1.

Directive 2007/64/EC ( 2 ) and Directive (EU) 2015/2366, ( 3 ) which has replaced the former since 13 January 2018, govern the provision of payment services in the internal market. Payment services are evolving rapidly as a result of advances in technology. ( 4 )

2.

The proceedings in which this reference for a preliminary ruling has been made are between a Bulgarian bank and a customer, who denies having made certain disposals from his current account. The customer has claimed that the bank should reimburse the funds transferred.

3.

In that context, the Court is required to clarify the concepts of ‘payment instrument’ ( 5 ) and ‘authentication’ used by Directive 2007/64, which applies ratione temporis to the case in the main proceedings.

4.

The Court will also have to develop its as-yet inchoate case-law on the liability of payment service providers (‘PSPs’) where payment transactions are not authorised by users.

5.

Article 4(19) and (23) gives the following definitions:

‘For the purposes of this Directive, the following definitions shall apply:

…

…

6.

Under Article 54 (‘Consent and withdrawal of consent’):

‘1.   Member States shall ensure that a payment transaction is considered to be authorised only if the payer has given consent to execute the payment transaction. A payment transaction may be authorised by the payer prior to or, if agreed between the payer and his payment service provider, after the execution of the payment transaction.

2.   Consent to execute a payment transaction or a series of payment transactions shall be given in the form agreed between the payer and his payment service provider.

In the absence of such consent, a payment transaction shall be considered to be unauthorised.

3.   Consent may be withdrawn by the payer at any time, but no later than the point in time of irrevocability under Article 66. Consent to execute a series of payment transactions may also be withdrawn with the effect that any future payment transaction is to be considered as unauthorised.

4.   The procedure for giving consent shall be agreed between the payer and the payment service provider.’

7.

Article 59 (‘Evidence on authentication and execution of payment transactions’) states:

‘1.   Member States shall require that, where a payment service user denies having authorised an executed payment transaction or claims that the payment transaction was not correctly executed, it is for his payment service provider to prove that the payment transaction was authenticated, accurately recorded, entered in the accounts and not affected by a technical breakdown or some other deficiency.

2.   Where a payment service user denies having authorised an executed payment transaction, the use of a payment instrument recorded by the payment service provider shall in itself not necessarily be sufficient to prove either that the payment transaction was authorised by the payer or that the payer acted fraudulently or failed with intent or gross negligence to fulfil one or more of his obligations under Article 56.’

8.

Article 60 (‘Payment service provider’s liability for unauthorised payment transactions’) provides that:

‘1.   Member States shall ensure that, without prejudice to Article 58, in the case of an unauthorised payment transaction, the payer’s payment service provider refunds to the payer immediately the amount of the unauthorised payment transaction and, where applicable, restores the debited payment account to the state in which it would have been had the unauthorised payment transaction not taken place.

…’

9.

Article 86 (‘Full harmonisation’) states:

‘1.   Without prejudice to Article 30(2), Article 33, Article 34(2), Article 45(6), Article 47(3), Article 48(3), Article 51(2), Article 52(3), Article 53(2), Article 61(3), and Articles 72 and 88 in so far as this Directive contains harmonised provisions, Member States shall not maintain or introduce provisions other than those laid down in this Directive.

…

3.   Member States shall ensure that payment service providers do not derogate, to the detriment of payment service users, from the provisions of national law implementing or corresponding to provisions of this Directive except where explicitly provided for therein.

However, payment service providers may decide to grant more favourable terms to payment service users.’ ( 6 )

10.

Article 75(2) of the Zakon za zadalzheniata i dogovorite (Law on obligations and contracts) provides:

‘…

The debtor shall be discharged of his or her debt where he or she has fulfilled, in good faith, an obligation vis-à-vis a person who, on the basis of clear circumstances, appears to be entitled to receive performance. …’.

11.

Article 57(1) of the Zakon za platezhnite uslugi i platezhnite sistemi (Law on payment services and payment systems) of 2009 ( 7 ) reads:

‘In the event of an unauthorised payment transaction, the payment service provider shall immediately refund to the payer the amount of the unauthorised payment transaction and, if necessary, restore the payer’s payment account to the state in which it was prior to the execution of the unauthorised payment transaction.’

12.

In the order for reference, instead of setting out the facts it considers to have been proven, the referring court describes the facts invoked by each party in the proceedings. They are as follows.

13.

UA and Eurobank EFG Bulgaria AD (‘Eurobank’) concluded a current account agreement in Sofia (Bulgaria) on 22 November 2017. Under the agreement, the bank undertook to open and maintain an open-ended current account in euros in UA’s name in order to provide him with payment services. UA paid a total of EUR 999860 into the account in various transfers.

14.

On 6 February 2018, UA visited the bank branch to make a transaction on his account, but a Eurobank employee informed him that the balance was only EUR 16000.

15.

UA asserts that this surprised him and that, after he had requested an explanation, the employee provided him with a bank statement showing the movements on the account from the opening of the account to 6 February 2018.

16.

In the light of that statement, UA established that a person not known to him, named MK, had made disposals of funds in the account by means of six individual transfer orders with a total value of EUR 982000, without valid authorisation from UA, as the account holder, since he had not issued MK with any form of power of attorney.

17.

The Eurobank employee explained to UA that those unilateral dispositive transactions had been carried out by MK, who had presented himself as the depositor’s agent and provided a power of attorney dated 1 December 2017, certified by an Italian notary.

18.

UA showed the employee that the document in question did not contain his signature as principal, and took the following steps to protect his interests: (a) on 6 March 2018, he notified Eurobank that his funds had been improperly disposed of and requested that they be reimbursed; (b) on 8 March 2018 he sent a copy of that notification to the Central Bank of the Republic of Bulgaria and sent a written enquiry to the notary. The notary replied, stating that he had neither drawn up nor certified a power of attorney in favour of MK, that the power of attorney was ‘a forgery’ and that he had reported the foregoing to both Eurobank, in response to its enquiry of 20 February 2018, and the College of Notaries of Milan (Italy).

19.

Eurobank acknowledges that UA visited the bank branch with two Italian nationals on 22 November 2017. During the conversation, the Eurobank employee understood that UA intended to use an agent to operate the current account he was going to open. UA declined the online banking services, SMS notifications and bank card that the bank offered him.

20.

On 15 December 2017, an individual (MK) who presented himself as UA’s agent, visited the branch and produced to the Eurobank employee a copy, notarised by the Italian notary on 5 December 2017, of the power of attorney dated 1 December 2017.

21.

The authenticity of that copy had been certified by means of an ‘apostille’ and all the documents had been translated from Italian into Bulgarian by a sworn translator. The power of attorney was specific (express) and authorised the agent to make disposals with the funds in UA’s account.

22.

For each of the six transfer orders, MK produced the original copy of the power of attorney.

23.

On the date on which UA became aware of the six disposals of the funds in his current account (6 February 2018), he did not report the purported irregularities to the bank employees. He did not do so until 20 February 2018. On 6 March 2018 he submitted to the bank a written report alleging those unauthorised disposals and claiming reimbursement of his funds.

24.

Eurobank accepts that, on 20 February 2018, it sent the notary a scanned copy of the power of attorney and asked him whether the power of attorney of 1 December 2017 had been duly filed and entered in his register, whether the the power of attorney had the same legal effects as the power of attorney itself and whether the making of such copies was in line with standard practice. The notary replied only with the following: ‘The attached document is a forgery. Do not use it’.

25.

On 27 February 2018, Eurobank sent a written enquiry to the Deputy Prosecutor of the Italian Republic, who, with his signature, had certified the copy of the power of attorney at issue by means of an ‘apostille’ under the Hague Apostille Convention. ( 8 ) The Public Prosecutor’s Office in Monza (Italy) confirmed that the ‘apostille’ had been issued on 12 December 2017, that is to say, it officially confirmed that the ‘“apostille” placed on the copy of the power of attorney is valid’.

26.

According to UA, the Eurobank employees acted imprudently and with gross negligence by allowing a person with no power of representation to dispose of the funds in his current account. The power of attorney produced contained a prima facie irregularity and was not such that it could be accepted because the principal’s signature was absent. Eurobank should therefore have refused to execute the six transactions at issue.

27.

Eurobank claims that:

28.

On 4 February 2019, UA brought proceedings against Eurobank before the Sofiyski gradski sad (Sofia City Court, Bulgaria). By its judgment of 13 May 2021 that court upheld the application and ordered Eurobank to reimburse EUR 982000 to UA for the unauthorised payment transactions. ( 9 )

29.

Eurobank has brought an appeal against the first instance judgment to the Apelativen sad Sofia (Court of Appeal, Sofia, Bulgaria), which has referred the following questions to the Court of Justice:

30.

The request for a preliminary ruling was received at the Court on 21 June 2022.

31.

UA, Eurobank, the Bulgarian, Czech and Italian Governments and the European Commission lodged written observations.

32.

Following the submission of observations, by an addendum received at the Court on 13 January 2023, the referring court supplemented its order with certain additional information.

33.

The Court invited the parties to make submissions at the hearing on whether the information contained in that addendum is relevant for the purposes of responding to the request for a preliminary ruling.

34.

Only the Bulgarian Government and the Commission appeared at the hearing, which was held on 28 September 2023.

35.

The referring court enquires whether ‘a power of attorney by which the agent makes a disposal of assets on behalf of the payer by means of a payment order’ can be described as a payment instrument within the meaning of Article 4(23) of Directive 2007/64.

36.

Article 4 of Directive 2007/64 contains two definitions, for the purposes of that directive:

37.

This means that both a physical device (card or mobile telephone) and a set of procedures (PINs, TANs, DigiPass, Bizum, usernames, passwords and so forth) agreed between the payment service user ( 10 ) and the PSP in order to initiate a payment order will be payment instruments within the meaning of Directive 2007/64.

38.

Specifically, a user can arrange with a PSP that, using a set of procedures agreed between both parties, he or she will use those procedures to order the PSP to execute a payment transaction (to place, transfer or withdraw funds).

39.

Article 4(23) of Directive 2007/64 uses a very broad definition of ‘payment instrument’, with the effect that the type of technology, means of transmitting the payment order and possession of the security elements are not decisive, even where the security elements are in the possession of the user. ( 11 )

40.

According to the Court’s case-law, ( 12 ) payment instruments may be:

41.

In the judgment in T-Mobile Austria the Court clarified the interpretation to be given to Article 4(23) of Directive 2007/64, in view of the discrepancy between the different language versions as regards use of the term ‘personalised’ in conjunction with the expressions ‘any … device’ and ‘set of procedures’. It held that in order for a payment instrument to be considered to be personalised it must allow the PSP to verify that the payment order was initiated by a user authorised to do so. ( 13 )

42.

The definition in Article 4(23) of Directive 2007/64 may therefore include a set of procedures agreed between the PSP and the user and used by the latter in order to initiate a payment order. ( 14 )

43.

In the present case, the document provided to Eurobank was a copy of the specific (express) power of attorney purportedly issued by an Italian notary, by means of which UA authorised the agent to dispose of funds in his current account. The copy was certified by an ‘apostille’ and translated into Bulgarian by a sworn translator.

44.

In principle, a specific, express power of attorney granted by the holder of the payment account ( 15 ) to an agent, authorising the latter to carry out transactions debited from a bank account, is not, subject to what I am about to add, a payment instrument. As such, that power of attorney does not enable the PSP to verify that the payment order was initiated by a user authorised to do so and is not an instrument provided to the holder of a payment account by the PSP.

45.

However, as I have already indicated, according to Article 4(23) of Directive 2007/64, a payment instrument may consist of a set of procedures‘agreed’ between the PSP and the user. Nothing stands in the way of the power of attorney forming part of that set of procedures, although for it to do so, there would need to be a prior agreement between the holder of the payment account and the PSP.

46.

In consonance with that requirement, Article 54(1) and (2) of Directive 2007/64 provides that a payment transaction is considered to be authorised only if the payer has given consent to execute the payment transaction, and that consent is to be given in the form agreed between the payer and the PSP. In the absence of such consent, a payment transaction is to be considered to be unauthorised.

47.

The nub of the question referred is whether such agreement between the user and the PSP actually existed. In order to dispel the uncertainty on that point, the Apelativen sad Sofia (Court of Appeal, Sofia) added an addendum to its order for reference, from which it can be deduced that the framework contract ( 16 ) between Eurobank and UA is governed by the General Terms and Conditions signed on 22 November 2017 and contains the following clauses:

48.

It appears, therefore, that there was an agreement between UA (as holder of the payment account) and Eurobank (as PSP) which provided for the possibility of using a notarised power of attorney to make disposals with the funds in the account. To that end, the contract concluded between those two parties included a set of steps (a procedure) which had to be followed in order for the PSP to execute a payment order attributed to the user.

49.

From that perspective, it can be found that, by means of a notarised power of attorney, the holder of the payment account indirectly conveys to the PSP its intention to perform payment transactions debited from the funds in the payment account. A power of attorney of this kind is, then, the initial element in the set of procedures ‘agreed’ between the PSP and the user in order to execute a payment order.

50.

To the same extent, the power of attorney can be described as a non-personalised (or indirect ( 17 )) payment instrument, because the agent can operate the payment account by presenting his or her notarised power of attorney or duly certified copy and is not required to submit a transfer order signed manually by the account holder. If such a manuscript order from the account holder were required, notarised powers of attorney for managing payment accounts would be meaningless, because account holders would always need to perform the transactions and endorse them with their signature.

51.

It is true that the power of attorney is not issued by the PSP but by the account holder to a third party, to enable the latter to order payment transactions on behalf of the account holder. However, that circumstance does not mean that it cannot be considered to be an element in the set of procedures agreed between both parties and which constitutes the payment instrument. By analogy, a transfer ordered in person at the bank branch, by means of a manuscript order issued by the account holder, is also a payment instrument, even though it is not issued by the PSP.

52.

The approval of the PSP, given in the framework contract which allows the use of a notarised power of attorney, in itself shows that the PSP has indirect control over this type of payment instrument, since it can allow or refuse its use by the account holder.

53.

I would note at this stage that the debate has focused on whether Clauses V.22 and V.25 of the framework contract between the credit institution and its customer strictly required production of the original of the power of attorney, in the absence of which Eurobank could not allow the disposals of funds. It will be for the referring court to interpret the terms of that framework contract, in relation to such facts as it finds to be proven.

54.

Subject to the referring court’s assessment of the agreement, my view is that, in reply to the first question referred, Article 4(23) of Directive 2007/64 should be interpreted as meaning that a specific, express power of attorney granted by the holder of the payment account to an agent so that the agent can dispose of funds is not, prima facie, a payment instrument, unless the account holder and the PSP have so agreed in the clauses of the framework contract between them.

55.

If they do so agree, the notarised power of attorney would form part of a set of procedures agreed between the PSP and the user of the payment service in order to initiate a payment order. Since it is not inconceivable that this has occurred in the present case, the way is open for an examination of the following questions referred.

56.

The referring court seeks to ascertain whether the ‘apostille’ placed on a document by the competent foreign authority in accordance with the Apostille Convention ‘form[s] part of the authentication procedure for both the payment instrument and the payment transaction within the meaning of Article 4(19) of [Directive 2007/64], in conjunction with Article 59(1) thereof’.

57.

I shall examine separately the points that this question raises in respect of authentication and in respect of the Apostille Convention.

58.

Directive 2007/64 refers to authentication in a dual context:

59.

The PSP must use authentication to verify that the account holder has consented to one or more payment transactions being carried out. Authentication (of the payment instrument and of the transaction itself) confers reliability on any transactions the agent may order and is crucial if the PSP is to execute payment orders correctly and to be exempt from liability.

60.

If the user denies authorising the payment transaction, the burden of proof therefore lies on the PSP. The reversal of the burden of proof is particularly favourable to users: the PSP must demonstrate the circumstances which, under Directive 2007/64, would relieve it of its reimbursement obligation in relation to payment transactions that the account holder denies having authorised.

61.

Imposing the burden of proof on the PSP in such a situation is consistent with Article 54(1) of Directive 2007/64: payment transactions may be considered to be authorised only if the payer has given consent to execute the payment transaction prior to or, if agreed between the payer and the PSP, after the execution of the payment transaction. In the absence of such consent, a payment transaction is to be considered to be unauthorised.

62.

Under Article 54(2) of Directive 2007/64, consent to execute a payment transaction or a series of payment transactions is to be given in the form agreed between the payer and the PSP. As I have repeatedly stated and has occurred here, the user and the PSP may agree that an express power of attorney can be used to express consent and to enable the agent to make disposals of the funds in the payment account.

63.

The power of attorney is therefore one of the instruments by means of which payment service users express their consent to payment transactions, by the agent, being made from their account.

64.

Against that background, since the PSP bears the burden of proving consent by the holder of the payment account, in order not to incur liability it must exercise the utmost care in performing the procedure for authenticating the power of attorney.

65.

Where a notary is involved, that factor, prima facie, ensures that the power of attorney is genuine and reliable. Such notarial involvement is however not regulated in Directive 2007/64 and must comply with the provisions of national law. ( 20 )

66.

Put simply, where the user and the PSP have agreed that a power of attorney forms part of the set of procedures agreed in order to initiate a payment order, authentication of the power of attorney is indispensable to the PSP verifying that the account holder has authorised the agent to carry out payment transactions.

67.

It remains for me to examine how the existence of the ‘apostille’ under the Hague Convention affects the procedure for authenticating the power of attorney.

68.

According to the information provided by the referring court and the parties, a problem arose concerning the authenticity of the document that MK produced to Eurobank.

69.

It would appear that MK provided a copy, certified by the notary in Milan and with the ‘apostille’ of the Italian authority competent to perform that formality, of the original power of attorney.

70.

In response to Eurobank’s enquiries, the notary informed it that the power of attorney was a forgery. However, according to the letters rogatory ordered by the referring court, the Italian authority confirmed that the ‘apostille’ accompanying the copy of the power of attorney was genuine. ( 21 )

71.

The referring court will have to resolve that discrepancy in order to ascertain whether fraudulent conduct has occurred. It will also be for that court to interpret the framework contract between UA and Eurobank, in the light of national law, in order to determine whether, according to the terms of that contract, it was not sufficient to provide a copy of the notarised power of attorney ( 22 ) and that its original, duly signed by the principal, had to be provided.

72.

EU law contains no specific provision applicable to the legalisation of a notarised power of attorney for the purpose of operating a payment account. Regulation (EU) 2016/1191 ( 23 ) established a simplified procedure for legalising public documents, but those documents do not include a notarised power of attorney granted in order to operate a payment account. ( 24 )

73.

The referring court asserts that the Apostille Convention ( 25 ) applies to the legalisation in Bulgaria of a notarised power of attorney in order to make disposals with the funds in a bank account. According to the convention (point (c), second paragraph of Article 1), notarial acts are public documents.

74.

Under that convention, which concerns public documents which have been executed in the territory of one Contracting State and which have to be produced in the territory of another Contracting State:

75.

In short, the convention replaces the cumbersome traditional legalisation process with a single formality, that is to say, the issuing of an authentication certificate known as an ‘apostille’, by the home State. The ‘apostille’ certifies the authenticity of the origin of a public document, meaning that it can be produced in a foreign country, provided that the country in question is a Contracting Party to the convention. Apostillisation therefore has the same effect as legalisation. ( 26 )

76.

Although the Court does not have jurisdiction to interpret the Apostille Convention (because it does not form part of EU law), it is at liberty, in the course of interpreting the provisions of Directive 2007/64, to confirm to the referring court that the ‘apostille’ affixed by a foreign authority by virtue of the convention is one of the means that the PSP may use when authenticating a payment instrument, where it is contained in a foreign public document.

77.

The referring court seeks to ascertain whether, where a payment instrument is formally (prima facie) regular, it can assume that the account holder has authorised the payment transaction, that is to say, has consented to its execution.

78.

In order to answer that question, the Court must first address the harmonised regime governing the liability of PSPs ( 27 ) and users when dealing with payment transactions not authorised by the user.

79.

I shall examine the features of that liability regime before setting out a number of considerations that may be of use to the referring court when applying it to this case.

80.

According to Article 60 of Directive 2007/64, in conjunction with Articles 58 and 59 thereof, liability for losses suffered as a result of unauthorised payment transactions lies, in principle, with the PSP rather than the user. Nevertheless, in certain circumstances users may be required to bear those losses.

81.

The referring court’s question seeks to determine whether merely formal (prima facie) authentication of the payment instrument relieves the PSP of liability.

82.

The considerations set out by the referring court in the order for reference appear to support the conclusion that, in the view of that court:

83.

In interpreting the provisions of EU law, it is necessary to consider not only their wording but also the context in which they occur and the objectives pursued by the rules of which they are part. ( 28 )

84.

The Court has in fact already confirmed, with respect to the applicable provisions of Directive 2007/64, that:

85.

Once the indispensable notification of any unauthorised transaction has been given within the prescribed time limit, the PSP is subject to an immediate repayment obligation.

86.

That liability regime includes the mechanism referred to above for allocating the burden of proof, which is particularly favourable to users: it is the PSP and not the user that must demonstrate the circumstances that exempt it from the repayment obligation, that is to say, it must prove that the payment transaction was authenticated, accurately recorded and entered in the accounts. ( 34 )

87.

As Advocate General Saugmandsgaard Øe summarised in his Opinion in CRCAM, ‘the EU legislature has thus established a liability regime which rests on three essential and interconnected elements: an obligation to notify on part of the payment service user … the imposition of the burden of proof on the payment service provider … and, lastly, in the absence of proof, liability on the part of the service provider, pursuant to Articles 60 and 75 of that directive, depending on whether the transaction was unauthorised, not executed or incorrectly executed’. ( 35 )

88.

Article 86 of Directive 2007/64, entitled ‘Full harmonisation’, provides that ‘without prejudice to [several provisions of that directive which it sets out] in so far as this Directive contains harmonised provisions, Member States shall not maintain or introduce provisions other than those laid down in this Directive’.

89.

Since Articles 58, 59 and 60 of Directive 2007/64 are not among the provisions in respect of which Article 86 allows the Member States freedom of action, the Court has concluded that the liability regime for PSPs in those articles has been the subject of full harmonisation, with the result that the Member States cannot maintain a parallel liability regime in respect of the same operative event. ( 36 )

90.

Recitals 1 and 4 of Directive 2007/64 are in the same vein: the harmonised liability regime under the directive may not be placed in competition with an alternative liability regime laid down under national law, based on the same facts and the same basis, that adversely affects the objectives and the effectiveness of that directive. ( 37 )

91.

It is common ground that, within the period laid down in Article 58 of Directive 2007/64, UA, as the holder of the payment account, informed Eurobank of the existence of the unauthorised payment transactions carried out by its purported agent MK.

92.

As an authentication element that in its view proves the user’s consent, Eurobank relies on the copy, bearing an ‘apostille’, of the power of attorney granted by UA to MK in the presence of an Italian notary. The notary, however, states that the power of attorney and the copy were forgeries. The copy that MK produced to the bank for the purpose of ordering the transfers apparently bore no signature by the principal, the holder of the account, meaning that the bank was not able to conduct a comparison of signatures. Nor is there any record that Eurobank used alternative means (such as a recorded telephone call) to satisfy itself that UA had consented to the transfer orders submitted by MK.

93.

According to Article 59(2) of Directive 2007/64, if a user denies having authorised an executed payment transaction (as has occurred here), the use of a payment instrument recorded by the PSP ‘shall in itself not necessarily be sufficient to prove either that the payment transaction was authorised by the payer or that the payer acted fraudulently or failed with intent or gross negligence to fulfil one or more of his obligations under Article 56’.

94.

That rule supports the inference that use of the payment instrument produced to Eurobank in the form of a (forged) power of attorney, even though it was certified and bore an ‘apostille’, may be insufficient to demonstrate authorisation by the payer.

95.

If the circumstances of the case aroused reasonable doubts concerning the payment instrument, the PSP had a greater duty of care when verifying that it was genuine, in order to dispel those doubts and be completely certain that the holder of the payment account had authorised the transactions at issue. Only that approach upholds the guiding principle of Directive 2007/64, that is to say, the aim of protecting payment service users, in particular when they are consumers. ( 38 )

96.

I believe that, given the peculiar circumstances of this case, the PSP was not entitled to confine itself to carrying out a purely formal (prima facie) authentication of a notarised copy of a power of attorney, bearing an ‘apostille’ affixed by the competent authority of a foreign State.

97.

In order to enhance the protection of payment service users, Directive 2007/64 and its successor, Directive 2015/2366, have introduced the ‘pay first and argue later’ principle in relation to the liability of PSPs. ( 39 )

98.

As already stated, it is for the PSP to provide evidence proving that the user consented to a payment transaction or has been fraudulent or grossly negligent. The burden of proof imposed on the PSP is, I repeat, a very heavy one.

99.

The harmonised regime governing the liability of PSPs for unauthorised payment transactions cannot be tempered by recourse to national provisions ( 40 ) under which the liability of PSPs is attenuated compared with the more stringent liability resulting from Directive 2007/64. The national court must give precedence to Directive 2007/64 and apply Article 86 thereof in conjunction with Articles 58, 59 and 60.

100.

The argument outlined by the referring court – that a rigorous liability regime protecting users would have an adverse impact on the PSPs’ activity – is insufficient to rebut the foregoing. The European legislature has weighed up the pros and cons of both alternatives and has elected the one it considers best in the common interest.

101.

Within the alternative included in Directive 2007/64, the formal and substantive authentication of payment instruments is essential in order to provide legal certainty for the parties to payment transactions. It is equally indispensable for the proper functioning of the EU payment system, which promotes the free movement of capital.

102.

In short, my view is that Articles 58, 59 and 60 of Directive 2007/64, in conjunction with Article 86 thereof, must be interpreted as meaning that, where there are circumstances giving rise to legitimate doubts as to the validity of the payment instrument:

103.

In the light of the foregoing considerations, I propose that the Court should answer the Apelativen sad Sofia (Court of Appeal, Sofia, Bulgaria) as follows:

Article 4(19) and (23) and Articles 58, 59 and 60, in conjunction with Article 86, of Directive 2007/64/EC of the European Parliament and of the Council of 13 November 2007 on payment services in the internal market amending Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC

must be interpreted as meaning that: