DNB's Dutch payment-transaction oversight regulation addresses operational availability and resilience, including iDEAL. It connects payment services with risk controls and evidence for supervision, focusing on their ability to remain available and function through disruption.
TL;DR:
- Institutions must manage security and availability of mass-market cashless payments.
- Measures actual availability and outsourced dependencies, including planned-test disruptions.
- DNB distinguishes time-critical services from transfer submission and urgent-payment functions.
Summary
Which payment services the framework covers
DNB's Q&A explains that the regulation covers methods used in mass-market cashless payments. Its risk-based supervisory focus includes iDEAL and point-of-sale transactions as time-critical payments, and functionality for submitting transfers and urgent payments as non-time-critical services. Credit-card products also fall within the framework even where they are not the primary focus. This is broader than the resilience of one branded payment product.
Domestic scope follows the payment providers
DNB defines a domestic transaction by reference to the payment-service providers of the payer and payee being located in the Netherlands. The customer's residence is not the deciding factor in that definition. The Q&A also identifies the systems within the issuing domain for which an institution is responsible. These distinctions help determine which part of a payment chain contributes to the institution's availability measurement and oversight obligations.
Availability is measured through actual disruption
The framework expects systems to support a high level of availability and security, with different supervisory benchmarks for time-critical payments and recovery of non-time-critical submission functionality. DNB states that availability figures should include all unavailability, including failover tests, disasters and emergencies. Examining causes remains part of its assessment of operational-risk control; a planned event is not automatically invisible merely because it was scheduled in advance.
Outsourced processing remains an institutional concern
Where third parties perform part of a transaction process, DNB expects the institution to support the required availability through contracts and monitoring. The relevant service therefore includes dependencies beyond an institution's own technology estate. Its operational evidence should connect the payment function, responsible systems and supplier arrangements. The Q&A provides supervisory interpretation of the regulation and should be read alongside other applicable resilience and payment-service requirements.
Keywords
- DNB oversight
- Dutch payments
- service availability
- operational risks
- outsourced dependencies
- iDEAL
- POS payments
- urgent transfers
- disruption measurement
- payment security