New rules for payment services and more user protection

Automatic summary, not yet reviewed

1. The royal decree-lawroyal decree-law A rule with the force of law that the Government passes because it is urgent. It applies from its publication, but the Congreso must validate it within 30 days or it lapses. regulates payment services provided professionally in Spain: account management, cash withdrawals, transfers, direct debits, card payments, money remittance, and two new services: payment initiation and account information.
2. Two new services are regulated for the first time. Payment initiation allows starting a payment from an account held at another bank, and account information allows viewing online, in aggregated form, the status of one or several accounts.
3. Only authorized entities can provide payment services: banks, electronic money institutions, payment institutions, and others listed in the law. Anyone who is not one of them and is not excluded cannot provide these services.
4. The Bank of Spain now authorizes payment institutions, a task previously held by the Ministry of Economy and Business. It also registers them in a public registry and supervises them.
5. Payment institutions must protect users' money: either by keeping it in separate accounts, so users recover their funds if the institution goes bankrupt, or by covering it with insurance or a comparable guarantee.
6. If someone makes an unauthorized payment with your card or account, the provider must refund the amount immediately, at the latest by the end of the next business day, unless it suspects fraud. As a general rule, you only bear up to 50 euros of the losses if you did not act fraudulently or with gross negligence.
7. You can request a refund of a direct debit within eight weeks from the charge to your account. For direct debits in euros, the provider cannot refuse that refund.
8. Providers must apply strong customer authentication (two or more security elements) for online account access or online payments, manage security risks, and report serious incidents to the Bank of Spain.

Who it affects

• Users of payment services (consumers and microenterprises): They gain more protection against fraud, the right to refund direct debits, and access to new payment and account information services.
• Payment institutions and electronic money institutions: They must obtain authorization from the Bank of Spain, meet capital requirements, protect user funds, and submit to its supervision.
• Banks and credit institutions: They must give payment institutions non-discriminatory access to accounts and confirm the availability of funds when applicable.
• Payment initiation and account information providers: They are regulated for the first time: they must register with the Bank of Spain and meet security and liability obligations.

Words worth knowing

Adeudo domiciliado (direct debit)

A payment in which the beneficiary charges an amount to your account with your prior consent, such as electricity or water bills.

Contrato marco (framework contract)

The contract governing the terms of payment services between the user and the provider, covering future transactions.

Autenticación reforzada de cliente (strong customer authentication)

Verifying identity using at least two different elements: something you know (a password), something you have (your cell phone), or something you are (your fingerprint).

Microempresa (microenterprise)

A company with fewer than ten employees and annual turnover or balance sheet not exceeding two million euros.

Entidad de pago (payment institution)

A company authorized to provide payment services throughout the European Union without being a bank or taking deposits.

royal decree-law

A rule with the force of law that the Government passes because it is urgent. It applies from its publication, but the Congreso must validate it within 30 days or it lapses.

decree-law

A rule with the force of law that the Government passes because it is urgent. It applies from its publication, but the Congreso must validate it within 30 days or it lapses.

It summarizes the law as published in the BOE. It is written by artificial intelligence and may contain mistakes: the official text is what counts. Read the official text · How we make summaries