Innovation and Digitalisation

We also believe that the Digital Euro would strengthen the monetary sovereignty of the euro area. However, we predict that the introduction of a Digital Euro could also have some major unintended consequences impacting savings and retail banks if not addressed properly.

Our position paper, issued in March 2023, reflects on the effect of the Digital Euro on retail and saving banks, we highlight three areas where the introduction of the Digital Euro could have a negative impact on our members.

Firstly, the Digital Euro can severely affect our balance sheet activities – the core business for savings and retails banks. Detailed work is still needed to identify a suitable model for distributing, storing and exchanging digital currencies that balances the needs of maintaining the effectiveness of monetary policy transmission mechanisms, customer service and regulatory compliance.

Otherwise, and if the Digital Euro becomes “too successful”, the deposit outflow could reduce the balance sheets of banks and eventually their capabilities to finance the economy – as a result, possibilities for consumer finance, mortgages and SME financing will be reduced and the potential impact on banks’ liquidity positions is very relevant.

Secondly, lots of obligations and requirements will be put on savings and retail banks as envisioned institutions for the distribution of the Digital Euro, whilst a sustainable long-term business model is questionable.

Finally, cashless payments in the euro area are flourishing and are showing healthy growth rates. Under a push from regulators, banks are already heavily investing in payment solutions (notably based on instant payments) that address the need for European sovereignty in payments.

These new solutions under development will need to find their place in the already competitive payments mix – adding yet another competing payment product by positioning the Digital Euro as such is a game changer. At any rate a level playing field needs to be present.

Therefore, although supportive of the Digital Euro, we are of the opinion that many legitimate and reasonable questions still need to be answered and a successful implementation needs to properly address the above concerns. In order to achieve this, we argue for significantly lower maximum caps on holdings. For the distributors of the Digital Euro, a long-term sustainable business model will be required.

And if the Digital Euro will be positioned as a retail payments product, it should not use its privileged position as a public-money funded product by mandatory acceptance requirements that distort the competitive retail payments market.

The definition of AI remains a highly debated issue. According to ESBG members, the proposed definition is currently too broad. ESBG members argued for a narrow scope, since a scope that is too broad could potentially include more traditional software systems that should not fall under the scope of the proposal The definition of AI needs to take into account the different levels of autonomy and explainability of the system, as well as the level of control and human participation. Furthermore, it must contain the ability to learn and reason as central element.
Stakeholders were also asked for concrete examples of overlap with other pieces of legislation, also of sector-specific legislation. ESBG pointed out a number of articles where overlap with other legislation, notably the GDPR exists. There has also been discussion on the high-risk classification, extraterritorial applications, cooperation mechanisms, and access to data. Therefore, ESBG provided input on those matters as well.

The FSB  reports that crypto-assets and markets must be subject to effective regulation and oversight commensurate with the risks they pose. Crypto-asset markets are fast evolving and could reach a point where they represent a threat to global financial stability due to their scale, structural vulnerabilities and increasing interconnectedness with the traditional financial system.

WSBI-ESBG, for its part, welcomed the initiative of addressing the above-mentioned crucial issues and replied to the call for feedback on this consultative document on a proposed framework for International Regulation of Crypto-asset Activities, in particular calling for a more measured regulatory approach between the several players (i.e.; financial institutions, issuers, and providers of crypto assets) and for consistency between regulations and requirements applicable to traditional finance and crypto-based finance.

Finally, members underlined the importance of having a clear and dynamic regulatory approach to avoid confusion on the categorization of crypto-assets (i.e.; stablecoins, global stablecoins, digital assets), and the need for a higher consistency between local and international regulations.

On 28 September, the European Commission published its proposal for the Artificial Intelligence Liability Directive which  complements and modernises the EU civil liability framework by introducing for the first time rules specific to damages caused by AI systems. 

The purpose is to lay down uniform rules in case of damages caused by AI systems and to establish broader protection for victims. The Directive is applicable to both individuals and businesses. The new rules will, for instance, make it easier to obtain compensation if someone has been discriminated against in a recruitment process involving AI technology.

It is proposed that five years after the entry into force of the AI Liability Directive, the Commission will assess the need for no-fault liability rules for AI-related claims if necessary.

Consequently, on 3 October, the Commission enabled relevant stakeholders to provide feedback on the proposed AI Liability Directive. All feedback to be received will be summarised by the Commission and presented to the Parliament and Council with the aim of feeding into the legislative debate.

As part of its mandate, ESBG replied to the Commission’s call for feedback on 2 December. In its response, ESBG supports the protection of consumers as well as adapting liability rules to the digital age, thereby setting out a framework for excellence and trust in AI.

However, ESBG understands from the proposed Directive that the presumption of a causal link in the case of fault is mainly a matter of “non-compliance of due diligence duties”. In this context, ESBG calls for clarification on what could be considered as non-compliance of due diligence duties. In particular, ESBG questions whether the presence of bias or discrimination could be considered a noncompliance of due diligence duties. Furthermore, clarification is necessary on what tools are available to providers and users of AI systems to refute the causal link.

Finally, as the AILD is a directive, members stress the importance to take the cultural and legal differences between member states into account when implementing. Different application across member states can lead to regulatory arbitrage where firms choose where to be domiciled according to the member states legislative application. Therefore, the directive should be aligned with the Rome I Regulation and the Rome II Regulation regarding the conflict of laws on the law applicable to non-contractual obligations.

On 14 November, ESBG submitted its input to the European Commission’s call for feedback on the proposed Cyber Resilience Act, which was published in September. All feedback received will be summarised by the Commission and presented to the European Parliament and Council with the aim of feeding into the legislative debate.

On 15 September, the Commission published a proposal for a Cyber Resilience Act, which aims to protect consumers and businesses from products with inadequate security features. The Cyber Resilience Act introduces mandatory cybersecurity requirements for products with digital elements. It will ensure that digital products, such as wireless and wired products and software, are more secure for consumers across the EU. In addition to increasing the responsibility of manufacturers by obliging them to provide security support and software updates to address identified vulnerabilities, it will enable consumers to have sufficient information about the cybersecurity of the products they buy and use.

In the position paper, ESBG members welcome the Commission proposal and support the goal of only having secure software on the internal market. However, members believe that the Cyber Resilience Act leaves too much room for interpretation regarding its scope of applicability and therefore proposes that the Commission should make a clear scope-statement that would dissolve any uncertainty whether the software developed, operated, or marketed by financial institutions is in scope of this Act.

In addition, there are vertical initiatives that already regulate the cyber-resilience of hardware and software products used by certain sectors. This is the case of the Digital Operational Resilience Act (DORA) for the financial sector, a regulatory framework specifically designed and developed to ensure the digital operational resilience of the financial sector. Extending the scope of the Cyber Resilience Act to products manufactured by credit institutions may place additional burdens onto banks, on top of the already existing tight regulatory corset.

ESBG stated the need to further assess exactly what gaps in the payments system could be filled by the introduction of a digital euro, and to analyse how the existing solutions could be adjusted to enhance their value to the customer. This in its response to the European Commission targeted consultation on June 15. We highlighted the financial education challenges ahead, which will be key to address in order to continue building the customers’ confidence in the financial sector.

The response also stated that ESBG and its members are in favour of limits to individual holdings of digital euro – ideally in the form of €1,500 cap. It elaborated that a higher limit might cause a deposit outflow that would not be manageable for most banking business models in the EU and would likely force banks to de-leverage massively. The negative impact of this on balance sheet would be particularly severe for savings and retail banks that currently have little to no access to market funding. The deposit outflow would not only impact liquidity, but also the volume of credit provision of deposit-intense banks, which in the past kept the lending stable even in crisis times.

For a digital euro to be successful, it must provide a user-friendly onboarding process and it should be secure, easy to access and use, and adapted to the public. It would also require the acceptance of both the consumers and merchants. Finally, However, any measure aimed at introducing mandatory acceptance – and any eventual exemption – should be carefully assessed and designed at EU level to avoid affecting the level playing field between different means of payment and crowd-out the existing solutions.

The European Commission launched a public consultation in March to gather views from a wide range of stakeholders to help shaping the Cyber Resilience Act, a regulation on horizontal cybersecurity requirements for digital products and ancillary services. As a response to this public consultation on the Cyber Resilience Act, ESBG submitted its position to the European Commission on 18 May. The ESBG position focuses on the following aspects: I) Cybersecurity of digital products and the users of digital products; II) Improving the cybersecurity of digital products; and III) Stakeholder impact of potential regulatory measures.

Digital products and ancillary services create opportunities for EU economies and societies but they also lead to new challenges because when everything is connected a cybersecurity incident can affect an entire system, and thus disrupt economic and social activities. The initiative for a Cyber Resilience Act aims to address market needs and protect consumers from insecure products by introducing common cybersecurity rules for manufacturers and vendors of tangible and intangible digital products and ancillary services.

On the whole, ESBG welcomes the European Commission’s Cyber Resilience Act as the level of risk of cybersecurity incidents affecting digital products has increased during the last five years. The overall level of cybersecurity of digital products marketed in the European Union could be improved. Subjecting certain products marketed in the Union to cybersecurity requirements would be effective (e.g. hardware or software products subject to higher cybersecurity risks).

Moreover, ESBG members believe that leaving it to hardware manufacturers and software developers to demonstrate compliance with security requirements is insufficient. It would be more valuable to have the opinion of a third party based on a control framework.

All feedback received will be taken into account as the Commission further develops and fine-tunes this initiative, that is tentatively scheduled for the third quarter of 2022. Input will help the Commission analyse cybersecurity-related problems associated with the digital products markets, explore possible ways forward and assess the impact of different types of interventions.

ESBG submitted its position to the European Commission on the proposed Data Act on 12 May. ESBG welcomed the Commission’s data strategy and its commitment to create a single market for data that will constitute a potential source of growth and innovation.

We believe that a European approach to data is essential to ensure competitiveness, avoid fragmentation of national regulations, and benefit from a scale effect. Moreover, ESBG members stressed that the horizontal regulatory approach is crucial to establish the key rules and principles for all sectors as, in our view, an open data economy should be multilateral and cross-sectoral.

The European Commission published its proposal for the Data Act in February and opened this call for feedback in March. The proposal clarifies who can use, access, and share data generated in the EU across all economic sectors, and on what terms. The Data Act aims to provide a harmonised framework for data sharing, conditions for access by public bodies, international data transfers, cloud switching, and interoperability.

The Data Act is based on the results of an open public consultation that the European Commission carried out in 2021, to which ESBG responded in September. It is the second main legislative initiative directly related to data, following the recent adoption of the Data Governance Act, which aimed to increase trust and facilitate data sharing across the EU and between sectors.