Beschluss (EU) 2022/911 der Europäischen Zentralbank vom 19. April 2022 zu den TARGET-EZB-Bedingungen und zur Aufhebung des Beschlusses EZB/2007/7 (EZB/2022/22)

Durchsuchbarer Text in vereinfachter Darstellung. Tabellen, Abbildungen und verbindliche Gestaltung bitte anhand der Originaldateien prüfen.

ated on a cumulative basis as set out in the following table. For participants in a billing group the monthly volume of payment orders (debit entry) for all participants in that group shall be aggregated. Monthly fee EUR 1 875 Monthly volume of payment orders Band From To Transaction fee per payment order (EUR) 1. 1 10 000 0,60 2. 10 001 25 000 0,50 3. 25 001 50 000 0,40 4. 50 001 75 000 0,20 5. 75 001 100 000 0,125 6. 100 001 150 000 0,08 7. Above 150 000 0,05 2. Liquidity transfer orders from RTGS DCAs to sub-accounts, to MCAs, to overnight deposit accounts or to RTGS DCAs held by the same participant or by participants within the same banking group shall be free of charge. 3. Liquidity transfer orders from RTGS DCAs to MCAs or to RTGS DCAs held by participants not belonging to the same banking group shall incur a charge of EUR 0,80 per transaction (debit entry). 4. Liquidity transfer orders from RTGS DCAs to T2S DCAs or to TIPS DCAs shall be free of charge. 5. Cash transfer orders from an RTGS DCA to an AS account (1) shall not be charged to the RTGS DCA holder. 6. The following fees shall apply to RTGS DCA holders: Service Monthly fee (EUR) Addressable BIC holder (correspondents (2)) 20 Unpublished BIC 30 Multi-addressee access (based on BIC 8) 80 4. FEES FOR AS USING RTGS AS SETTLEMENT PROCEDURES Fees are charged per ancillary system regardless of the number and type of accounts. AS Operators operating more than one system will be charged for each system. 1. AS using RTGS AS settlement procedures or having been granted an exception allowing them to settle on an RTGS DCA shall choose one of the following two pricing options: a) a monthly fee, plus a fixed transaction fee per cash transfer order. Monthly fee EUR 300 Transaction fee per cash transfer order EUR 1,60 b) a monthly fee, plus a transaction fee based on the volume of cash transfer orders an calculated on a cumulative basis as set out in the following table. Monthly fee EUR 3 750 Monthly volume of cash transfer orders Band From To Transaction fee per cash transfer order (EUR) 1. 1 5 000 1,20 2. 5 001 12 500 1,00 3. 12 501 25 000 0,80 4. 25 001 50 000 0,40 5. Above 50 000 0,25 Cash transfer orders between an RTGS DCA and an AS account (3) shall be charged to the respective A according to the pricing option that the AS has opted for. 2. In addition to the fees set out above, each AS shall be subject to two fixed fees as set out in the following table. A. Fixed fee I Monthly fee per AS EUR 2 000 B. Fixed fee II (based on gross underlying value (4) ) Size (EUR millions/day) Annual fee (EUR) Monthly fee (EUR) from 0 to 999,99 10 000 833 from 1 000 to 2 499,99 20 000 1 667 from 2 500 to 4 999,99 40 000 3 334 from 5 000 to 9 999,99 60 000 5 000 from 10 000 to 49 999,99 80 000 6 666 from 50 000 to 499 999,99 100 000 8 333 500 000 and above 200 000 16 667 5. FEES FOR T2S DCA HOLDERS 1. The following fees shall be charged for the operation of T2S DCAs: Item Applied rule Fee per item (EUR) Liquidity transfer orders between T2S DCAs Per transfer for the debited T2S DCA. 0,141 Intra-balance movements Any successfully executed intra-balance movement (i.e. blocking, unblocking, reservation of liquidity usw.). 0,094 A2A queries Per business item within each A2A query generated 0,007 A2A reports Per business item within each generated A2A report including A2A reports as a result of U2A queries. 0,004 Messages bundled into a file Per message in each file containing bundled messages 0,004 Transmission Each transmission per T2S party (both inbound and outbound) will be counted and charged for (except for technical acknowledgement messages). 0,012 U2A queries Any executed query search function 0,100 Fee per T2S DCA Any T2S DCA existing at any time during the monthly billing period Currently free of charge, to be reviewed at regular intervals. 0,000 Auto-collateralisation Issue or return of auto-collateralisation 0,000 2. Liquidity transfer orders from a T2S DCA to an RTGS DCA, a TIPS DCA or an MCA shall be free of charge. 6. FEES FOR TIPS DCA HOLDERS 1. Fees for the operation of TIPS DCAs shall be charged to the party indicated as shown in the following table: Item Rule applied Fee per item (EUR) Settled instant payment order Party to be charged: the owner of the TIPS DCA to be debited 0,002 Unsettled instant payment order Party to be charged: the owner of the TIPS DCA to be debited 0,002 Settled positive recall answer Party to be charged: the owner of the TIPS DCA to be credited 0,002 Unsettled positive recall answer Party to be charged: the owner of the TIPS DCA to be credited 0,002 2. Liquidity transfer orders from TIPS DCAs to: MCAs; RTGS DCAs; sub-accounts; overnight deposit accounts; TIPS AS technical accounts; and T2S DCAs shall be free of charge. 7. FEES FOR AS USING TIPS AS SETTLEMENT PROCEDURE 1. Fees for the use by an AS of the TIPS AS settlement procedure shall be charged to the party indicated as shown in the following table: Item Rule applied Fee per item (EUR) Settled instant payment order Party to be charged: the owner of the TIPS AS technical account to be debited 0,002 Unsettled instant payment order Party to be charged: the owner of the TIPS AS technical account to be debited 0,002 Settled positive recall answer Party to be charged: the owner of the TIPS AS technical account to be credited 0,002 Unsettled positive recall answer Party to be charged: the owner of the TIPS AS technical account to be credited 0,002 2. Liquidity transfer orders from TIPS AS technical accounts to TIPS DCAs shall be free of charge. 3. In addition to the fees set out above, each AS shall be subject to a monthly fee based on the gross underlying volume of instant payments, near instant payments and positive recall answers settled in the AS’s own platform and enabled by the pre-funded positions on the TIPS AS technical account. The fee shall be EUR 0,0005 per settled instant payment, near instant payment or settled positive recall answer. For each month, each AS shall report the gross underlying volume of its settled instant payments, near instant payments and settled positive recall answers rounded down to the nearest ten thousand, at the latest by the third business day of the following month. The reported gross underlying volume shall be applied by the ECB to calculate the fee for the following month. (1) Regardless of whether it is a RTGS DCA, an RTGS AS technical account or an AS guarantee funds account. (2) Addressable BIC holders are available for different participant types: Addressable BIC holder — Correspondent; Addressable BIC holder — Branch of Participant; and Addressable BIC holder — Branch of correspondent. Only the Addressable BIC holder — Correspondent participation type shall incur the fee. The fee shall be charged for each different BIC11. (3) Regardless of whether it is a RTGS DCA, an RTGS AS technical account or an AS guarantee funds Account. (4) The ‘gross underlying value‘ is the total amount of gross monetary obligations that are discharged via an AS after settlement has taken place on an RTGS DCA or sub-account. For CCPs, the gross underlying value is the total notional value of future contracts or the mark-to-market value of the future contracts, at values to be settled when futures contracts expire and commissions are applied. APPENDIX VII REQUIREMENTS REGARDING INFORMATION SECURITY MANAGEMENT AND BUSINESS CONTINUITY MANAGEMENT MCA HOLDERS, T2S DCA HOLDERS AND TIPS DCA HOLDERS These requirements regarding information security management or business continuity management shall not apply to MCA holders, T2S DCA holders and TIPS DCA holders. RTGS DCA HOLDERS AND AS The requirements set out in section 1 of this Appendix VII (information security management) shall apply to all RTGS DCA holders and AS, except where an RTGS DCA holder or an AS demonstrates that a specific requirement is not applicable to it. In establishing the scope of application of the requirements within its infrastructure, the participant should identify the elements that are part of the Payment Transaction Chain (PTC). Specifically, the PTC starts at a Point of Entry (PoE), i.e. a system involved in the creation of transactions (e.g. workstations, front-office and back-office applications, middleware), and ends at the system responsible to send the message to the NSP. The requirements set out in section 2 of this Appendix VII (business continuity management) shall apply to RTGS DCA holders and AS designated by the Eurosystem as being critical for the smooth functioning of the TARGET system on the basis of criteria periodically updated and published on the ECB’s website. 1. Information security management Requirement 1.1: Information security policy The management shall set a clear policy direction in line with business objectives and demonstrate support for and commitment to information security through the issuance, approval and maintenance of an information security policy aiming at managing information security and cyber resilience across the organisation in terms of identification, assessment and treatment of information security and cyber resilience risks. The policy should contain at least the following sections: objectives, scope (including domains such as organisation, human resources, asset management usw.), principles and allocation of responsibilities. Requirement 1.2: Internal organisation An information security framework shall be established to implement the information security policy within the organisation. The management shall coordinate and review the establishment of the information security framework to ensure the implementation of the information security policy (as per Requirement 1.1) across the organisation, including the allocation of sufficient resources and assignment of security responsibilities for this purpose. Requirement 1.3: External parties The security of the organisation’s information and information processing facilities should not be reduced by the introduction of, and/or the dependence on, an external party/parties or products/services provided by them. Any access to the organisation’s information processing facilities by external parties shall be controlled. When external parties or products/services of external parties are required to access the organisation’s information processing facilities, a risk assessment shall be carried out to determine the security implications and control requirements. Controls shall be agreed and defined in an agreement with each relevant external party. Requirement 1.4: Asset management All information assets, the business processes and the underlying information systems, such as operating systems, infrastructures, business applications, off-the-shelf products, services and user-developed applications, in the scope of the Payment Transaction Chain shall be accounted for and have a nominated owner. The responsibility for the maintenance and the operation of appropriate controls in the business processes and the related IT components to safeguard the information assets shall be assigned. Note: the owner can delegate the implementation of specific controls as appropriate, but remains accountable for the proper protection of the assets. Requirement 1.5: Information assets classification Information assets shall be classified in terms of their criticality to the smooth delivery of the service by the participant. The classification shall indicate the need, priorities and degree of protection required when handling the information asset in the relevant business processes and shall also take into consideration the underlying IT components. An information asset classification scheme approved by the management shall be used to define an appropriate set of protection controls throughout the information asset lifecycle (including removal and destruction of information assets) and to communicate the need for specific handling measures. Requirement 1.6: Human resources security Security responsibilities shall be addressed prior to employment in adequate job descriptions and in terms and conditions of employment. All candidates for employment, contractors and third-party users shall be adequately screened, especially for sensitive jobs. Employees, contractors and third-party users of information processing facilities shall sign an agreement on their security roles and responsibilities. An adequate level of awareness shall be ensured among all employees, contractors and third-party users, and education and training in security procedures and the correct use of information processing facilities shall be provided to them to minimise possible security risks. A formal disciplinary process for handling security breaches shall be established for employees. Responsibilities shall be in place to ensure that an employee’s, contractor’s or third-party user’s exit from or transfer within the organisation is managed, and that the return of all equipment and the removal of all access rights are completed. Requirement 1.7: Physical and environmental security Critical or sensitive information processing facilities shall be housed in secure areas, protected by defined security perimeters, with appropriate security barriers and entry controls. They shall be physically protected from unauthorised access, damage and interference. Access shall be granted only to individuals who fall within the scope of Requirement 1.6. Procedures and standards shall be established to protect physical media containing information assets when in transit. Equipment shall be protected from physical and environmental threats. Protection of equipment (including equipment used off-site) and against the removal of property is necessary to reduce the risk of unauthorised access to information and to guard against loss or damage of equipment or information. Special measures may be required to protect against physical threats and to safeguard supporting facilities such as the electrical supply and cabling infrastructure. Requirement 1.8: Operations management Responsibilities and procedures shall be established for the management and operation of information processing facilities covering all the underlying systems in the Payment Transaction Chain end-to-end. As regards operating procedures, including technical administration of IT systems, segregation of duties shall be implemented, where appropriate, to reduce the risk of negligent or deliberate system misuse. Where segregation of duties cannot be implemented due to documented objective reasons, compensatory controls shall be implemented following a formal risk analysis. Controls shall be established to prevent and detect the introduction of malicious code for systems in the Payment Transaction Chain. Controls shall be also established (including user awareness) to prevent, detect and remove malicious code. Mobile code shall be used only from trusted sources (e.g. signed Microsoft COM components and Java Applets). The configuration of the browser (e.g. the use of extensions and plugins) shall be strictly controlled. Data backup and recovery policies shall be implemented by the management; those recovery policies shall include a plan of the restoration process which is tested at regular intervals at least annually. Systems that are critical for the security of payments shall be monitored and events relevant to information security shall be recorded. Operator logs shall be used to ensure that information system problems are identified. Operator logs shall be regularly reviewed on a sample basis, based on the criticality of the operations. System monitoring shall be used to check the effectiveness of controls which are identified as critical for the security of payments and to verify conformity to an access policy model. Exchanges of information between organisations shall be based on a formal exchange policy, carried out in line with exchange agreements among the involved parties and shall be compliant with any relevant legislation. Third party software components employed in the exchange of information with TARGET (e.g. software received from a Service Bureau) must be used under a formal agreement with the third party. Requirement 1.9: Access control Access to information assets shall be justified on the basis of business requirements (need-to-know (1)) and according to the established framework of corporate policies (including the information security policy). Clear access control rules shall be defined based on the principle of least privilege (2) to reflect closely the needs of the corresponding business and IT processes. Where relevant, (e.g. for backup management) logical access control should be consistent with physical access control unless there are adequate compensatory controls in place (e.g. encryption, personal data anonymisation). Formal and documented procedures shall be in place to control the allocation of access rights to information systems and services that fall within the scope of the Payment Transaction Chain. The procedures shall cover all stages in the lifecycle of user access, from the initial registration of new users to the final deregistration of users that no longer require access. Special attention shall be given, where appropriate, to the allocation of access rights of such criticality that the abuse of those access rights could lead to a severe adverse impact on the operations of the participant (e.g. access rights allowing system administration, override of system controls, direct access to business data). Appropriate controls shall be put in place to identify, authenticate and authorise users at specific points in the organisation’s network, e.g. for local and remote access to systems in the Payment Transaction Chain. Personal accounts shall not be shared in order to ensure accountability. For passwords, rules shall be established and enforced by specific controls to ensure that passwords cannot be easily guessed, e.g. complexity rules and limited-time validity. A safe password recovery and/or reset protocol shall be established. A policy shall be developed and implemented on the use of cryptographic controls to protect the confidentiality, authenticity and integrity of information. A key management policy shall be established to support the use of cryptographic controls. There shall be policy for viewing confidential information on screen or in print (e.g. a clear screen, a clear desk policy) to reduce the risk of unauthorised access. When working remotely, the risks of working in an unprotected environment shall be considered and appropriate technical and organisational controls shall be applied. Requirement 1.10: Information systems acquisition, development and maintenance Security requirements shall be identified and agreed prior to the development and/or implementation of information systems. Appropriate controls shall be built into applications, including user-developed applications, to ensure correct processing. These controls shall include the validation of input data, internal processing and output data. Additional controls may be required for systems that process, or have an impact on, sensitive, valuable or critical information. Such controls shall be determined on the basis of security requirements and risk assessment according to the established policies (e.g. information security policy, cryptographic control policy). The operational requirements of new systems shall be established, documented and tested prior to their acceptance and use. As regards network security, appropriate controls, including segmentation and secure management, should be implemented based on the criticality of data flows and the level of risk of the network zones in the organisation. There shall be specific controls to protect sensitive information passing over public networks. Access to system files and program source code shall be controlled and IT projects and support activities conducted in a secure manner. Care shall be taken to avoid exposure of sensitive data in test environments. Project and support environments shall be strictly controlled. Deployment of changes in production shall be strictly controlled. A risk assessment of the major changes to be deployed in production shall be conducted. Regular security testing activities of systems in production shall also be conducted according to a predefined plan based on the outcome of a risk-assessment, and security testing shall include, at least, vulnerability assessments. All of the shortcomings highlighted during the security testing activities shall be assessed and action plans to close any identified gap shall be prepared and followed-up in a timely fashion. Requirement 1.11: Information security in supplier (3) relationships To ensure protection of the participant’s internal information systems that are accessible by suppliers, information security requirements for mitigating the risks associated with supplier’s access shall be documented and formally agreed upon with the supplier. Requirement 1.12: Management of information security incidents and improvements To ensure a consistent and effective approach to the management of information security incidents, including communication on security events and weaknesses, roles, responsibilities