Captured statutory text (L5)
5 Electronic Money Regulations 2011
(19)For regulation 29 (registration of EEA branch) substitute—
Decision following notice of intention(29)
(1)If the Authority, taking into account any information received from the host state competent authority, proposes to determine that an authorised electronic money institution is not permitted to exercise passport rights in an EEA State as notified in a notice of intention, the Authority must give the relevant institution a warning notice.
(2)The Authority must, within the period of three months beginning with the date on which it receives a notice of intention and having considered any representations made in response to the warning notice—
(a)if it decides
(i)that the authorised electronic money institution is not permitted to exercise passport rights in the EEA State, not to register an EEA branch, or to cancel the registration an EEA branch, give the institution a decision notice; or
(ii)that the authorised electronic money institution is permitted to exercise passport rights in the EEA State, to register an EEA branch, or not to cancel the registration of an EEA branch, give the institution notice of its decision; and
(b)notify the host state competent authority of its decision, providing reasons for that decision if the Authority does not agree with the assessment of the host state competent authority.
(3)If the Authority decides that the authorised electronic money institution is not permitted to exercise passport rights in the EEA State, not to register an EEA branch, or to cancel the registration of an EEA branch, the institution may refer the matter to the Upper Tribunal.
(4)If the Authority decides to register an EEA branch, it must update the register as soon as practicable.
(5)If the Authority decides to cancel the registration of an EEA branch, the Authority must, where the period for a reference to the Upper Tribunal has expired without a reference being made, as soon as practicable update the register accordingly.
(6)The authorised electronic money institution may commence activities as notified in its notice of intention only after the Authority has notified the institution of its decision under paragraph (2)(a)(ii) and, in the case of services to be provided through an EEA branch, after entry of the branch on the register.
(7)After registration, the authorised electronic money institution must notify the Authority of the date on which it starts to provide payment services in the other EEA State through the EEA branch, and the Authority must notify such date to the host state competent authority.
Notice of intention from an EEA authorised payment institution(29A)
(1)If a home state competent authority sends information to the Authority about an EEA authorised electronic money institution which intends to provide services in the United Kingdom, the Authority must, before the end of the period of one month beginning on the day which the Authority receives all the required information—
(a)assess the information; and
(b)provide relevant information to the home state competent authority in connection with the intended provision of payment services in the United Kingdom, including in particular any reasonable grounds for concern with regard to money laundering or terrorist financing within the meaning of the money laundering directive in connection with the intended appointment of an agent or establishment of a branch in the United Kingdom.
(2)The EEA authorised electronic money institution may provide services in the United Kingdom in accordance with the information it has provided to the home state competent authority upon entry of the branch or agent in the register maintained by the home state competent authority.
.
(20)In regulation 30 (supervision of firms exercising passport rights)—
(a)in paragraph (2)(b)(ii) after “information” insert “ , including on compliance with the conditions at regulation 6(4)(a) and (4A) ”;
(b)for paragraph (4) substitute—
(4)The Authority may direct that an EEA authorised electronic money institution exercising its passport rights to services in the United Kingdom through a branch or an agent in the United Kingdom must report to the Authority on such activities, for information and statistical purposes and, where the institution has exercised its right of establishment in the United Kingdom, to monitor compliance with Part 5 of these Regulations.
(5)Reports required under paragraph (4) must be given at such times and in such form, and verified in such manner, as the Authority may direct.
(6)An agent in the United Kingdom appointed by an EEA authorised electronic money institution or a branch of an EEA authorised electronic money institution in the United Kingdom must maintain the confidentiality of any confidential information provided to the Authority under paragraph (4).
(7)If a host state competent authority informs the Authority that an authorised electronic money institution providing services through an EEA branch or an EEA agent does not comply with a provision of the payment services directive, the Authority must—
(a)exercise its powers as appropriate without undue delay, to ensure that the authorised payment institution complies with the relevant provisions; and
(b)inform the host state competent authority and the competent authority of any other relevant EEA State of the measures taken without delay.
(8)Where immediate action is necessary to address a serious risk to the collective interests of electronic money holders or payment service users in the United Kingdom, the Authority may, in addition to providing information under paragraph (2), take precautionary measures in relation to an EEA authorised electronic money institution pending action by the home state competent authority.
(9)Any measures taken under paragraph (8) must be temporary and must end when the risk identified has been addressed.
(10)If the Authority decides to take measures under paragraph (8), it must inform the home state competent authority, the competent authority of any other relevant EEA State, and the European Banking Authority of the measures to be taken and the reason that immediate action is necessary—
(a)in advance of taking the measures, if that is compatible with the need for immediate action; and
(b)in any event without undue delay.
(12)In paragraphs (7)(b) and (10) “competent authority of any other relevant EEA State” means a competent authority designated in accordance with the electronic money directive in an EEA State which the Authority considers to have an interest in the measures taken, or to be taken, by the Authority.
.
(21)Before regulation 32 (additional activities) insert—
Record keeping(31A)
(1)An electronic money institution must maintain relevant records and keep them for at least five years from the date on which the record was created.
(2)For the purposes of paragraph (1), records are relevant where they relate to compliance with obligations imposed by or under Parts 2 to 4 and, in particular, would enable the Authority to supervise effectively such compliance.
.
(22)In regulation 32(2) for “regulation 27(2) of the Payment Services Regulations 2009” substitute “ regulation 32(2) of the Payment Services Regulations 2017 ”.
(23)In regulation 34 (requirement for agents to be registered)—
(a)in paragraph (3)(a)—
(i)in paragraph (iii) after “the agent and” insert “ , if the agent is not an electronic money institution or an EEA authorised electronic money institution, or a payment service provider within the meaning of the Payment Services Regulations 2017, ”;
(ii)omit “and” after paragraph (iii)
(iii)after paragraph (iii) insert—
(iiia)the services for which the agent is appointed;
(iiib)the unique identification code or number of the agent, if any; and
;
(b)after paragraph (5) insert—
(5A)Where the application relates to the provision of services in exercise of passport rights through an EEA agent, the Authority must, within one month beginning with the date on which it received the completed application, inform the host state competent authority of the information provided under paragraph (3) or (5).
;
(c)omit paragraphs (7) and (8);
(d)after paragraph (10) insert—
(10A)Where the application relates to the provision of services in exercise of passport rights through an EEA agent, the Authority must—
(a)take into account any information received from the host state competent authority in making its decision; and
(b)notify the host state competent authority of its decision, providing reasons for that decision if the Authority does not agree with the assessment of the host state competent authority.
(10B)The Authority must give notice under paragraph (10) and (10A)—
(a)where the application relates to the provision of services in the United Kingdom, within a period of two months beginning on the date on which the Authority received the completed application;
(b)where the application relates to the provision of services in the exercise of passport rights through an EEA agent, within a period of three months beginning on the date on which the Authority received the completed application.
;
(e)after paragraph (12) insert—
(12A)An authorised electronic money institution must notify the Authority of the date on which it starts to provide services in another EEA State through a registered EEA agent, and the FCA must notify such date to the host state competent authority.
;
(f)after paragraph (14) insert—
(15)An authorised electronic money institution must notify the Authority without undue delay if there is any change in the information notified under paragraph (3) or (5).
.
(24)In regulation 36(1) (reliance) for “2009” substitute “ 2017 ”.
(25)In regulation 49 (reporting requirements), after paragraph (2) insert—
(3)A direction under this regulation must specify the purpose for which the information is required, as appropriate, and the time within which the information is to be given.
.
(26)In regulation 71 (duty to co-operate and exchange information)—
(a)in paragraph (1)—
(i)omit “and” after sub-paragraph (b);
(ii)after sub-paragraph (c) insert—
; and
(d)the European Banking Authority,
;
(b)in paragraph (2)(a) for “and (c)” substitute “ , (c) and (d) ”;
(c)after paragraph (2) insert—
(3)If the European Banking Authority is assisting the Authority, or a competent authority in another EEA State, in relation to a disagreement between those authorities pursuant to Article 19 of Regulation (EU) 1093/2010 of the European Parliament and of the Council of 24th November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC , the Authority must defer any decision in relation to the subject of the disagreement until the disagreement is resolved under that Article.
.
(27)In regulation 73 (prohibition on contracting out) for “2009” substitute “ 2017 ”.
(28)After regulation 78 (amendments to the banking consolidation directive) insert—
Transitional arrangements for existing electronic money institutions on the implementation of the second payment services directive(78A)
(1)This regulation applies in relation to an authorised electronic money institution, EEA authorised electronic money institution or small electronic money institution which provides services before 13th January 2018 in accordance with these Regulations or the national law in another EEA State transposing the electronic money directive and, where relevant, the Payment Services Regulations 2009 or the national law in another EEA State transposing the first payment services directive.
(2)In the case of an authorised electronic money institution or small electronic money institution—
(a)the institution may continue to provide the services provided before 13th January 2018 until the end of 12th July 2018 without further authorisation or registration under these Regulations;
(b)the institution is to be treated as if on 13th January 2018 the Authority had imposed a requirement under regulation 7 (imposition of variations), including under that regulation as applied by regulation 15 (supplementary provisions), requiring the institution to refrain from providing account information services or payment initiation services for an indefinite period;
(c)any other requirement imposed by the Authority under regulation 7 (imposition of variations), including under that regulation as applied by regulation 15 (supplementary provisions), applies in relation to services provided pursuant to sub-paragraph (a);
(d)regulations 10 (cancellation of authorisation) and 11 (variation of authorisation on Authority's own initiative), including those regulations as applied by regulation 15, apply in relation to the institution as if references to authorisation or registration included references to entitlement to provide payment services pursuant to sub-paragraph (a); and
(e)the institution may not apply for a variation under regulation 8 (variation etc. at request of authorised electronic money institution), including under that regulation as applied by regulation 15, before it complies with paragraph (4) or (5) of this regulation.
(3)An EEA authorised electronic money institution may continue to provide the services provided before 13th January 2018 until the end of 12th July 2018 without further authorisation or registration under the national law implementing the amendments to the electronic money directive made by Article 111 of the payment services directive.
(4)Where an authorised electronic money institution intends to provide services on or after 13th July 2018, the institution must before 13th April 2018—
(a)provide to the Authority all information specified in Schedule 1 that the person has not previously provided to the Authority; or
(b)notify the Authority that it has previously provided all such information to the Authority.
(5)Where a small electronic money institution intends to provide services as a small electronic money institution on or after 13th July 2018, the institution must before 13th April 2018 notify the Authority whether it continues to meet the requirements for registration as a small electronic money institution, together with any information relevant to that question which is has not previously provided to the Authority.
(6)On receipt of information or a notification pursuant to paragraph (4) or (5), the Authority must consider whether the institution's authorisation or registration should be continued on and after 13th July 2018.
(7)If the Authority does not decide to continue the institution's authorisation or registration under paragraph (6), the institution's authorisation or registration is to be treated as having been cancelled on 13th July 2018.
(8)The Authority must maintain in the register a person entitled to provide services pursuant to this regulation.
(9)In this regulation “first payment services directive” means Directive 2007/64/EC of the European Parliament and of the Council of 13th November 2007 on payment services in the internal market amending Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC .
.
(29)In Schedule 1 (information to be included in or with an application for authorisation)—
(a)after paragraph 5 insert—
(5A) A description of the applicant's procedure for monitoring, handling and following up security incidents and security-related customer complaints, including where appropriate an incidents reporting mechanism which takes account of the notification obligations under regulation 99 of the Payment Services Regulations 2017.
(5B) A description of the applicant's process for filing, monitoring, tracking and restricting access to sensitive payment data.
(5C) A description of the applicant's business continuity arrangements, including a clear identification of the critical operations, effective contingency plans, and a procedure for regular testing and reviewing of the adequacy and efficiency of such plans.
(5D) A description of the principles and definitions used by the applicant in collecting statistical data on performance, transactions and fraud.
(5E) A statement of the applicant's security policy, including—
(a)a detailed risk assessment in relation to the payment services to be provided, including risks of fraud and illegal use of sensitive and personal data, and
(b)a description of—
(i)the applicant's security control and mitigation measures to provide adequate protection to users against the risks identified,
(ii)how such measures ensure a high level of technical security and data protection, including such security and protection for the software and IT systems used by the applicant and any undertakings to which the applicant outsources any part of its operations, and
(iii)where appropriate, the applicant's measures to comply with regulation 98(1) of the Payment Services Regulations 2017, taking into account any guidelines issued by the European Banking Authority under Article 95(3) of the payment services directive.
;
(b)in paragraph 7, after “branches and” insert “ the off-site and on-site checks that the applicant undertakes to perform on them at least annually, ”;
(c)in paragraph 13, after “5” insert “ , 5A ”; and
(d)after paragraph 13, insert—
(14) In the case of an applicant which proposes to provide payment initiation services or account information services, the professional indemnity insurance or comparable guarantee which it holds in relation to such services.
.
(30)In Schedule 2 (capital requirements)—
(a)in paragraph 1 for “the items specified in paragraph 4(a), (b) and (c) of this Schedule” substitute “ one or more of the items specified in Article 26(1)(a) to (e) of the capital requirements regulation ”;
(b)in paragraph 4 for “the following items” to the end substitute “ own funds as defined in Article 4(1)(18) of the capital requirements regulation, and are to be calculated in accordance with paragraphs 9 to 12. ”;
(c)omit paragraphs 5 to 8 and the heading preceding paragraph 7;
(d)for paragraph 9 substitute—
(9) For the purposes of calculating own funds—
(a)the amount of Tier 2 capital must be equal to or less than one third of the amount of Tier 1 capital;
(b)at least 75% of the amount of Tier 1 capital must be in the form of Common Equity Tier 1 capital.
;
(e)in paragraph 13(a) after “payment services” insert “ specified in paragraph 1(a) to (f) of Schedule 1 of the Payment Services Regulations 2017. ”;
(f)in paragraph 21(4)—
(i)in paragraph (a) for “2009” substitute “ 2017 ”;
(ii)omit paragraph (b);
(iii)in paragraph (c) after “payment service” insert “ specified in paragraph 1(a) to (e) of Schedule 1 to those Regulations ”.
Full captured verbatim text
(19) For regulation 29 (registration of EEA branch) substitute— Decision following notice of intention(29) (1) If the Authority, taking into account any information received from the host state competent authority, proposes to determine that an authorised electronic money institution is not permitted to exercise passport rights in an EEA State as notified in a notice of intention, the Authority must give the relevant institution a warning notice. (2) The Authority must, within the period of three months beginning with the date on which it receives a notice of intention and having considered any representations made in response to the warning notice— (a) if it decides (i) that the authorised electronic money institution is not permitted to exercise passport rights in the EEA State, not to register an EEA branch, or to cancel the registration an EEA branch, give the institution a decision notice; or (ii) that the authorised electronic money institution is permitted to exercise passport rights in the EEA State, to register an EEA branch, or not to cancel the registration of an EEA branch, give the institution notice of its decision; and (b) notify the host state competent authority of its decision, providing reasons for that decision if the Authority does not agree with the assessment of the host state competent authority. (3) If the Authority decides that the authorised electronic money institution is not permitted to exercise passport rights in the EEA State, not to register an EEA branch, or to cancel the registration of an EEA branch, the institution may refer the matter to the Upper Tribunal. (4) If the Authority decides to register an EEA branch, it must update the register as soon as practicable. (5) If the Authority decides to cancel the registration of an EEA branch, the Authority must, where the period for a reference to the Upper Tribunal has expired without a reference being made, as soon as practicable update the register accordingly. (6) The authorised electronic money institution may commence activities as notified in its notice of intention only after the Authority has notified the institution of its decision under paragraph (2)(a)(ii) and, in the case of services to be provided through an EEA branch, after entry of the branch on the register. (7) After registration, the authorised electronic money institution must notify the Authority of the date on which it starts to provide payment services in the other EEA State through the EEA branch, and the Authority must notify such date to the host state competent authority. Notice of intention from an EEA authorised payment institution(29A) (1) If a home state competent authority sends information to the Authority about an EEA authorised electronic money institution which intends to provide services in the United Kingdom, the Authority must, before the end of the period of one month beginning on the day which the Authority receives all the required information— (a) assess the information; and (b) provide relevant information to the home state competent authority in connection with the intended provision of payment services in the United Kingdom, including in particular any reasonable grounds for concern with regard to money laundering or terrorist financing within the meaning of the money laundering directive in connection with the intended appointment of an agent or establishment of a branch in the United Kingdom. (2) The EEA authorised electronic money institution may provide services in the United Kingdom in accordance with the information it has provided to the home state competent authority upon entry of the branch or agent in the register maintained by the home state competent authority. . (20) In regulation 30 (supervision of firms exercising passport rights)— (a) in paragraph (2)(b)(ii) after “information” insert “ , including on compliance with the conditions at regulation 6(4)(a) and (4A) ”; (b) for paragraph (4) substitute— (4) The Authority may direct that an EEA authorised electronic money institution exercising its passport rights to services in the United Kingdom through a branch or an agent in the United Kingdom must report to the Authority on such activities, for information and statistical purposes and, where the institution has exercised its right of establishment in the United Kingdom, to monitor compliance with Part 5 of these Regulations. (5) Reports required under paragraph (4) must be given at such times and in such form, and verified in such manner, as the Authority may direct. (6) An agent in the United Kingdom appointed by an EEA authorised electronic money institution or a branch of an EEA authorised electronic money institution in the United Kingdom must maintain the confidentiality of any confidential information provided to the Authority under paragraph (4). (7) If a host state competent authority informs the Authority that an authorised electronic money institution providing services through an EEA branch or an EEA agent does not comply with a provision of the payment services directive, the Authority must— (a) exercise its powers as appropriate without undue delay, to ensure that the authorised payment institution complies with the relevant provisions; and (b) inform the host state competent authority and the competent authority of any other relevant EEA State of the measures taken without delay. (8) Where immediate action is necessary to address a serious risk to the collective interests of electronic money holders or payment service users in the United Kingdom, the Authority may, in addition to providing information under paragraph (2), take precautionary measures in relation to an EEA authorised electronic money institution pending action by the home state competent authority. (9) Any measures taken under paragraph (8) must be temporary and must end when the risk identified has been addressed. (10) If the Authority decides to take measures under paragraph (8), it must inform the home state competent authority, the competent authority of any other relevant EEA State, and the European Banking Authority of the measures to be taken and the reason that immediate action is necessary— (a) in advance of taking the measures, if that is compatible with the need for immediate action; and (b) in any event without undue delay. (12) In paragraphs (7)(b) and (10) “competent authority of any other relevant EEA State” means a competent authority designated in accordance with the electronic money directive in an EEA State which the Authority considers to have an interest in the measures taken, or to be taken, by the Authority. . (21) Before regulation 32 (additional activities) insert— Record keeping(31A) (1) An electronic money institution must maintain relevant records and keep them for at least five years from the date on which the record was created. (2) For the purposes of paragraph (1), records are relevant where they relate to compliance with obligations imposed by or under Parts 2 to 4 and, in particular, would enable the Authority to supervise effectively such compliance. . (22) In regulation 32(2) for “regulation 27(2) of the Payment Services Regulations 2009” substitute “ regulation 32(2) of the Payment Services Regulations 2017 ”. (23) In regulation 34 (requirement for agents to be registered)— (a) in paragraph (3)(a)— (i) in paragraph (iii) after “the agent and” insert “ , if the agent is not an electronic money institution or an EEA authorised electronic money institution, or a payment service provider within the meaning of the Payment Services Regulations 2017, ”; (ii) omit “and” after paragraph (iii) (iii) after paragraph (iii) insert— (iiia) the services for which the agent is appointed; (iiib) the unique identification code or number of the agent, if any; and ; (b) after paragraph (5) insert— (5A) Where the application relates to the provision of services in exercise of passport rights through an EEA agent, the Authority must, within one month beginning with the date on which it received the completed application, inform the host state competent authority of the information provided under paragraph (3) or (5). ; (c) omit paragraphs (7) and (8); (d) after paragraph (10) insert— (10A) Where the application relates to the provision of services in exercise of passport rights through an EEA agent, the Authority must— (a) take into account any information received from the host state competent authority in making its decision; and (b) notify the host state competent authority of its decision, providing reasons for that decision if the Authority does not agree with the assessment of the host state competent authority. (10B) The Authority must give notice under paragraph (10) and (10A)— (a) where the application relates to the provision of services in the United Kingdom, within a period of two months beginning on the date on which the Authority received the completed application; (b) where the application relates to the provision of services in the exercise of passport rights through an EEA agent, within a period of three months beginning on the date on which the Authority received the completed application. ; (e) after paragraph (12) insert— (12A) An authorised electronic money institution must notify the Authority of the date on which it starts to provide services in another EEA State through a registered EEA agent, and the FCA must notify such date to the host state competent authority. ; (f) after paragraph (14) insert— (15) An authorised electronic money institution must notify the Authority without undue delay if there is any change in the information notified under paragraph (3) or (5). . (24) In regulation 36(1) (reliance) for “2009” substitute “ 2017 ”. (25) In regulation 49 (reporting requirements), after paragraph (2) insert— (3) A direction under this regulation must specify the purpose for which the information is required, as appropriate, and the time within which the information is to be given. . (26) In regulation 71 (duty to co-operate and exchange information)— (a) in paragraph (1)— (i) omit “and” after sub-paragraph (b); (ii) after sub-paragraph (c) insert— ; and (d) the European Banking Authority, ; (b) in paragraph (2)(a) for “and (c)” substitute “ , (c) and (d) ”; (c) after paragraph (2) insert— (3) If the European Banking Authority is assisting the Authority, or a competent authority in another EEA State, in relation to a disagreement between those authorities pursuant to Article 19 of Regulation (EU) 1093/2010 of the European Parliament and of the Council of 24th November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC , the Authority must defer any decision in relation to the subject of the disagreement until the disagreement is resolved under that Article. . (27) In regulation 73 (prohibition on contracting out) for “2009” substitute “ 2017 ”. (28) After regulation 78 (amendments to the banking consolidation directive) insert— Transitional arrangements for existing electronic money institutions on the implementation of the second payment services directive(78A) (1) This regulation applies in relation to an authorised electronic money institution, EEA authorised electronic money institution or small electronic money institution which provides services before 13th January 2018 in accordance with these Regulations or the national law in another EEA State transposing the electronic money directive and, where relevant, the Payment Services Regulations 2009 or the national law in another EEA State transposing the first payment services directive. (2) In the case of an authorised electronic money institution or small electronic money institution— (a) the institution may continue to provide the services provided before 13th January 2018 until the end of 12th July 2018 without further authorisation or registration under these Regulations; (b) the institution is to be treated as if on 13th January 2018 the Authority had imposed a requirement under regulation 7 (imposition of variations), including under that regulation as applied by regulation 15 (supplementary provisions), requiring the institution to refrain from providing account information services or payment initiation services for an indefinite period; (c) any other requirement imposed by the Authority under regulation 7 (imposition of variations), including under that regulation as applied by regulation 15 (supplementary provisions), applies in relation to services provided pursuant to sub-paragraph (a); (d) regulations 10 (cancellation of authorisation) and 11 (variation of authorisation on Authority's own initiative), including those regulations as applied by regulation 15, apply in relation to the institution as if references to authorisation or registration included references to entitlement to provide payment services pursuant to sub-paragraph (a); and (e) the institution may not apply for a variation under regulation 8 (variation etc. at request of authorised electronic money institution), including under that regulation as applied by regulation 15, before it complies with paragraph (4) or (5) of this regulation. (3) An EEA authorised electronic money institution may continue to provide the services provided before 13th January 2018 until the end of 12th July 2018 without further authorisation or registration under the national law implementing the amendments to the electronic money directive made by Article 111 of the payment services directive. (4) Where an authorised electronic money institution intends to provide services on or after 13th July 2018, the institution must before 13th April 2018— (a) provide to the Authority all information specified in Schedule 1 that the person has not previously provided to the Authority; or (b) notify the Authority that it has previously provided all such information to the Authority. (5) Where a small electronic money institution intends to provide services as a small electronic money institution on or after 13th July 2018, the institution must before 13th April 2018 notify the Authority whether it continues to meet the requirements for registration as a small electronic money institution, together with any information relevant to that question which is has not previously provided to the Authority. (6) On receipt of information or a notification pursuant to paragraph (4) or (5), the Authority must consider whether the institution's authorisation or registration should be continued on and after 13th July 2018. (7) If the Authority does not decide to continue the institution's authorisation or registration under paragraph (6), the institution's authorisation or registration is to be treated as having been cancelled on 13th July 2018. (8) The Authority must maintain in the register a person entitled to provide services pursuant to this regulation. (9) In this regulation “first payment services directive” means Directive 2007/64/EC of the European Parliament and of the Council of 13th November 2007 on payment services in the internal market amending Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC . . (29) In Schedule 1 (information to be included in or with an application for authorisation)— (a) after paragraph 5 insert— (5A) A description of the applicant's procedure for monitoring, handling and following up security incidents and security-related customer complaints, including where appropriate an incidents reporting mechanism which takes account of the notification obligations under regulation 99 of the Payment Services Regulations 2017. (5B) A description of the applicant's process for filing, monitoring, tracking and restricting access to sensitive payment data. (5C) A description of the applicant's business continuity arrangements, including a clear identification of the critical operations, effective contingency plans, and a procedure for regular testing and reviewing of the adequacy and efficiency of such plans. (5D) A description of the principles and definitions used by the applicant in collecting statistical data on performance, transactions and fraud. (5E) A statement of the applicant's security policy, including— (a) a detailed risk assessment in relation to the payment services to be provided, including risks of fraud and illegal use of sensitive and personal data, and (b) a description of— (i) the applicant's security control and mitigation measures to provide adequate protection to users against the risks identified, (ii) how such measures ensure a high level of technical security and data protection, including such security and protection for the software and IT systems used by the applicant and any undertakings to which the applicant outsources any part of its operations, and (iii) where appropriate, the applicant's measures to comply with regulation 98(1) of the Payment Services Regulations 2017, taking into account any guidelines issued by the European Banking Authority under Article 95(3) of the payment services directive. ; (b) in paragraph 7, after “branches and” insert “ the off-site and on-site checks that the applicant undertakes to perform on them at least annually, ”; (c) in paragraph 13, after “5” insert “ , 5A ”; and (d) after paragraph 13, insert— (14) In the case of an applicant which proposes to provide payment initiation services or account information services, the professional indemnity insurance or comparable guarantee which it holds in relation to such services. . (30) In Schedule 2 (capital requirements)— (a) in paragraph 1 for “the items specified in paragraph 4(a), (b) and (c) of this Schedule” substitute “ one or more of the items specified in Article 26(1)(a) to (e) of the capital requirements regulation ”; (b) in paragraph 4 for “the following items” to the end substitute “ own funds as defined in Article 4(1)(18) of the capital requirements regulation, and are to be calculated in accordance with paragraphs 9 to 12. ”; (c) omit paragraphs 5 to 8 and the heading preceding paragraph 7; (d) for paragraph 9 substitute— (9) For the purposes of calculating own funds— (a) the amount of Tier 2 capital must be equal to or less than one third of the amount of Tier 1 capital; (b) at least 75% of the amount of Tier 1 capital must be in the form of Common Equity Tier 1 capital. ; (e) in paragraph 13(a) after “payment services” insert “ specified in paragraph 1(a) to (f) of Schedule 1 of the Payment Services Regulations 2017. ”; (f) in paragraph 21(4)— (i) in paragraph (a) for “2009” substitute “ 2017 ”; (ii) omit paragraph (b); (iii) in paragraph (c) after “payment service” insert “ specified in paragraph 1(a) to (e) of Schedule 1 to those Regulations ”.