With mobile payments on the rise, driven by changing consumer behavior, payment institutions such as Paypal and Apple pay are rapidly gaining in market share and importance. In the EU, such entities tend to be regulated as electronic money institutions (EMIs) and payment institutions (PI), and play a major role in facilitating the development of digital and mobile payment services.
Many payment firms have traditionally been based in London, as one of the key FinTech hubs in the EU. What will Brexit entail for such UK based payment companies active in the EU? How are firms in the payments field finding solutions to the loss of passporting? what regulatory work is involved in new applications and relocations of PIs and EMIs? to find out, we talked to Karen O’Sullivan, Head of the innovation, payments, market infrastructures and governance department at the Luxembourg regulator, the CSSF, and Natasha Deloge, Deputy Head, from her team.
Natasha Deloge and Karen O’Sullivan
COPING WITH POLITICAL UNCERTAINTY
“Deal or no deal, the main priority of payment firms is to make sure that they can continue to serve and provide services to their clients. If their clients are in the EU, this requires some form of licence, whether an EMI or PI license,” explains Karen O’Sullivan, Head of the Innovation, Payments, Market Infrastructures and Governance Department at the Luxembourg regulator, the CSSF. The provision of payment services across countries in the EU is enabled by the possibility of passporting services into other Member States.
We have experience with small start-ups and big players such as Amazon Payments and Alipay, so we are not afraid of what lies ahead of us.
In the absence of clarity regarding the legal certainty of Brexit and its impact
on financial services, the regulator has for some months been encouraging local firms to draw up contingency plans that take into consideration a “hard” Brexit scenario in which no transition period is greed, with the UK becoming a third country on 29 March 2019. While the deadline has been known for a long time, the political uncertainty surrounding Brexit has been making it diffcult for businesses to understand their future international business and service offerings to their clients.
“The political situation contributes to the confusion. In addition to the complexity of deciding where they want to set up European operations, going forward, and tackling all
the formalities of obtaining the appropriate licence, many companies are still waiting for clarity on around the timeframe for the UK’s departure and whether or not there will be a transition period,” she adds.
Some companies might even stay only in the UK, if their clients are only there. Other UK companies have most of their clients in the EU, and for them legal certainty post-Brexit is absolutely crucial to the companies’ survival. Plans to mitigate some of the risks of a potential no-deal Brexit are already underway in Luxembourg. The Luxembourg government tabled a draft law on 31 January 2019 that would, on a temporary basis, extend the existing rights of UK financial services providers currently offering their
services to or engaging in financial activities in Luxembourg.
Many companies are still waiting for clarity on around the time frame for the UK’s departure and whether or not there will be a transition period.
“Under the terms of that draft law, specifically in the case of a no-deal Brexit, there would be a transitory regime allowing UK-based Payment Institutions and Electronic
Money Institutions to continue to provide their services to Luxembourg based clients
for a period of 21 months, so any existing entity currently servicing clients based in Luxembourg would be able to do so until December 2020,” says Natasha Deloge,
Deputy Head of the Innovation, Payments, Market Infrastructures and Governance Department at the CSSF.
BUSINESS AS USUAL?
While some companies call it contingency planning, developing a new EU strategy, or relocating as a result of Brexit, Luxembourg’s role as a European payment hub has certainly been reinforced since the UK’s vote to leave the EU. A number of major Payments institutions and Electronic Money Institutions have chosen to establish operations in Luxembourg, or reinforce their existing setups in the Grand Duchy, in order to continue to serve the EU market from a strategic location in the heart of Europe.
We do not have a fast-track procedure for Brexit-based applications. All application files are reviewed the same way.
The fact that a payment company already has an FCA approval does not necessarily facilitate the application for an E-money or Payment Institutions license elsewhere, nor the supervisory work of the regulator, but it makes life easier for the entity itself as they understand the general application file and required documentation.
“We do not have a fast-track procedure for Brexit-based applications. All application files are reviewed the same way. But having gone through the FCA process may be an advantage for the entity applying: we notice that those that have already been through an application process previously generally have application files that are better prepared because they have experience in the type of information that is required,” explains O’Sullivan.
One of the main areas a EMI or PI application file covers are the organisational
requirements of a payment license to ensure that it is compliant with regulatory
requirements and aords appropriate consumer protection thereby making it safe to use for its clients. This includes the necessity to have appropriate staff specialised in field such as compliance, AML/KYC, risk management, audit, IT security and IT infrastructure, as well as the on-site general management responsible for the daily management of a financial institution.
APPLYING PROPORTIONALITY
During an application file review, the regulator performs its due diligence to ensure that key functions operate safely out of the Grand Duchy and that the practicalities are in place in terms of the size of operation required in Luxembourg.
We have certain requirements, which apply regardless of what sector or industry the entity is going to operate in. In any application file that we review, Brexit or not, one of the
first things that we look at are the substance requirements such as the minimum size of
operations required,” highlights Deloge.
In any application file that we review, Brexit or not, one of the first things that we look at are the substance requirements such as the minimum size of operations required.
“The company’s key functions must be in Luxembourg, including at least the day-to-day authorised management and the chief compliance officer. Given the nature of the payments entities, there are also certain requirements from an IT point of view,”
adds O’Sullivan
The company’s key functions must be in Luxembourg, including at least the day-to- day authorised management and the chief compliance officer.
In the case of Brexit, a number of entities may split their UK entity from their European operations, making delegation and outsourcing important subject matters.
The CSSF does allow outsourcing back into the group both within and outside the EU. However, there has to be oversight from the Luxembourg entitiy. However the concept of the central administration being in Luxembourg must always be preserved.
One important factor is that when a company is licensed in Luxembourg, the local central administration is responsible for all tasks, and therefore must oversee all outsourcing.
Guidelines on outsourcing from the European Banking Authority will be in place in a couple of months and are already taken into consideration in the files we are currently re-viewing. One important factor is that when a company is licensed in Luxembourg, the local central administration is responsible for all tasks, and therefore must oversee all
outsourcing,” says Deloge.
O’Sullivan highlights that a case-by-case assessment is required to make sure that the size of the required operations in Luxembourg is proportional to the volume and type of business, the riskiness and magnitude of the activities, as well as the maturity of the entity itself. There is no “one size fits all” regulatory approach in the payments industry in Luxembourg.
In any application file that we review, Brexit or not, one of the first things that we look at are the substance requirements such as the minimum size of operations required.
“We cannot have the same requirements for a start-up with two clients compared to an
entity that has 3 million people in its client database. A certain level of common sense is needed.”
EXTRA CARE
“The entities that are looking for a licence in Luxembourg usually have done their due
diligence on a number of jurisdictions and have appropriate questions prepared. The feedback we hear is that they appreciate our openness to innovation, the reputation
of the CSSF as a strong financial regulator, and also the benefit of Luxembourg as a
financial marketplace, especially in an international context and for B2B business,”
explains O’Sullivan.
Throughout the application process, the applicant benefits from close interaction
with the regulator.
“Both our authorisation and supervision teams work hand in hand within our department. When a licence is granted and the file is passed from one team to the other, there is a continuity in the quality of engagement even though the faces change,” she adds.
The combination of a high level of expertise, responsiveness and the ability to
file an application in English have had an impact on the decision of several financial companies to come to Luxembourg.
“Whether the applicant wants to deal with us in English, French or German, we respond
in their language of choice, and in the context of Brexit that does help: the decision makers
understand the documents used in the process,” says Deloge.
GEARED UP FOR THE EXTRA WORKLOAD
Over the last 10 years, the CSSF has had to cope with rapid growth in different
parts of the financial sector, adding staff with the required experience to supervise
an increasingly important European fiancial hub.
We are continuously growing in numbers and in experience.
“We are continuously growing in numbers and in experience. Attracting talent, integrating new staff and converting the professionals we have hired into operational agents
is something that we have experience in. The important thing is to be growing at the right
time so as to be able to meet our obligations as a regulator and service the markets efficiently,” explains Deloge.
Currently employing around 850 people, the CSSF continues to recruit specialists to fulfil its tasks as regulator and supervisor of the financial sector. A staff count of more than 900 people is anticipated in the next few years.
“We have the necessary tools in place to ensure good supervision. We have experience with small start-ups and big players such as Amazon Payments and Alipay, so we are not afraid of what lies ahead of us,” she adds.
MOVING FORWARD TO POST-BREXIT: GROWING TOGETHER
When asked what will drive the European payments industry post-Brexit, the regulator highlights the importance of legal harmonisation across Europe: passporting is the main factor attracting global payments players to choose Luxembourg as their location for Europe.
Europe is attractive because there is a harmonised legal framework and EU legislation
ensures that there are no major discrepancies in legislation. EU countries grow together
when it comes to innovation. It is useful to know that you can oer your payment services across the EU and that you will be treated in the same way in another country,”
highlights Deloge.
“You set up in one country but you have access to the whole client base,” adds O’Sullivan.