electronic money institutions operating in Portugal through agents or distributors of electronic
money, under the freedom to provide services, are required to appoint a central contact point in Portugal should the
requirements of a delegated act of the European Commission adopting the regulatory technical standards be met.
In short, this legal regime aims to create a single market for payment services, facilitating the circulation of information with more transparency, and at the same time to create the conditions for the provision of services by
new non-bank players. This long-awaited piece of legislation will completely change the way payment services are
provided in Portugal since it allows payment transactions without any direct interaction of the user with his/her bank.

⁽¹⁾ Regulation (EC) No 924/2009, of the European Parliament and of the Council, of 16 September 2009, on cross-border payments in the Community sets out that the charges for payments to other Member States are equal as for corresponding payments within each Member State; Regulation (EC) No 260/2012, of the European Parliament and of the Council, of 14 March 2012, establishes technical and business requirements credit transfers and direct debits in euro; and Regulation (EU) No 2015/751 of the European Parliament and of the Council de 29 Abril 2015, on interchange fees for card-based payment transactions.