Search This Blog

Showing posts with label prepaid cards. Show all posts
Showing posts with label prepaid cards. Show all posts

Thursday, 20 March 2025

Can EU Payment Institutions Really Hold Balances and Operate Prepaid Card Programs?

The European Banking Authority has issued some questionable guidance on how it interprets the definition of 'electronic money' in light of an odd preliminary ruling from the European Court of Justice in ABC Projektai UAB v Lietuvos bankas back in February 2024. I doubt them both and would suggest the ABC case can be restricted to its facts could not be relied upon for the principle that the EBA claims; while the EBA guidance is not binding in any event. But your mileage may differ and I may be wrong - by all means let me know. It's all a bit complex and I've summarised my understanding below for information purposes only. If you're after legal advice, please ping me via Crowley Millar as it's principally an EEA issue. Somehow, I don't see the UK adopting these interpretations... suddenly, a Brexit benefit?

How is E-money Defined in EU law?

The definition of e-money is in the second E-money Directive (EMD2), which is implemented by statute or regulations by each member state (and the UK prior to Brexit) and is intertwined with definitions in the second Payment Services Directive (PSD2) which governs payment services more generally, including those that involve e-money as the form of 'funds':

“electronic money” means electronically, including magnetically, stored monetary value as represented by a claim on the issuer which is issued on receipt of funds for the purpose of making payment transactions as defined in [the second Payment Services Directive (PSD2)], and which is accepted by a natural or legal person other than the electronic money issuer; 
‘payment transaction’ means an act, initiated by the payer or on that payer’s behalf or by the payee, of placing, transferring or withdrawing funds, irrespective of any underlying obligations between the payer and the payee.

'payee' means a natural or legal person who is the intended recipient of funds which have been the subject of a payment transaction"; 

‘payment order’ means an instruction by a payer or payee to its payment service provider requesting the execution of a payment transaction;  

‘acquiring of payment transactions’ means a payment service provided by a payment service provider contracting with a payee to accept and process payment transactions, which results in a transfer of funds to the payee;

In other words, e-money is monetary value issued for the purpose of enabling the e-money holder to pay an intended third party, such as a merchant, as the payee. 

There's some protection for the e-money account holder, in terms of a requirement to immediately redeem any unspent e-money and repay the funds on demand; and safeguard the corresponding amount of cash until the e-money is spent, for example.

Of course, there has to be a mechanism for getting the stored value to the payee. It's possible, in a wallet-to-wallet e-money system that the payee will be another e-money account holder with the same issuer, in which case, the e-money issuer will simply debit the payer's account and credit the payee's account. But that use-case is very difficult to scale (trust me), so e-money issuers also issue debit cards that draw on the e-money balance to enable it to be spent with any merchant who accepts that brand of card (so-called 'prepaid cards'). Most commonly, these cards are issued under membership of the major card schemes. A merchant payee will have contracted with another payment service provider (the 'acquirer', in the case of a card transaction) to do what's necessary at its end to process payment transactions involving the payer's means of payment - the prepaid card that draws on the payer's e-money balance - and transfer the resulting funds to the merchant's own account. 

I mean, it wouldn't be great, would it, if the protection of immediate redemption of unspent value could be lost because the value is technically available via a card and doesn't pop out as the actual original e-money at the other end... (in fact, that 'e-money' status that is lost immediately within the issuer's own systems as the first step in the payment flow) so, as the FCA explained in its guidance under UK E-money Regulations implementing EMD2 pre-Brexit:

The fact that the device on which monetary value is stored is made available, for example, on a plastic card that also functions as a debit or credit card or is a mobile phone does not stop that monetary value from being electronic money. [FCA perimeter guidance ("PERG") 3A.3, Q11]

The real significance of requiring that e-money must be 'accepted by persons other than the issuer' is to avoid regulating 'basic gift cards', for example, which are issued and redeemed by a merchant to enable its customers to purchase only the goods or services that it offers. The FCA also explains this by saying that: 

"...these basic gift cards do not initiate payment orders; payment for the goods or services is made by the customer to the retailer of the goods in advance, when the card is purchased from the retailer." [PERG 15.5 Q40]

The stored value in some electronic travellers cheques is also not considered e-money (PERG 3A.3, Q13).

And there's an express exemption from the definition of e-money and payment services for payment instruments that are only accepted within 'limited networks' of third party payees, which we don't need to cover here.

The ABC case

ABC was a payment institution authorised in Lithuania. As a payment institution, ABC was not authorised to issue e-money, but it could provide the following payment services: execute payment transactions, including: transfers of funds on a payment account with the user’s payment service provider or with another payment service provider; direct debits, including one-off direct debits, and payment transactions through a payment card or a similar device; and/or credit transfers, including standing orders. It could also offer money remittance. 

Under (Lithuania's implementation of) PSD2, any funds that ABC received from customers had to be the subject of a specific payment order, which had to be executed within specific time limits; and those funds could not be held longer than necessary to process the transaction. Under guidance of the Lithuanian regulator (approved by the European Commission), this meant that the funds held in ABC’s payment accounts without a payment order would be regarded as 'deposits', 'other repayable funds' or 'electronic money'. If it wished to issue e-money, ABC would have needed to be authorised as an e-money institution, necessitating higher initial and ongoing capital requirements based on the amount of e-money issued and outstanding. If it wished to accept deposits, ABC would have needed to be authorised as a credit institution with much higher capital requirements still.  

As it turned out, ABC had been allowing customers to deposit funds without a payment order and to hold balances in its payment accounts for long periods, so the Lithuanian regulator revoked ABC's authorisation as a payment institution, for going beyond the scope of that authorisation by issuing e-money.

The question for the ECJ was whether ABC's activities actually amounted to issuing e-money, which the ECJ said it did not, based on findings that:

  • 'direct debits', for example, contemplate a payment institution receiving funds "in advance" of receiving a payment order (missing the obvious point that the direct debit instruction involves a (future dated) payment order under Article 78). 
  • the rules on safeguarding funds held beyond a business day suggest that PSD2 contemplated there being no corresponding payment order in place (whereas the need for safeguarding arises because PSD2 contemplates both future dated payment orders and longer time limits for processing some payment transactions, as well as the fact that some may fail, as well as to preserve funds in the event of issuer insolvency or malfeasance).
  • for funds received by the institution to constitute e-money (my emphasis): 
"47. the issuance of electronic money [must be] distinct from the mere entry in a payment account in that, inter alia, before being used for the purposes of such a payment, such money must be electronically ‘stored’, which implies that it has been issued beforehand, that is to say, converted into a monetary asset separate from the funds received, and that its use as a means of payment is accepted by a natural or legal person other than the electronic money issuer..." 
"48. ...in order for an activity to come under the issuance of ‘electronic money’, within the meaning of Article 2(2) of that directive, it is at the very least necessary that there be a contractual agreement between the user and the electronic money issuer under which those parties expressly agree that that issuer will issue a separate monetary asset up to the monetary value of the funds paid by the user. However, transferring and holding funds on a payment account without immediately mandating payment transactions up to the value of those funds does not mean that the user of the payment service has given his, her or its express or tacit consent to the issuance of electronic money." 
"49. It is not apparent from the documents before the Court that ABC Projektai converted some of the funds which it received into electronically, including magnetically, stored money which could be used by a network of customers who would accept it voluntarily. On the contrary, all the indications are that the funds in question were deposited in payment accounts and could be used solely to execute payment orders from the users concerned."

In other words, the court held that: 

  • (in paragraph 47) as a matter of legal interpretation, the use of the stored value had to be accepted as a means of payment by third parties (consistent with the FCA's view, for example) [- not that the 'actual stored value had to end up with the payee']; 
  • in this case, there was no explicit agreement with users that ABC was issuing stored value on the basis that it could be used to pay third parties (in paragraph 48) - [whereas the fact that the value in the payment account could be used for payment transactions means it could and would indeed be accepted by third parties];  
  • (in paragraph 49) in this case, there was no evidence that any particular 'network' of third parties had accepted that they could be paid using the 'stored money' in ABC's payment accounts. The funds could simply be used to 'execute payment orders' (i.e. to request the execution of a payment transaction, according to the definition) - [again, missing the point that this implicitly means that third parties were indeed accepting this];
  • By receiving and holding funds that were not the subject of a payment order but could simply be used for payment transactions at a later date, ABC was not issuing e-money, but merely providing a payment service under PSD2. Therefore, it did not need authorisation as an e-money institution under EMD2

In other words, I interpret the court as dealing with the interpretation of the final part of the e-money definition in paragraph 47; and referring to the lack of evidence in paragraphs 48 and 49. I do not read paragraph 49 to colour or restate what was already plainly stated in paragraph 47.

However, from an evidentiary (and logical) standpoint, the court simply ignored the notion there would eventually be an intended recipient of the funds (payee) who must thereby have accepted the means of payment afforded to the payer by ABC.

Mind blown!

Fortunately, it should be possible to restrict any application of the ABC case to its fairly narrow facts.

EBA Guidance on the definition of e-money in the context of prepaid cards

While the ABC case was ongoing, there was also a pending request to the EBA for regulatory guidance from a bank (credit institution) that was planning to issue e-money that customers could spend on prepaid debit cards issued under the major card scheme rules. The EBA accepted that the presentation of such a card as a means of payment at a merchant checkout triggers a series of payment transactions, including the debit of the customer/payer's account associated with the card, and a series of debt-creditor obligations that are net-settled from the payer's card issuer/account service provider, to the card scheme, to the card acquirer and ultimately to the merchant payee. 

In other words, in the case of the major card transactions there is never a direct payment of funds from the cardholder's payment account to the merchant's payment account (often referred to as 'account-to-account' or 'A2A' payments). 

The bank claimed that it's application to become an e-money institution [let's put aside why it applied] had been wrongly rejected because the local regulator interpreted the wording at the end of the definition of e-money “accepted by a natural or legal person other than the electronic money issuer” as requiring that a party other than the issuer must accept the electronic money as a means of payment by becoming a holder of the actual electronic money (meaning that the payee must also have an agreement directly with the same e-money issuer to accept that e-money as payment). 

"The local regulator thus takes the view that there is no issuance of electronic money in a situation where no third party (payee) becomes the holder of the issued e-money (other than the EMI’s customer holding the e-money)." 

In answering this question, the ECB cited the strange decision in ABC v Lietuvos as the basis for agreeing with the local regulator, meaning that prepaid card programs do not involve the issuance of e-money!

In light of the reasoning of the Court, the last condition of the definition of electronic money (acceptance by a natural or legal person other than the electronic money issuer) should be understood as entailing the transferability and voluntary acceptance of electronic money as a separate monetary asset, and not simply as the reception by the payee of funds resulting from redeemed e-money. The submitter states that the payees (merchants in this case) are paid in scriptural money. Therefore, in accordance with the Court’s ruling in case C 661/22 and the reasoning outlined above, there is no acceptance of electronic money by a party other than the issuer in the case in question

This paragraph of the EBA guidance of course, misconstrues what the ECJ said in paragraph 47 of the ABC case, which was only that the stored value (in this case, any balance on the prepaid card) must have been "issued beforehand, that is to say, converted into a monetary asset separate from the funds received, and that its use as a means of payment is accepted by a natural or legal person other than the electronic money issuer...". In other words, applied to this case, the court would only have meant that the use of the value on the prepaid card must be accepted as a means of payment, not that the e-money itself must be accepted (consistent with FCA guidance cited above). 

That paragraph of the EBA guidance also ignores the fact that the merchant who accepts a card payment is the 'payee' because that merchant is the "intended recipient of funds which have been the subject of [the multiple] payment transaction[s]" triggered by the presentation of the card, as contemplated by recital 68 of PSD2:

The use of a card or card-based payment instrument for making a payment often triggers the generation of a message confirming availability of funds and two resulting payment transactions. The first transaction takes place between the [payer's card] issuer and the merchant’s [payee's] account servicing payment service provider [to pay for the goods/services], while the second, usually a direct debit, takes place between the payer’s account servicing payment service provider and the issuer [to pay the payer/cardholder's bill, though they may be the same account for a debit card]. Both transactions should be treated in the same way as any other equivalent transactions. 

The next paragraph of the EBA guidance then continues as if the payee is somehow required to have a customer agreement with the e-money issuer, when that would only be the case where the payee already held such an account and the transaction occurred within the e-money issuer's system (as a wallet-to-wallet or account-to-account payment): 

Furthermore, with regard to the question of whether the payees must be in a contractual agreement with the electronic money issuer, recital 18 of the EMD2 lays out redeemability as an intrinsic feature of electronic money, by stating that “electronic money needs to be redeemable to preserve the confidence of the electronic money holder”. In that respect, Article 11(3) of the EMD2 establishes that the conditions of redemption should be stated in the contract between the electronic money issuer and the electronic money holder. Article 11(7) further establishes that “redemption rights of a person, other than a consumer, who accepts electronic money shall be subject to the contractual agreement between the electronic money issuer and that person”. Consequently, the acceptance of electronic money whereby the person who accepts electronic money becomes a holder of electronic money, should therefore be understood to require a contractual arrangement with the electronic money issuer. 

The [prepaid card] scenario described in the question therefore fails to meet all of the criteria of the definition of electronic money.

Again, mind blown!

Fortunately, this is only guidance...

Monday, 7 September 2020

Transferring Prepaid Card Programmes Is Non-Trivial

Ominous news that the UK e-money subsidiary of scandal-ridden Wirecard AG is "intending to wind-down its FCA-regulated business" and that "the business will continue to trade while alternative arrangements are being made with its card providers." 

Having advised on the creation and transition of various prepaid card programmes and customers, I'm aware this is highly technical from an e-money and payments regulation standpoint, and will involve intensive 'customer due diligence' under the anti-money laundering regime, as well as a careful approach to the processing of personal data. 

The FCA claims to be "working closely with Wirecard throughout this process to ensure that its customers are treated fairly," so programme managers any e-money issuer(s) taking them and their programmes on will need to tread carefully.

Needless to say, I'm here to help the transferring programme managers or their new e-money service providers either in the UK or in relation to any EEA programmes via Ireland.

 

Thursday, 2 January 2020

You Have 9... No, wait, 8 Days To Comply With The Changes To The Money Laundering Regs

Not only do the recent changes to the Money Laundering Regulations widen the range of firms who have to comply, but there are also changes to the requirements for customer due diligence, risk assessments, policies, controls, procedures and training for firms already in scope. You have until by 10 January 2020 to comply with most of the changes. I've summarised most changes here. Let me know if you need assistance.

Changes to Scope of the MLRs
The range of firms covered by the MLRs now includes letting agents, art market participants; cryptoasset (e.g. virtual currency) exchange providers and custodian wallet providers. 

The definition of tax adviser is also extended to those who provide material aid or assistance on tax; and certain limits are lowered for e-money transactions and new restrictions are imposed on acquiring anonymous prepaid card transactions. 

Law enforcement authorities and the Gambling Commission can obtain information about safe-deposit boxes and about accounts held with banks, building societies and credit unions.

Changes to due diligence requirements

When you adopt new products, business practices (including new delivery mechanisms) or technology you must take appropriate measures in preparation for, and during, that process to assess - and if necessary mitigate - any money laundering or terrorist financing risks change may cause.

If your firm is a parent, you must establish and maintain throughout your group all the various policies, controls and procedures for the purposes of preventing money laundering and terrorist financing - including for data protection and sharing information and including policies on the sharing of information about customers, customer accounts and transactions.

You must take appropriate measures - and keep records to prove - that you train your employees and agents whose work is relevant to your AML compliance or the identification or mitigation of the risk, prevention or detection of money laundering and terrorist financing. The training must be in the law relating to money laundering and terrorist financing, and related data protection requirements; as well as how to recognise and deal with suspicious transactions and other activities or situations which may be related to money laundering or terrorist financing.

The triggers for applying customer due diligence measures now include:
  • at appropriate times for existing customers, on a risk based approach; 
  • when you become aware that the circumstances of an existing customer relevant to your risk assessment for that customer have changed;
  • when you have a legal duty to contact an existing customer for the purpose of reviewing any information relevant to your risk assessment and relates to the beneficial ownership of the customer, including information which enables you to understand the ownership or control structure of a legal person, trust, foundation or similar arrangement who is the beneficial owner of the customer; 
  • when you have to contact an existing customer to fulfil a duty under the International Tax Compliance Regulations 2015.
The obligation to understand the ownership and control structure of a customer applies whether the customer is a body corporate or other legal person, trust, company, foundation or similar legal arrangement.

Where you've exhausted all possible means of identifying the beneficial owner of the body corporate and either you haven't succeeded or you aren't satisfied that the individual identified is in fact the beneficial owner, you must keep written records of all the actions you've taken to identify the beneficial owner and take reasonable measures to verify the identity of the senior person in the body corporate responsible for managing it, as well as all the actions you've taken and any difficulties you encountered in doing so.

Before establishing a business relationship with a customer, you must collect proof of registration or an excerpt of the relevant company or partnership registry (as the case may be) and report to the relevant registrar any discrepancy between information relating to the beneficial ownership of the customer that you collect from the register and information that otherwise becomes available to you in the course of carrying out your duties under the MLRs.

There are new triggers for carrying out 'enhanced' customer due diligence measures, as well as a specified (non-exhaustive) list of measures.

The thresholds for applying customer due diligence in the context of e-money are significantly reduced.

There are new restrictions on acquiring anonymous prepaid card transactions.

Law enforcement authorities and the Gambling Commission can now obtain information about safe-deposit boxes and about accounts held with banks, building societies and credit unions.