Systemically important payment systems (SIPS)

KEY POINTS

Pursuant to the Treaty on the Functioning of the European Union and the Statute of the European System of Central Banks and of the ECB, the Eurosystem promotes the smooth operation of payment systems¹ by conducting oversight.

Under Regulation (EU) 2025/1355, the Governing Council of the ECB adopts reasoned decisions identifying which payment systems are SIPS on the basis of:

• certain quantitative thresholds; or
• a flexible methodology that takes into account qualitative aspects such as the nature, size and complexity of the payment system, the nature and importance of its participants and the substitutability of the payment system.

The process to identify a payment system as a SIPS is clearly set. A review and identification exercise is done by the ECB on an annual basis and the list of SIPS is maintained on the ECB’s website.

The Governing Council of the ECB identifies a SIPS operator² for each SIPS. The identified SIPS operator is accountable vis-à-vis the competent authority³ for the compliance of the SIPS with the oversight requirements under Regulation (EU) 2025/1355.

A SIPS operator must have in place a cyber-resilience strategy and framework in line with the relevant requirements. Moreover, a SIPS operator must always retain responsibility for the outsourced functions, operations and/or services and must have in place appropriate contractual arrangements and frameworks.

SIPS operators are required to:

• ensure that the legal frameworks in which they operate provide a high degree of certainty for their activities;
• have documented objectives prioritising their system’s safety and efficiency;
• have effective and documented governance arrangements with clear and direct lines of responsibility and accountability for their Board and management;
• establish robust frameworks to manage risks and to address collateral and settlement finality in line with the requirements of the regulation.

SIPS operators must:

• establish and maintain a sound framework to comprehensively identify, measure, monitor and manage risks, including liquidity, credit, general business, custody and investment, and operational and cyber risks, that may arise in or are borne by the SIPS;
• accept as collateral only cash or assets with low credit, liquidity and market risks that fulfil certain conditions;
• establish rules and procedures to enable final settlement to take place no later than the end of the intended settlement date and to enable it to continue to meet its obligations in the event of a participant default, which address the replenishment of resources following a default;
• set up procedures for ensuring money settlement;
• hold their own and participants’ assets with supervised and regulated bodies (known as custodians) that are competent to fully protect those assets;
• determine their own investment strategy, secured by high-quality obligors⁴;
• set up and publicly disclose non-discriminatory access and participation criteria, which are reviewed at least annually, for their services;
• have a process in place to identify and meet the needs of the markets they serve;
• adopt clear and comprehensive rules and procedures that are fully disclosed to participants;
• prepare recovery plans to re-establish smooth operation;
• prepare orderly wind-down plans for their orderly closure;
• maintain sufficient capital and liquid assets to cover general business risks;
• perform annual stress tests on liquidity and collateral frameworks;
• adopt a cyber-resilience framework and strategy;
• test the cyber resilience of controls and systems through the TIBER-EU threat-led penetration testing framework;
• report major cyber incidents.

Where a SIPS operator has not complied with the regulation:

• the competent authority may impose corrective measures⁵ within two years after the finalisation of the assessment to remedy the non-compliance and/or avoid repeating it (pursuant to ECB Decision (EU) 2017/2098); and/or
• the ECB may impose sanctions (pursuant to Council Regulation (EC) No 2532/98 and European Central Bank Regulation (EC) No 2157/1999 on the powers of the ECB to impose sanctions), in which the amount of the sanctions will be calculated in accordance with Decision (EU) 2017/2097.

In accordance with Decision (EU) 2019/1349, for oversight purposes, competent authorities can:

• require SIPS operators to: (a) provide all information and documents necessary for the efficient and effective conduct of the oversight functions; (b) appoint an independent expert to investigate or review the SIPS operation;
• carry out continual and/or ad hoc oversight to ensure SIPS operators comply with all the requirements;
• cooperate with other authorities.

Decision (EU) 2017/2097 sets out the methodology to be followed by the ECB for calculating the amount of the sanctions (fines or periodic penalty payments) to be imposed on the SIPS operators for infringements of the relevant oversight requirements. That decision sets the baseline amount of a sanction to 50 % of the sum of the following amounts:

• 1 % of turnover, and
• 0.0001 % of the value of payments processed.

The decision also lays down the limits to the amount of sanctions and the duration of the periodic penalty payments to be imposed.