Article 2, Paragraph 1. · ECB/2025/2

Contents

1.A Eurosystem central bank shall upon request provide access to its central bank operated payment systems for a non-bank payment service provider (NB-PSP) that complies with all of the following requirements:

(a)the NB-PSP (or a third party carrying out such tasks for whose actions and omissions the NB-PSP remains solely liable) installs, manages, operates, monitors and ensures the security of the necessary IT infrastructure to connect to the central bank operated payment system and is able to submit cash transfer orders to the central bank operated payment system;

(b)the NB-PSP provides any supporting information the relevant central bank reasonably deems necessary to decide on an application to obtain access to the central bank operated payment system;

(c)the NB-PSP implements adequate security controls to protect its systems from unauthorised access and use, including in relation to cyber resilience and information security;

(d)the NB-PSP submits to the relevant central bank either a statement issued by the relevant national competent authority or a statement duly signed as approved by the competent management body of the NB-PSP, in both cases confirming compliance by the NB-PSP with: (i) the conditions for requesting participation in designated payment systems, as set out in the relevant national law provisions implementing Article 35a(1) of Directive 2015/2366; and (ii) with the procedures set out in the relevant national law provisions implementing Article 35a(2) of Directive 2015/2366.For the avoidance of doubt, nothing in this paragraph shall exempt NB-PSPs from compliance with any requirements, including specific application procedures, applicable to them pursuant to Guideline (EU) 2022/912 (ECB/2022/8).