Search This Blog

Showing posts with label Brexit preparations. Show all posts
Showing posts with label Brexit preparations. Show all posts

Wednesday, 5 August 2020

Brexit-proofing... eIDAS Certificates

The European Banking Authority has just reminded firms to get ready for the end of cross-border activity between the EU and UK. Among other things, for Open Banking this means:
account information service providers (AISPs) and payment initiation service providers (PISPs) registered/authorised in the UK will no longer be entitled to access customers’ payment accounts held at the EU payment service providers and their PSD2 eIDAS certificates under Article 34 of the Commission Delegated Regulation (EU) 2018/389 [the eIDAS Regulation] will be revoked.”
However, as explained by the UK's Information Commissioner, a version of the eIDAS Regulation will take effect in UK law after 1 January 2020 (by virtue of the snappily titled Electronic Identification and Trust Services for Electronic Transactions (Amendment etc.) (EU Exit) Regulations 2019/89). 

This means UK law will continue to recognise EU registered qualified trust service providers, with the intention that UK-based organisations can continue to use EU-based trust services as well as UK-based trust providers. The approved trust providers that appear in the eIDAS trusted list for the UK immediately before the end of the transition period will remain on the list for the new UK scheme after transition ends. But the certificates issued under the UK scheme - or by EU service providers to UK-based firms - will not be recognised in the EU (or EEA).

Of course, it's a practical/commercial issue as to whether EU-based trust service providers will continue issuing certificates to UK firms after Brexit transtion ends…


Thursday, 20 September 2018

"No-Brainer": UK Firms Switching From English to Irish Law And Courts For Their New EEA Hubs

Sadly, we are at "the point of no return" for Brexit preparations by UK businesses who supply goods or services into the remaining EU27 countries - or to non-EU markets under EU trade arrangements. Many will have already been making public announcements to reassure their regulators, customers and suppliers that they've planned how to keep their operations running smoothly in the event of a "No Deal Brexit" on 29 March 2019.  But now they have to execute those business continuity plans.

While the politicians seem to think they still have 6 weeks to negotiate a UK withdrawal agreement, few businesses would have that luxury. Working back from 29 March, they have to consider contractual notice periods (some mandated by law), as well as software development and operational process changes that will need to be fully tested and running in good time before that day.

Of course, the timetable is just the tip of the preparation iceberg. Below the waterline other preparations may have been happening for some time, such as establishing a new entity in an EU27 country and getting it authorised or licensed; opening local bank accounts; leasing office premises; transferring or employing management and staff; relocating or purchasing computers and other equipment, stock or assets, and related software and data licenses; and re-contracting some of the more critical affected customers and suppliers through their new entity.

These preparations raise numerous tax, legal and accounting issues in their own right - including the fact that the UK government is still unclear on much of the official rules, processes and procedures. But the choice of law under which each new entity contracts with customers and suppliers, and which courts will govern disputes, are among the most critical to making life as easy as possible in the transition.

Both EEA-based parties will probably want the contractual terms to remain broadly the same as any current English law contract, even if certain aspects might need to be re-negotiated. Billing and payment details, currency and pricing would likely need to change, for example; as will the legal basis for sharing EEA-residents' personal data with UK operations. There won't be an EU "adequacy decision" on the UK's data protection standards before April 2019 - and no timetable can even be agreed for reaching one unless and until the UK has actually left the EU. The General Data Protection Regulations as enacted where the new entity is established will apply to the new entity's collection, use and storage of personal data, even though the customer-facing privacy policy may remain broadly the same and the customers will still have consistent rights to complain about misuse under their own national data protection laws. In turn, the parties will no longer want the contract to be governed by English law and courts, to avoid the need to worry EEA customers and suppliers about the extent to which English law inevitably diverges from the law in EEA member states.

In these circumstances, choosing the application of Irish law instead of English law to govern at least the commercial aspects of a contract becomes a "no-brainer", because at this stage it's substantively very similar to the law of England & Wales, and far more so than the law of any other EU country. Ireland is the only other purely common law jurisdiction in the EU today, and will be alone after Brexit. The few technical differences include, for example, the absence of the right for any non-party to enforce a benefit under the agreement, which the UK allowed through statute in 1999, or different monetary thresholds for the jurisdiction of familiar types of courts. But such differences can be either simply flagged and understood or explicitly accommodated if necessary (to cite the relevant example, most parties try to limit or exclude 'third party rights' anyway, but the rights can also be explicitly specified). So, while the customer is well advised to run a final check of the contract with independent local Irish counsel, it will not face the comparatively awkward and expensive exercise in understanding the numerous substantive differences between English common law and the codified civil law system of other EU member states.

Of course, it remains possible to agree that the commercial elements of the contract and provision for its enforcement are governed by Irish law and courts, even though the regulated activities of one or other party to the contract (and any regulatory complaints) may be governed by the law of another EU member state. But it has been quite common until now for, say, a financial institution established and regulated in another member state to contract with its customers in the English language under English law (or Irish law, for that matter). So customers should have no problem with a switch from English to Irish law on that basis. 

Note that the process for transferring contracts can be a bit tricky, however. For instance, some UK businesses may seek to merely "assign" their English law contracts to a new entity (possibly under a provision that appears to allow this even without the other party's consent). But under English law it is not possible for a party to assign its obligations under a contract - just its own rights or benefits (e.g. the right to receive payments).  So the transfer of existing contracts to a new entity (and the other changes mentioned) would generally need to be done by way of "novation", which necessarily involves the consent of the other party.  The process of amending agreements may also be constrained by law, such as under national regulations implementing the second Payment Services Directive. These provide for a two month notice period for changes, and a right of termination where it is agreed the changes can be proposed unilaterally and the payment service provider takes that route. It's awkward enough for the ongoing relationship that the process might provoke a renegotiation (or that consent to novation might not be forthcoming at all), without actually being seen to trigger a positive right for the customer to terminate within a finite notice period (think Article 50)!

Of course, this all relates to the new EEA-based entity.  The group head office, and perhaps the UK entity, will still have the job of tracking the extent to which English law (and therefore the basis of the offering to UK customers) diverges from Irish law, EU rules and the offering to EEA customers. 

But you'll just have to blame the Brexiteers for that!