Amendments to the NPS Law1, which entered into force 23 October 2014, would significantly affect further development of the Russian payment infrastructure. In fact they require international payment cards to be processed locally and aim to cement the role of the National Payment Card System as the single operator providing payment clearing and operations services in Russia. The new law gives almost no space for maneuver to international payment systems that must transfer their processing capabilities with respect to Russian domestic operations to the local state-owned operator by 31 March 2015. Otherwise, an unprecedented monetary deposit2 shall be secured with the Bank of Russia.
Federal Law No. 319-FZ “On Amendments to the Federal Law on the National Payment System and Certain Legislative Acts of the Russian Federation” dated 22 October 2014 (the Amendments Law) amends the NPS Law and the NPCS Law.3
Readers will recall that legislators adopted the NPCS Law this spring in the wake of international political sanctions which prohibited certain international payment systems (e.g., Visa and MasterCard) from servicing payments on cards issued by sanctioned Russian banks. Shortly thereafter, Russian parliamentarians adopted the NPCS Law to promote uninterrupted, secure funds transfers. The NPCS Law formed the bedrock for creating the National Payment Card System (or NPCS). The Bank of Russia has been mandated with building the NPCS from scratch, as an alternative to international payment systems which have successfully operated in Russia for more than 20 years). The NPCS Law also required security deposits by operators of such payment systems not qualifying as “nationally important payment systems.”4 We note that representatives of international payment systems have sharply criticised the introduction of security deposits.
In many experts’ opinions, the NPCS Law was poorly conceived and adopted hastily. Given this, it did not take long for a new law elaborating the main principles of the NPCS to appear. The Amendments Law expands and develops the ‘national territory”’ model of regulation for payment systems and their members, as laid out in the NPCS Law. The key changes to the NPS Law from the Amendments Law are:
- The choice of the NPCS as the mandatory processing partner for international payment systems (IPSs) such as Visa and MasterCard, who are generically defined by the new term ‘international payment cards.’
- The use of local processing by the NPCS as a tool to ensure uninterrupted funds transfers as an alternative to mandatory deposits.
- Deferral of the deadline for payment systems without national importance and local NPCS processing to pay their security deposit to 2Q 2015.
Notably, legislators are steadily tightening requirements for IPSs while boosting the role of the NPCS and its status as a nationally important payment system5 and monopolist on the Russian payments services market. But by deferring the deadline for deposits (which most IPS operators view as unacceptable), legislators appear willing to compromise.
International payment cards and international payment systems
The NPS Law requires funds transfers to be made via the NPCS using so-called national payment instruments, i.e., payment cards and other electronic means of payment issued to clients by NPCS members (i.e., credit organizations) under the NPCS rules.6 Operations with national payment instruments must be processed through the NPCS operations and payments clearing centres.7
The task of expanding the NPCS’s functions as a payment infrastructure operator has forced legislators to demonstrate wonders of legal skill while drafting the Amendments Law. To extend the requirement that funds transfers be processed by NPCS operations and payments clearing centers to Russian domestic operations carried out by means of payment cards issued within an IPS, it was necessary to identify and define the terms international payment cards and international payment systems.
For the purposes of the NPS Law, international payment cards (IPC) means payment cards (i) issued by credit organisations situated in two or more states, and (ii) bearing the trademark/service mark of a foreign legal entity whose personal law is the law of a foreign state.8 While the second criterion (card branding) for an IPC does not raise any questions, the first criterion is formulated in a manner that makes interpretation uncertain. Legislators apparently had in mind different credit organisations which ‘issue payment cards in more than two states’ within the same payment system (under the same payment system brand).
The Amendments Law also uses the term IPC to define an IPS and distinguish such payment systems from foreign payment systems.9 The Amendments Law does not provide a definition of IPS. However, it refers to payment systems that provide rules for issuing IPCs and carry out funds transfers in the Russian Federation using such IPCs.10 This definition covers Visa, MasterCard and American Express, as well as other IPSs whose legal status has attracted Russian authorities’ scrutiny since the sanctions war began. Naturally, while such IPSs have Russian presence, their members continue to issue cards with international branding belonging to overseas members of the IPS group. This definition of IPS allows them to be distinguished from other payment systems with operators working in Russia in accordance with the NPS Law, in order to apply special restrictive legal regulations to them.
NPCS processing in place of security deposits
Debate over the viability and future effectiveness of the monetary model of securing uninterrupted funds transfers in payment systems has continued ever since the NPCS Law appeared. Essentially, this model recalls the instrument of guarantee funds formed out of guarantee deposits by the members of a payment system in order to secure the obligations of the members. The difference is that the NPCS Law now requires a payment system operator to guarantee performance of its own obligations.
Under the NPS Law, the operators of payment systems not deemed 'important' (effectively, all IPSs) must make a security deposit to a special account with the Bank of Russia in an amount of two days’ turnover in Russia. The deposit is transferred as a quarterly contribution of 25 percent of the payment system’s average daily turnover in Russia in the last quarter.11 Fines for breach of uninterrupted functioning of obligations are calculated and charged to this deposit.12 Legislators intend these deposits to guarantee the uninterrupted operation of IPSs in Russia.
In reality, leading payment systems greeted the security deposit requirement with hostility, seeing it as unworkable and stating it would effectively force them to leave Russia. Had this happened, the legislators would certainly have achieved their declared objective of securing uninterrupted payments through payment systems (especially IPSs). Citizens would simply have lost the ability to make such payments using payment cards from well-known systems like Visa and MasterCard.
Fortunately, a compromise was reached two months after the NPCS Law's adoption. If payment systems not recognized as being of national importance transferred their functions of local transfers’ processing to the NPCS or to a nationally-important payment system, they would be released from the deposit requirement.13 At the time, the Government also gave payment systems the right to choose their local processing partner.
However, less than three months later, government authorities have now made a compulsory choice of partner for IPSs. Under the Amendments Law, IPSs as well as credit organizations making funds transfers using IPCs must obtain operations and clearing services from the NPCS.14 Cooperation with the NPCS will be organized by the Bank of Russia and in accordance with NPCS rules adopted under its guidance. Both sets of documents have yet to be drafted or approved.
It would be logical for similar amendments also to be made to the current provisions of the NPS Law15allowing operators to engage foreign operations centers. Although these provisions will expire on July 1, 2016, at the moment there is a clear contradiction of the NPS Law, which will create additional questions for market participants.
The Amendments Law expressly provides that the operator of a payment system not deemed nationally important will not pay a security deposit provided it submits all instructions for funds transfers using IPSs in Russia to an NPCS operations and payment clearing centre by 31 March 2015.16 If this imperative condition is not met, the security deposit must be paid by 31 March 2015 with respect to transfers made from 1 January 2015 for which instructions are not submitted to an NPCS operations and payment clearing center.
In this way, a compromise approach has been adopted that allows non-nationally important payment systems (primarily, IPSs) to avoid paying the security deposit by using NPCS processing services. Unfortunately, the actual development of the NPCS infrastructure is lagging behind the new legal framework for its activities and is still embryonic. For this reason, payment system operators have been given a deferral17 of the security deposit for the transitional period necessary for transfer of IPCs operations to an NPCS operations and payment clearing center.
Technical requirements of the Bank of Russia to domestic processing
Bank of Russia Instruction No. 3342-U “On Requirements for Information Technologies Used by Payment Infrastructure Operators for the Purpose of Recognising a Payment System as a Payment System of National Importance” establishes the technical requirements for processing by nationally important payment systems including the NPCS, entered into force on 25 October 2014.
In order to be recognized as a nationally important payment system, a payment infrastructure services operator must use information technology meeting the following Bank of Russia’s requirements (agreed with the Russian Government):
(a) Russian organisations must be the developers (rights holders) of at least 25 percent of the payment card software and the software used for data protection, operations and payment clearing centre functions. (b) License agreements must grant the operator the right to use such software in Russia for at least five years and provide an obligation by the licensee to update the software. (c) Preparation (assembly) of payment cards by Russian organizations, in Russia, using media that meet the requirements of national standards. (d) The encryption module used in the payment card integrated circuit must be certified by the federal security authority (FSB of Russia) certification system and/or have a certificate of conformity to the safety standards of at least two foreign payment systems in which funds transfers are made using payment cards. (e) The use of information technology in funds transfers must be organized in a manner that meets data security requirements.18
Clearly, the final localization of Russian domestic payments processing will require the creation of the corresponding payment infrastructure and associated information technology in Russia. But swiftly creating and implementing data security technology on par with that used by IPSs for many years would appear Utopian, to say the least. There is a high risk that in the initial stages of operations, the NPCS will not have data security systems to match Visa’s 3D Secure or MasterCard’s Secure Code. It is unclear how the NPCS, which will act as payment infrastructure operator for processing the vast majority of Russian domestic operations, will meet the statutory requirements for data security by 2015 when paying for goods and services online.
The Amendments Law and the new status of the NPCS as Russian national payment infrastructure operator have been widely discussed in the business community. Some experts wonder whether they are consistent with free market principles and Russian Federation competition law. However, the main question, undoubtedly, is how quickly and effectively the latest national project—a payment system—can be rolled out. Joint Stock Company NPCS was established shortly after the adoption of the NPCS Law, with its share issuance registered by the Bank of Russia in early September 2014. However, as we have noted, the work to create the payment system’s technological platform is far from being complete. The Amendments Law also requires the Bank of Russia to adopt regulatory acts and the NPCS rules governing relations with IPSs for processing and clearing services. This will also take time.
Assuming the respective infrastructure, technology and regulatory issues are dealt with in the near future, and the new NPCS will be ready to connect its members and IPSs to its processing facilities, the risk of technical problems should not be ruled out. The two giants of the payment services market—Visa and MasterCard—jointly service approximately 95 percent19 of payment cards used in Russia. According to the Bank of Russia’s Deputy Chairman, Olga Skorobogatova, the processing center for Russian domestic transactions by IPSs 'might' be built by Q1 2015.20 This gives IPSs a very short time—less than is usually needed to connect a single member— to switch over their processing. Any potential differences in the way the IPSs approach transaction processing will also need additional time to reach a general position enabling the use of a single payment infrastructure services operator (NPCS). Not least importantly will be how significant changes to the activities of payment systems will affect the functioning of the payment cards in Russia, especially during the December-January peak season for vacationers and shoppers.
Commenting on the Amendments Law, Deputy Chairman Skorobogatova confirmed that international payment systems will be 'ready to operate in Russia via NPCS processing'. 20