Oslo 2020

Editor: Øystein Olsen

Design: Brandlab | Layout and print: 07 Media AS

The text is set in 10 pt Azo Sans Light

ISSN 1894-8634 (online)

Norges BANK

Bankplassen 2, P.O. Box 1179 Sentrum, N-0107 Oslo

Phone: 22 31 60 00 | Fax: 22 41 31 05 | E-mail: post@norges-bank.no

www.norges-bank.no

Selected key figures

Daily turnover in Norges Bank’s settlement system: Average for 2019. Source: Norges Bank.

Daily number of transactions in the Norwegian Interbank Clearing System (NICS): Average for 2019. Source: Bits.

Daily turnover in securities settlement: Gross turnover. Average for 2019. Source: VPS.

Mobile share of P2P payments: Survey conducted spring 2020. Source: Norges Bank.

Contactless share of BankAxept payments: Average for April 2020. Source: BankAxept.

Number of banks: Number of banks with an account in Norges Bank. At year-end 2019. Source: Norges Bank.

Financial Infrastructure Report 2020 – in a nutshell

The operation of the financial infrastructure has been stable

There have been few disruptions in the Norwegian financial infrastructure in recent years, and operation has been stable also during the coronavirus pandemic. We consider the operation of the financial infrastructure to be secure and efficient.

Solutions for real-time payments have improved

Payment solutions where the funds are available in the payee’s account seconds after the payment is initiated are increasing in use. During spring 2020, Norwegian banks have begun to use an improved common infrastructure for real-time payments. This is a clear advance, but there is still a need for further development. We will assess whether we should expand our role as operator so that more payments can be settled directly at Norges Bank.

The authorities should define clear standards for national governance and control

Disruptions in the financial infrastructure can have material negative consequences for us all. The authorities should therefore define clear standards for adequate national governance and control of critical functions. In our view, the operation of critical infrastructure should be located in Norway. If it is located abroad, contingency arrangements that can be operationalised immediately should be established in Norway.

New framework introduced to strengthen cyber resilience

Cyber crime in the financial sector is on the rise, and attack methods are constantly changing. Together with Finanstilsynet, we have decided to draw up a proposal for a framework for testing the cyber resilience of the banking and payment system in Norway. The framework will build on the TIBER-EU framework designed by the European Central Bank to promote financial stability. A national (TIBER-NO) framework will be elaborated in collaboration with the financial sector and relevant authorities.

Dependence on ICT service providers should be reduced

ICT service providers are crucial for the delivery of critical functions for the payment system. In our assessment, there is a need to reduce dependence on these service providers, so that switching provider where necessary can be efficient and secure. We will follow up through our supervisory and oversight work.

New solutions can provide gains, but also entail risks

New payment systems with proprietary digital currencies are being launched globally. Innovation and competition can contribute to a more efficient payment system, but these solutions also entail risks. We will contribute to elaborating and other measures that enable gains to be realised at an acceptable risk.

Central bank money must be available and easy to use

Today, most payments are made using deposit money. This is money created by banks. Cash is issued by the central bank. Even though deposit money is used the most, we have advocated that money issued by the central bank must continue to be available and easy to use. This is because central bank money has attributes that ensure confidence in the monetary system and an efficient payment system. Like many other central banks, Norges Bank is considering whether it may become necessary to issue a central bank digital currency (CBDC) as a supplement to banknotes and coins.

Norges Bank’s Financial Infrastructure Report

In its annual Financial Infrastructure Report, Norges Bank discusses developments, vulnerabilities and risks in the financial infrastructure. The Report is part of Norges Bank’s work to promote financial stability and an efficient financial infrastructure.

Norges Bank’s other reports on financial stability

In the annual Financial Stability Report, Norges Bank communicates assessments of the financial stability outlook. The Report discusses cyclical and structural features of banks and other financial institutions, financial markets and the Norwegian economy that are of importance for vulnerabilities and risks in the financial system.

Norges Bank’s quarterly Monetary Policy Report with financial stability assessment includes a current assessment of financial imbalances and the banking sector, Norges Bank’s monetary policy assessments and the decision basis for the countercyclical capital buffer for banks.

Norway’s Financial System provides a comprehensive overview of Norway’s financial system, its tasks and the performance of these tasks. This report is updated annually.

Executive Board’s assessment

The Financial Infrastructure Report is part of Norges Bank’s work to promote financial stability and an efficient and secure payment system in Norway. The Executive Board discussed the content of the Report on 29 April 2020.

The role and responsibility of Norges Bank for the financial infrastructure has been clarified and expanded in the new Central Bank Act. Norges Bank facilitates a secure and efficient system for settling payments and issues banknotes and coins. Norges Bank is tasked with overseeing the payment system and other financial infrastructure and contributing to contingency arrangements. Under the Payment Systems Act, Norges Bank is the supervisory authority for interbank systems.

The Executive Board considers the operation of the Norwegian financial infrastructure to be secure and efficient. There have been few disruptions in interbank systems and the securities settlement system in recent years. The operation of the financial infrastructure has also been stable during the coronavirus pandemic.

Payment solutions where the funds are available in the payee’s account seconds after the payment is initiated (real-time payments) are increasing in use. During spring 2020, Norwegian banks have begun to use a new infrastructure for real-time payments, called Straks 2.0. The plan is for all banks to be connected to the solution by the end of the first half of 2020. Straks 2.0 is a clear advance on the solution previously used by banks, though at the same time is in need of some improvements.

The payment system in Norway should be at least as secure and efficient as the payment systems in comparable countries. Banks have traditionally collaborated to develop good common solutions for the underlying payment system infrastructure. Developments in technology, market structure and competitive conditions may have weakened market participants’ incentives to contribute to the development of common solutions. There is a risk of increased fragmentation and that the development of common infrastructure in key areas will proceed more slowly than what is necessary for maintaining an efficient payment system. Norges Bank will assess whether it should expand its role as operator by settling more payments directly at the central bank. An alternative is to find new solutions within the existing division of labour between Norges Bank and the banking industry.

The financial infrastructure performs critical functions. Disruptions in the financial infrastructure can have consequences for wage and pension payments, businesses’ and households’ purchases of goods and services and transactions in money and securities markets. The authorities should define clear standards for adequate national governance and control of critical functions, especially in a contingency. The authorities may have more scope to implement national measures in a contingency if operations are subject to Norwegian legislation. In Norges Bank’s view, the operation of critical payment infrastructure should be located in Norway; alternatively, contingency arrangements that can be operationalised immediately should be established in Norway. Norges Bank, as the licensing authority for interbank systems, has therefore set the condition that ICT systems should be operable from Norway.

ICT system operation for the payment system has largely been outsourced to private entities that are not subject to direct supervision by the authorities. ICT service providers are crucial for the delivery of critical functions for the payment system. In Norges Bank’s assessment, there is a need to reduce dependence on these service providers on key infrastructure, so that switching provider where necessary can be efficient and secure. Norges Bank will follow up through its supervisory and oversight work.

Norges Bank and Finanstilsynet (Financial Supervisory Authority of Norway) have decided to draw up a proposal for a cyber resilience testing framework for the banking and payment system in Norway. The framework will build on the Threat Intelligence-based Ethical Red Teaming (TIBER-EU) framework designed by the European Central Bank. Its purpose is to improve the ability of the financial infrastructure to detect and respond to cyber attacks. Testing in accordance with the TIBER framework covers critical functions of the entities being tested and may also enhance insight into the cyber resilience of critical ICT service providers to the banking and payment system. Norges Bank and Finanstilsynet will involve the financial sector and relevant authorities in the elaboration of a national framework.

Access to central bank money ensures important payment system characteristics. Central bank money provides the public with credit risk-free funds. It promotes competition in the market for means of payment and payment instruments and is part of contingency arrangements if electronic back-up solutions fail. Like many other central banks, Norges Bank is considering whether it may become necessary to issue a central bank digital currency (CBDC) as a supplement to banknotes and coins. A Norges Bank working group has identified the attributes a CBDC should have and is currently assessing whether these attributes can be achieved by various technologies. Completion of this work is scheduled for spring 2021. Norges Bank will then assess how to proceed going forward.

New payment systems with proprietary digital currencies are being launched globally. A number are based on distributed ledger technology and have mechanisms to stabilise the currency’s value. Some of these solutions have been developed by tech giants with large user networks, which can assume a greater role in the payment system. Innovation and competition may contribute to a more efficient payment system by making cross-border payments easier, for example. But these solutions also entail risks, which may arise because the new solutions fall outside existing regulations that mitigate risk or because there are technology-specific risks associated with the new solutions. Regulating such systems is now the subject of discussions by international organisations. Norges Bank will contribute to the formulation of regulations that enable gains to be realised while at the same time mitigating risk.

Norges Bank’s responsibility

Norges Bank is tasked with promoting financial stability and an efficient and secure payment system.1 The Bank’s tasks in this regard comprise:

•Overseeing the payment system and other financial infrastructure and contributing to contingency arrangements.

•Supervising interbank systems.

•Providing for a stable and efficient system for payment, clearing and settlement between entities with accounts with Norges Bank.

•Issuing banknotes and coins and ensuring their efficient functioning as a means of payment.

As operator, Norges Bank ensures efficient and secure operating platforms and sets the terms for the services the Bank provides. As supervisory authority, Norges Bank sets requirements for licensed interbank systems. Through its oversight work, Norges Bank urges participants to make changes that can make the financial infrastructure more efficient and secure.

The use of instruments in different areas will vary over time and be adapted to developments in the payment system and the financial infrastructure. Norges Bank is tasked with giving advice to the Ministry of Finance when measures should be implemented by bodies other than the Bank in order to meet the objectives of the central bank.

The financial infrastructure

The financial infrastructure can be defined as a network of systems, called financial market infrastructures (FMIs) that enable users to perform financial transactions. The infrastructure must ensure that cash payments and transactions in financial instruments are recorded, cleared and settled and that information on the size of holdings is stored.

Virtually all financial transactions require the use of the financial infrastructure. Thus, the financial infrastructure plays a key role in ensuring financial stability. The costs to society of a disruption in the financial infrastructure may be considerably higher than the FMI’s private costs. The financial infrastructure is therefore subject to regulation, supervision and oversight by the authorities.

The financial infrastructure consists of the payment system, the securities settlement system, central counterparties (CCPs), central securities depositories (CSDs) and trade repositories.

NORGES BANK’S SUPERVISION AND OVERSIGHT WORK

Oversight entails monitoring FMIs, following developments and acting as a driving force for improvements. This work enables Norges Bank to recommend changes that can make the payment system and other FMIs more secure and efficient. An efficient payment system carries out payment transactions swiftly, at low cost and tailored to users’ needs.

Recommendations for making improvements may take place directly with FMIs, or through Norges Bank’s external publications and speeches, targeted at both private entities and other authorities.

Finanstilsynet (Financial Supervisory Authority of Norway) supervises systems for payment services. These are retail systems, which the public has access to, such as cash, card schemes and payment applications. Norges Bank’s oversight covers the payment system as a whole, including the retail systems Finanstilsynet supervises.

Even though Norges Bank oversees the payment system as a whole, individual FMIs are subject to regular individual oversight (Table 1).

Norges Bank is the licensing and supervisory authority for the part of the payment system called interbank systems. These are systems for clearing and settling transactions between credit institutions. If a licensed interbank system is not configured in accordance with the Payment Systems Act or the licence terms, Norges Bank will require that the interbank system owner rectify the situation. The purpose is to ensure that interbank systems are organised in a manner that promotes financial stability. Licensed interbank systems are shown in Table 1. Norges Bank may grant exemptions from the licensing requirement for interbank systems considered to have no significant effect on financial stability.

Definitions in the Payment Systems Act

Payment systems are interbank systems and systems for payment services:

Interbank systems are systems for the transfer of funds between banks with common rules for clearing and settlement.

Systems for payment services are systems for the transfer of funds between customer accounts in banks or other undertakings authorised to provide payment services.

Securities settlement systems are systems based on common rules for clearing, settlement or transfer of financial instruments.

Norges Bank assesses the FMIs that are subject to supervision and oversight in accordance with principles drawn up by the Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO). The CPMI is a committee comprising representatives of central banks, and the IOSCO is the international organisation of securities market regulators. The objective of the principles is to ensure a robust financial infrastructure that promotes financial stability. Norges Bank will publish an updated assessment of Norwegian interbank systems in accordance with the principles later in 2020.

A number of the FMIs that Norges Bank supervises or oversees are also followed up by other government bodies. The oversight of international FMIs that are important for the financial sector in Norway takes place through participation in international collaborative arrangements.

A detailed description of the FMIs supervised or overseen by Norges Bank is provided in Norway’s Financial System 2019.2

TABLE 1 FMIs subject to supervision and oversight by Norges Bank

System

Instrument

Operator

Norges Bank’s role

Other designated authorities

Norges Bank’s settlement system

Cash

Norges Bank

Supervision (Norges Bank’s Supervisory Council) and oversight

Supervision: Norwegian National Security Authority

Norwegian Interbank Clearing System

Cash

Bits

Licensing and supervision

DNB’s settlement bank system

Cash

DNB Bank

Licensing and supervision

Oversight of the bank as a whole: Finanstilsynet

SpareBank 1 SMNs settlement bank system

Cash

SpareBank 1 SMN

Oversight

Oversight of the bank as a whole: Finanstilsynet

CLS

Cash

CLS Bank International (CLS)

Oversight in collaboration with other authorities

Licensing: Federal Reserve Board

Supervision: Federal Reserve Bank of New York

Oversight: Central banks whose currencies are traded at CLS (including Norges Bank)

Norwegian securities settlement system

Securities and cash

Verdipapir-sentralen (VPS)

Oversight

Supervision: Finanstilsynet

VPS’s central securities depository (CDS) function

Securities

VPS

Oversight

Licensing: Ministry of Finance

Supervision: Finanstilsynet

SIX x-clear’s central counterparty system

Financial instruments

SIX x-clear.

Oversight in collaboration with other authorities

Supervision: Swiss financial supervisory authority

Oversight: Swiss National Bank, Finanstilsynet and Norges Bank

LCH’s central counterparty system

Financial instruments

LCH

Oversight in collaboration with other authorities

Supervision: Bank of England

Oversight: EMIR College and Global College (including Norges Bank)

EuroCCP’s central counterparty system

Financial instruments

EuroCCP

Oversight in collaboration with other authorities

Supervision: Dutch central bank

Oversight: EMIR College (including Norges Bank)

1 See Section 1-2 of the Central Bank Act and Section 2-1 of the Payment Systems Act.

2 Norges Bank (2019a).

1 Security and contingency arrangements for the financial infrastructure

The financial infrastructure has so far maintained operational stability through the coronavirus pandemic. The authorities and the private financial sector are communicating and collaborating effectively to address challenges and design measures.

Operation of the ICT systems in the payment system has largely been outsourced. If many of these systems are operated from another country, it could be difficult for Norwegian authorities to coordinate measures in a contingency situation. The authorities should define clear requirements for adequate national governance and control of critical functions.

Cyber crime in the financial sector is on the rise, and attack methods are constantly changing. Norges Bank and Finanstilsynet (Financial Supervisory Authority of Norway) have decided to draw up a proposal for a cyber resilience testing framework for the banking and payment system in Norway. The framework will be based on the Threat Intelligence-based Ethical Red Teaming (TIBER-EU) Framework developed by the European Central Bank (ECB) to promote financial stability.

1.1 FINANCIAL INFRASTRUCTURE IN THE TIME OF CORONAVIRUS

The Norwegian authorities and the private sector have established arrangements to maintain critical financial infrastructure functions in a contingency. These arrangements have also facilitated effective communication and collaboration between the authorities and the private sector to address challenges and design measures during the coronavirus pandemic.

The most important measures introduced by the Norwegian authorities and the private sector to safeguard the financial infrastructure during the coronavirus pandemic can be summarised as follows:3

•Norges Bank, Finanstilsynet and financial sector representatives exchange information frequently through the Contingency Committee for Financial Infrastructure. Any problems are therefore swiftly communicated to and discussed by key participants, promoting efficient problem solving.

•The Norwegian authorities have identified the critical parts of the financial infrastructure. Institutions responsible for the operation of critical infrastructure notify the authorities of the employees needed to maintain operations. Measures have been put in place to reduce the risk that these employees cannot come to work, eg the provision of daycare places and exemption from service in the Norwegian Home Guard.

•Financial market infrastructures have implemented efficient measures to maintain operations. Home office arrangements and the use of primary and secondary operational sites reduce the risk of many employees becoming infected at the same time. In addition, system changes are being postponed or limited to those that are strictly necessary, reducing the number of employees that need to come to work during periods when there is a risk of infection. A number of institutions have also relocated operations that were offshored back to Norway to improve operational control.

Measures similar to those described above have been implemented by the authorities and the private sector in other countries. International financial market infrastructures essential to Norwegian participants have been operationally resilient despite the challenges posed by the coronavirus pandemic. Norges Bank receives daily updates on action taken by the authorities and the private sector in other countries.

Impact of the coronavirus pandemic on consumer payment habits

In mid-March, the Norwegian Directorate of Health issued advice to the grocery sector on containment measures, eg that payments should primarily be contactless and that cash should only be used in exceptional cases.

A survey conducted by Norges Bank in the period 23-30 March 2020 shows a substantial fall in cash usage during the coronavirus pandemic compared with a similar survey in autumn 2019 (see box: Cash usage in Norway and selected other countries), in section 3.1. The share of contactless card payments rose considerably in the same period (see Section 2.1).

During the first few days after implementation of the Government’s measures, substantial cash withdrawals were made from Norges Bank. According to the survey mentioned above, respondents’ cash holdings increased by about a third compared with autumn 2019.

1.2 NATIONAL GOVERNANCE AND CONTROL

The payment system performs critical functions4. It ensures that wages, pensions and benefits are paid, that households and firms are able to pay for goods and services, and that money and securities market transactions are carried out. Disruptions in the payment system can quickly have serious consequences for society’s capacity to meet the fundamental needs of the population. In Norges Bank’s opinion, the operation of critical payment infrastructure should primarily take place in Norway; alternatively, contingency arrangements that can be operationalised immediately should be established in Norway.

ICT system operation for the payment system has largely been outsourced, including to offshore locations. International ICT service providers can provide access to better, cheaper and more secure solutions, and individual firms’ ICT operations can be outsourced within an acceptable level of risk. However, when a large number of companies in a sector relocate their ICT operations offshore, the consequences for society can also be negative. Offshoring can impair the nation’s ability to operate, develop and follow up ICT operations. It could also be difficult for the Norwegian authorities to coordinate contingency measures if many critical functions are operated from another country. Norges Bank, as the licensing authority for interbank systems, has set the condition that ICT systems should be operable from Norway.

With the need for national control of critical functions in a contingency, the authorities should define clear standards for adequate national governance and control of critical functions. The authorities may have more scope to implement national measures in a contingency if operations are subject to Norwegian legislation. In Norges Bank’s view, the operation of critical payment infrastructure should be located in Norway; alternatively, contingency arrangements that can be operationalised immediately should be established in Norway.5

Other public authorities have also issued recommendations about the operation of critical infrastructure in Norway. The Norwegian Communications Authority (Nkom) recommends that the owners of Norwegian mobile networks and nationwide transportation networks be required to operate their networks autonomously in Norway in situations where it is particularly important to safeguard national control capabilities and communication. The Norwegian National Security Authority (NSM) supports these recommendations in its risk report for 2020.6

Operational contingency solutions have been updated during the coronavirus pandemic. In April 2020, the NSM issued an updated alert on digital risk associated with Covid-19 recommending enterprises with offshored services to assess whether they can relocate operation and control to Norway and the alternative operational solutions that could be established in the event a service provider is no longer operational.7

MasterCard’s planned acquisition of parts of Nets

The Norwegian Interbank Clearing System (NICS) is the banks’ joint system for receiving and clearing payment transactions. Almost all payment transactions in Norway are sent to NICS for clearing before being sent to Norges Bank’s settlement system (NBO) for settlement. NICS is therefore a component of the critical payment infrastructure in Norway.

Bits AS (Bits), the Norwegian banking and financial industry’s infrastructure company, is the system operator for NICS and is licensed by Norges Bank. The technical operation of NICS has been outsourced to Nets Norge Infrastruktur AS (NNI). NNI also uses other companies in the Nets Group to perform operational tasks for NICS. NNI is a wholly-owned subsidiary of Nets Denmark A/S.

In October 2019, Norges Bank received a change notification from Bits concerning MasterCard’s plans to acquire Nets’ account-to-account services, including NNI and NICS’ source code. If the acquisition goes through, MasterCard will be Bits’ new contractual counterparty, while Nets will be a subcontractor for MasterCard.

Arrangements have been made for Nets to continue to provide MasterCard with the necessary services for the operation of NICS during a transition period. MasterCard may wish to change this arrangement further out. Norges Bank must be notified of such changes before they can be implemented.

Norges Bank has previously set conditions for the operation of NICS by Bits as system operator. One condition is that Bits must have adequate capacity and expertise to manage and control ICT deliveries and manage the outsourcing contract. In addition, hardware for NICS’ basic operations must be physically located in Norway. An operational contingency solution that can immediately take over the operational monitoring of NICS currently performed by Nets in Denmark must also be in place at all times in Norway. Any acquisition of Nets will not change these conditions.

Finanstilsynet has received notifications from banks in connection with MasterCard’s planned acquisition of Nets. Since the acquisition involves cross-border services, the Norwegian and Danish competition authorities have referred the case to the European Commission.

Norges Bank approved the change notification in its decision of 7 May 2020 on certain conditions, including access to the source code. The change notification refocuses attention on the risk for NICS of dependency on third-party providers. In its decision of 7 May, Norges Bank set the condition that Bits must reduce this risk to ensure that NICS can continue to be operated in Norway. See box: Independence from service providers.

Independence from service providers

ICT operation and development of the financial infrastructure have largely been outsourced. ICT service providers are therefore crucial for the delivery of critical functions for the payment system and other financial market infrastructures. In Norges Bank’s assessment, there is a need to reduce dependence on these service providers so that switching to a different service provider when necessary can be efficient and secure. For this to be a realistic alternative in all situations, including when a change of provider has to occur at short notice, system operators must take this into account in plans and contracts and in terms of resources and expertise. Norges Bank will follow up through its supervisory and oversight work.

1.3 RED TEAM TESTING TO ENHANCE CYBER RESILIENCE

The number of cyber attacks is increasing and attack methods are constantly changing. System operators are responsible for the security of their systems, which includes sound security procedures and recovery plans.

Norges Bank and Finanstilsynet have decided to draw up a proposal for a Threat Intelligence-based Ethical Red Teaming (TIBER-NO) framework to test the cyber resilience of the banking and payment system in Norway.

Threat landscape

There is broad political agreement internationally that the cyber resilience of the financial sector should be enhanced.8 Cyber crime in the financial sector is on the rise and targeted attacks are a regular occurrence.9

A cyber attack can have systemic consequences if the financial system lacks sufficient capacity to absorb shocks, recover from errors and maintain continuity of critical economic functions.10 A successful attack on financial infrastructure can prevent payment execution and result in heavy financial losses. A successful attack can also result in unauthorised access to or manipulation of sensitive information.

Penetration testing and the TIBER-EU framework11

The European Central Bank (ECB) published the TIBER-EU framework in 2018. TIBER-EU provides guidance for the testing of financial institutions’ detection, protection and response capabilities in the event of sophisticated cyber attacks. The aims of TIBER-EU are to enhance the cyber resilience of the financial sector and promote financial stability. The framework is based on similar testing programmes in the UK and the Netherlands.12 Denmark, Sweden and Finland have implemented the framework. Of the Nordic countries, only Denmark has started testing.

Penetration tests can be an effective tool for detecting and mitigating specific vulnerabilities in an institution’s defence systems. Red team testing is a full scope, multi-layered attack simulation, often performed by an external security company, designed to measure how well a company’s people, processes and technologies can withstand an attack from a real-life adversary.13

A standardised test format facilitates the sharing of test results between authorities in different jurisdictions. Financial institutions with cross-border operations can thereby avoid testing in each individual country and having to comply with different frameworks. TIBER-EU can also be used to compare the level of cyber maturity in different parts of the payment system, such as key ICT service providers, banks and the central settlement and clearing system.14

Norges Bank’s supervisory and oversight responsibilities related to cyber resilience are based on international recommendations15, which advise financial market infrastructures to carry out cyber resilience tests to identify vulnerabilities.16 TIBER-EU is a framework outlining how red team testing can be conducted based on these recommendations.

Dialogue and decision on a TIBER-NO

In May 2019, Norges Bank announced in Financial Infrastructure Report 2019 and Finanstilsynet in its Risk and Vulnerability Analysis 2018 that the suitability of the TIBER framework for testing cyber resilience in the banking and payment system in Norway would be assessed.

In autumn 2019, Norges Bank and Finanstilsynet circulated a joint consultation document17 on the TIBER framework to 17 financial sector entities and five relevant authorities. Although the 14 respondents (all from the financial sector) were generally positive to a TIBER-NO, the majority emphasised the importance of adjusting the framework to Norwegian conditions and harmonising Nordic TIBER frameworks. Based on this feedback, Norges Bank and Finanstilsynet held an information meeting for the financial sector and relevant authorities.

Following consultation with key financial market infrastructures, Norges Bank and Finanstilsynet decided to draw up a proposal for a TIBER framework to test the cyber resilience of the banking and payment system in Norway. Norges Bank has on several occasions highlighted the concentration and systemic risk associated with key ICT service providers in the payment system. Testing in accordance with the TIBER framework may also enhance insight into the cyber resilience of the payment system’s critical ICT service providers.

The TIBER-EU framework encourages relevant authorities to work together to establish a national framework (TIBER-NO). Norges Bank and Finanstilsynet will involve the financial industry and other relevant authorities in the elaboration of TIBER-NO, with the work adjusted to the coronavirus situation.18

European Commission consultation: Regulatory changes to improve the cyber resilience of the financial sector19

In 2020, the European Commission conducted a consultation on regulatory changes to enhance the cyber resilience of the financial sector. The Ministry of Finance asked for input on the Norwegian position.20 In its letter to the Ministry of 14 February 2020, Norges Bank noted that the Commission addresses many of the same issues raised by Norges Bank about ICT service providers. Norges Bank takes a positive view of the European Commission’s follow-up since an increasing number of ICT service providers are global entities.

3 See also Finanstilsynet (2020a).

4 The Norwegian Directorate for Civil Protection (DSB) has defined financial services as critical to society. See Norwegian Directorate for Civil Protection (2012).

5 Norges Bank has submitted similar recommendations in its consultation response to the Ministry of Defence on regulations under the new Security Act. See Norges Bank (2018b).

6 National Security Authority (2020a).

7 National Security Authority (2020b).

8 European Commission (2019).

9 Finanstilsynet (2019).

10 Norges Bank (2018c).

11 ECB (2018).

12 CBEST (UK) and TIBER-NL (Netherlands).

13 The TIBER framework is also discussed in Norges Bank (2019b).

14 Norges Bank (2019b).

15 CPMI-IOSCO (2012).

16 CPMI-IOSCO (2016).

17 Norges Bank and Finanstilsynet (2019).

18 See also Finanstilsynet (2020a).

19 European Commission (2019).

20 Norwegian Government (2020a).

2 Changing payment landscape

New payment solutions, new providers and increased competition may improve payment system efficiency, providing for faster, simpler and more convenient payments. At the same time, new challenges are emerging. Payment solutions should be based on a solid, common underlying infrastructure. As payment services have increasingly become a competitive arena, support for a common infrastructure owned and developed by industry joint bodies may have weakened. Large financial technology companies may become more influential in the payment system at the expense of banks and other financial institutions. Norges Bank will contribute to regulation and other measures to improve efficiency within the limits of acceptable risk.

In spring 2020, Norwegian banks began to use a new common infrastructure for real-time payments, called Straks 2.0. Retail payment solutions such as Vipps rely on this infrastructure. Straks 2.0 is a step in the right direction for efficient real-time payments in Norway, but improvements in the infrastructure will still be needed ahead. Norges Bank has launched a project to assess whether the Bank should offer real-time gross interbank settlement of retail payments in central bank money.

2.1 NEW PAYMENT METHODS

Payment methods are changing. The use of contactless card payments in shops is rising sharply, and mobile payments are expected to increase. The evolution of new payment methods is improving payment system efficiency. Driven by changes in regulations, technology and user behaviour, new types of providers have emerged, while large technology companies may become more influential in the payment system. This could have an impact on the security and efficiency of the payment system.

New and efficient electronic payment methods

The electronic payment methods used at point of sale in Norway are changing. Contactless card payments21 have shown very strong growth, particularly after supermarket chains made this payment option available around the turn of the year, and the health authorities urged the use of contactless card payments to prevent contagion. Over half of all BankAxept payments using physical cards are now contactless payments (Chart 2.1).22 A year ago, fewer than one in ten BankAxept payments were contactless payments.

Chart 2.1 Contactless payments as a percentage of total card payments. BankAxept. January 2017 – April 2020

Source: BankAxept

There are a number of solutions for making payments in shops using a mobile phone, eg Apple Pay and Google Pay. Coopay launched their mobile payment solution in 2019 and Vipps started rolling out its new solution for mobile payments in shops in May 2020. Surveys conducted by Norges Bank indicate that mobile payment usage in shops is currently limited.

The payment methods we use have also changed in other payment contexts. Cash used to be the main method of settling payments between private individuals, now nearly three in four of these payments are made using a mobile phone. Online shopping is growing faster than traditional high-street shopping. Online purchases are increasingly made using mobile phone applications or various forms of digital wallet, which often eliminate the need for the payer to re-enter card and delivery details for every purchase.

The evolution of new payment methods is improving payment system efficiency. The payment process has been simplified, payment processing time has decreased and there are more options available that are tailored to users’ needs. Contactless card payments are usually faster than traditional card payments. According to a BankAxept survey, a traditional card payment using chip and PIN takes 12 seconds, while a contactless payment is made in three seconds.23 Card payments using a mobile phone are not necessarily faster than ordinary card payments, but may be preferred for other reasons. Mobile phone payments rely on card details stored on the mobile phone, eliminating the need to carry physical cards. Mobile phone payments can be more secure as card details are not relayed to the payee. Mobile phone payments are also completely contactless. Payments are approved by for example entering a code or using the fingerprint reader on the mobile phone and not via contact with the payment terminal.

PSD2 and new interfaces

A new regulation has provided the basis for new payment solutions and lays down related security requirements. The revised Payment Services Directive (PSD2) came into force in Norway on 1 April 2019. The PSD2 opens up the market to providers offering payment services based on consumers’ payment accounts across banks and integrated account information services. So far, banks do not seem to be facing significant competition from new providers as a result of the introduction of the PSD2. The opportunities afforded by the PSD2 have primarily been utilised by banks. More banks now offer their customers an overview of account information across the banks in which they have accounts. Some banks also offer their customers the opportunity to initiate payments from their accounts in other banks. The PSD2 is part of a broader trend towards what is referred to as open banking, in which banks provide for third parties to offer services on top of banks’ infrastructure.

The PSD2 requires banks to offer a technical bank account interface to enable third parties to offer payment services. These interfaces were expected to be in place by 14 September 2019, but it has taken time for banks to develop interfaces that comply with the regulatory framework, and Finanstilsynet has therefore granted banks a postponement of the deadline.24 The PSD2 does not require technical interfaces to be standardised. A larger number of such interfaces could be an entry barrier for new providers and at the same time create a market for providers offering aggregation of several interfaces, known as API aggregators (see box: Providers offering bank account aggregation interfaces).

New user interfaces (for example mobile phone applications) can make it easier to switch between different bank accounts, payment instruments and means of payment. This can be combined with simple access to different forms of investing and saving, such as buying stocks and funds. The PSD2 regulates payment service providers to ensure that the payment itself is secure, while the interface and services offered via the interface are regulated to a lesser extent. Some providers of user interfaces could considerably influence many users’ choices at the same time. Interfaces offered by large technology companies, for example, may become widespread and affect many users’ choices (see below). This could have an impact on financial stability and the security and efficiency of the payment system.

Norges Bank is monitoring the emergence of new types of provider that could affect payment system security and efficiency as a result of the PSD2 and open banking and is keeping the need for measures under consideration.

Increased presence of global technology firms in the payment system

Global technology firms are present in many parts of the payment system25, delivering ICT infrastructure in the form of cloud services for the payment infrastructure, mobile phones and other end-user payment devices, and payment apps.26 The payment function can be integrated into other mobile apps or offered as a separate payment app, such as Google Pay.

Some technology firms (such as Amazon and Facebook) control e-commerce and social networking platforms, often also offering services on the platform in competition with other providers. These technology firms can thus regulate and restrict competition. This is also the case in the payment landscape. Providers of mobile phones and mobile operating systems, for example, can influence the choice of mobile payment services that can be offered, both by controlling the choice of apps that are available on the phone and which technology the mobile apps can use. One example is the iPhone, which only allows Apple’s payment apps to use its near-field communication (NFC) to authenticate payments.

Large technology firms’ participation in the payment market has so far been limited to offering services within the traditional payment infrastructure. Payment apps function as user and communication interfaces, with a payment card as the underlying payment instrument. Large technology firms may also have an interest in offering their own monetary and payment systems outside the existing payment infrastructure, for example e-money solutions or solutions based on their own currencies.

With a larger role in the payment system, technology firms will have a greater impact on financial stability and payment system security,27 both in terms of their role as ICT infrastructure providers and as providers of payment services for end-users. Service disruptions could have systemic consequences. Large technology firms’ market power could contribute to a power shift, with technology firms gaining more influence over the architecture and characteristics of the payment system at the expense of the influence previously wielded by banks and other financial institutions.

The large technology firms are global companies, and regulating them requires international cooperation. Norges Bank will consider whether the regulatory framework for the financial sector should to a greater extent take the role of large technology firms in the payment system into account.

Providers offering bank account aggregation interfaces

Payment service providers wishing to offer payment solutions based on access to account structures as prescribed in the PSD2 must deal with the different application program interfaces (APIs) used by different banks. The differences may make it difficult for new providers to make use of the access. This creates a market for a new type of provider, known as aggregators, who offer a standardised interface that allows new payment service providers to access accounts at any bank through the same interface (Chart 1). Such aggregators may reduce entry barriers, but could also be a new source of risk and market power. An aggregator used by many payment service providers could become systemically important.

Chart 1 Use of API aggregator in payment solutions

2.2 NEW SOLUTION FOR REAL-TIME PAYMENTS

Real-time payments are payment transactions where funds are made available in the payee’s account only seconds after payment initiation. A  well-functioning solution for real-time payments is an important part of an efficient payment system. In spring 2020, Norwegian banks began to use a new infrastructure for real-time payments, called Straks 2.0. Straks 2.0 is clearly a step forward, but some improvements are still needed. Norges Bank has launched a project to assess whether the Bank should offer real-time gross interbank settlement of retail payments in central bank money.

Real-time payments have become increasingly common internationally and there is reason to believe that the share of payments settled in real time will also increase in Norway (Chart 2.2).

Chart 2.2 Real-time payments as a percentage of credit transactions.1 Years since launch. Sweden, Denmark and Norway2

1 Credit transactions are account-to-account payments.

2 The instant payment solution was launched in Norway in 2013, but was not widely used until 2017 (year 5).

Sources: Danmarks Nationalbank, Sveriges Riksbank, Swish and Norges Bank

In order to be considered well-functioning, a real-time payment infrastructure must also have other characteristics. For example, it should not expose banks to credit risk, it should be available to all bank customers, and it should facilitate the delivery of a broad range of payments.

Improved solution

In spring 2020, Norwegian banks began to use a new infrastructure for real-time payments, called Straks 2.0. All the banks are scheduled to be connected by the end of the first half of 2020. Retail payment solutions such as Vipps will use this infrastructure for real-time payments. The solution can be outlined as follows:

•The infrastructure is available to all customers of all banks, 24 hours a day and all year round.

•The payee’s bank credits the payee’s account within seconds of payment initiation.

•The payee’s bank receives settlement in a private settlement solution before the payee’s account is credited. This takes place instantly and continuously on a 24-hour basis.

•Interbank positions are backed by liquidity set aside by banks in a dedicated account at Norges Bank. The amounts in this account ensure that banks can cover their payment obligations vis-à-vis the other participating banks. This means that the payment is backed by central bank money, eliminating credit risk between banks.

•Banks’ positions are settled in central bank money five times a day during Norges Bank’s settlement system’s opening hours.

•There is no limit on the size of payments.

Expanded role for Norges Bank?

Straks 2.0 is a clear improvement on the solution previously used by banks, whereby the payee’s account was credited without liquidity set aside at the central bank to guarantee interbank settlement. Straks 2.0 is therefore an improvement, but some weaknesses remain. For example, real-time payment solutions should be established to facilitate the exchange of information in line with international messaging standards.28 Such solutions will, for example, enable real-time payments to be used to pay bills, making the solution more useful to businesses and the public sector.

A common infrastructure can be regarded as a collective good that benefits us all. Payment solutions should therefore build on a common underlying infrastructure that is secure and fast and operates at low cost. Then providers can compete freely for customers through various applications and interfaces (Chart 2.3).

Chart 2.3 Simplified diagram of the payment infrastructure

Further development and use of a common infrastructure for real-time payments has taken longer and made less progress than Norges Bank would have preferred.29 Banks have traditionally joined forces to arrive at good common solutions for payment system infrastructure. Owing to developments in technology and market structure in recent years, payment services have increasingly become a competitive arena. Customer contact through payment services has gained strategic importance for banks. At the same time, other providers, such as large technology companies, have entered the payment market. Large technology companies may find it attractive to rely on network advantages based on their own services at the expense of the network advantages provided by a common infrastructure. Current trends may have weakened private sector incentives to contribute to developing a common solution such as the infrastructure for real-time payments.30

Project to establish a common nordic payments infrastructure (P27)

An initiative taken by large Nordic banks to establish a common Nordic payment infrastructure (P27) is described in Norges Bank (2019b). The infrastructure will deliver real-time payments between banks’ customers. In March 2019, DNB decided it would not participate in P27, and Finance Norway has stopped its work to prepare for the participation of Norwegian banks. The P27 banks in the other Nordic countries are moving ahead with the project.

According to the traditional division of labour between central banks and banks, large-value payments and interbank payments are settled individually at the central bank, while retail payments are normally sent to a clearing house before banks’ positions are settled at the central bank. With the technological developments of recent years, it is now also possible to settle retail payments directly and in real time at the central bank in a system that is open around the clock, every day of the year.31

At the same time, a number of central banks have taken on, or are considering taking on, a larger role as payment system operator. Central banks have assumed new roles for several types of payment, but particularly for real-time payments. Examples of countries where central banks have taken on a role in real-time payment solutions, or are planning to do so, are Iceland, Australia, Hong Kong, Mexico and the US. Sweden has joined the Eurosystem’s Target Instant Payment Settlement (TIPS) platform.32

Against this background, Norges Bank has launched a project to assess whether the Bank should offer real-time gross interbank settlement of retail payments in central bank money. There are two possible alternatives. The first is to establish a system for real-time payments with Norges Bank as operator and thereby responsible for management, development and operation. The other alternative is to join the Eurosystem’s TIPS solution, where TIPS settles payments in central bank money in NOK, but on behalf of Norges Bank.

The alternatives will be assessed giving consideration to further development of the current solution within today’s division of labour between Norges Bank and the banking industry. Norges Bank is engaged in a broad dialogue with the industry and will give weight in its assessment to finding solutions that are efficient and secure, that provide for innovation and competition, and that ensure satisfactory national management and control.

21 Payment is made when the card is held close to the payment terminal for a moment. A PIN code is required for amounts over NOK 500 or if the total value or number of contactless transactions exceeds a pre-determined limit.

22 Finance Norway (2020).

23 BankAxept (2019).

24 Finanstilsynet (2020b).

25 FSB (2019).

26 Some technology firms are also moving into other financial services closely linked to the payment system, such as credit provision (see FSB (2019)).

27 See FSB (2019).

28 ISO 20022 is becoming a globally accepted messaging standard for payments. Bits has launched a project (Straks 2.1) to implement ISO 20022 for real-time payments.

29 Norges Bank (2016) and Norges Bank (2018d).

30 For a broader discussion, see Nicolaisen (2019).

31 Real-time retail payments are typically settled in a system that is separate from the main settlement system (in Norway called NBO, Norges Banks oppgjørssystem [Norges Bank’s settlement system]), with solutions for the transfer of liquidity between the two settlement systems at the central bank.

32 TARGET Instant Payment Settlement. For more information on real-time payments in other countries, see Hartmann et al (2019) and and CPMI (2016).

3 Central bank money

Today, nearly all payments from customers’ bank accounts are made using deposit money (bank money). This is money created by banks. Norges Bank is of the opinion that it is important that central bank money is available and easy to use for the general public. Central bank money provides the general public with access to credit risk-free money. This contributes to competition in the market for means of payment and payment instruments, and cash is a part of the contingency arrangements should the electronic contingency arrangements fail. Norges Bank is considering whether there will also be a need in the future to provide the public with a central bank digital currency (CBDC) to ensure an efficient and secure payment system, and confidence in the monetary system.

3.1 CASH

The public makes payments by either using deposit money or central bank money (cash). Deposit money is created by private banks, while cash is issued by Norges Bank.

Norges Bank is tasked with ensuring an efficient payment system, an important part of which is providing the public with central bank money. Central bank money can be provided in two different ways: either as banknotes and coins, or electronically, as a digital claim (Section 3.2 provides an account of Norges Bank’s work on CBDCs).

Some properties of cash

•Cash is a credit risk-free alternative to bank deposits.

•Settlement in cash is immediate and final and is not dependent on a third party or electronic systems.

•It is legal tender that can be used by all.

•Cash functions as a back-up solution for the ordinary electronic payment systems.

Cash usage has declined over a long period (see box: Cash usage in Norway and selected other countries). Overall, cash is currently used in less than one in ten payments. At the same time, cash usage is far higher than this in, for example, the grocery sector and among the oldest segment of the population.

Cash is an alternative to deposit money (see box: Some properties of cash). Cash promotes competition in the payment market and is part of the back-up solution should the electronic contingency arrangements fail. Cash is therefore important for confidence in the banking system. A result of lower cash usage is that each cash payment in isolation incurs a higher economic cost and becomes more expensive in relation to other payment methods. Norges Bank will continue to issue cash and work to enable its use as long as it is appropriate and cost-efficient for society.

In order to fulfil its functions in the payment system and contribute to efficiency, it is important that cash is both available and easy to use. This means ensuring that the general public has real opportunities to obtain and use cash. To sustain the level of cash in circulation, appropriate opportunities for depositing cash are also important. Norges Bank is of the opinion that the availability and ease of use of cash has weakened in recent years. In recent years, measures have been implemented by both the authorities and banks to ensure that cash is available and easy to use.

Cash usage in Norway and selected other countries1

Cash is less frequently used when making payments for goods and services, while the frequency of electronic payment solutions is increasing steadily. Surveys conducted by Norges Bank indicate that in recent years Norwegian households have used cash in about one payment in ten (Chart 1). However, the spring 2020 survey showed that only 3% of all payments that could be made in cash were paid in cash. This survey was conducted in the period between 24 and 30 March. In this period, the authorities advised against the use of cash and many merchants refused to accept cash payment, which has likely contributed to the low share of cash payments. Cash usage has decreased by half since the corresponding survey in 2013.2

Chart 1 Cash usage in Norway (as a percentage of total number of payments)

Kilde: Norges Bank

In the Scandinavian countries, cash usage is very low compared with other countries. Table 1 shows the results from various national household surveys. In Germany, three out of four payments at point of sale are made in cash. As there are some differences in survey methodology, the types of payments included and survey timing, the data are not fully comparable.

Table 1 Cash usage in selected countries

Country

Period

Share of cash in % (number)

Germany

2017

74

US

2018

35

UK

2018

28

Denmark

2019

16

Sweden

2018

13

Norway

2020

3

Sources: Bundesbank, Danmarks Nationalbank, Federal Reserve Bank of San Francisco, Sveriges riksbank, UK Finance and Norges Bank

1 See Norges Bank (2020) for more information about the surveys.

2 The 2007 and 2013 surveys measured the share of cash transactions at physical points of sale. More recent surveys have measured the share of cash transactions at physical points of sale and person-to-person transactions together. The survey results are therefore not necessarily fully comparable.

Availability – banks’ provision of cash services in a normal situation

Norges Bank has previously pointed out that customer options for cash deposits and withdrawals have diminished over time and that current provisions are not fully satisfactory.33 Moreover, cash services are vulnerable because a substantial portion is provided by agents that are not bound by statutory obligation to the banks to maintain those services. Examples of the latter are grocery shops, which offer point-of-sale cashback, and the ATMs and night depositories operated by cash handling companies.

Under the Financial Institutions Act, banks are responsible for providing their customers with cash services. This obligation can be met either by providing these facilities themselves or by having an arrangement with another cash service provider. In the 2019 Financial Markets Report, the government called upon banks to, no later than year-end 2019, either agree on appropriate joint solutions, or individually enter into agreements that otherwise ensure bank customers access to satisfactory cash services.34

Over the past year, banks, Finance Norway and Bits AS have in collaboration established a common framework and rules for the deposit and withdrawal of cash at points of sale.35 The rules allow individual banks to agree that their customers can use cash services provided by other banks. Banks can also offer customers cash deposit and withdrawal services at physical points of sale that are linked to the BankAxept system. Vipps has developed a service, “kontanttjenester i butikk” [point-of-sale cash services], in line with these rules. Agreements have been entered into with a number of banks, and the solution will be available to bank customers from spring 2020. Norges Bank views bank-neutral common solutions as an economically efficient way for banks to meet their obligation to provide cash services.

According to the 2020 Financial Markets Report, the Ministry of Finance will request that Finanstilsynet (Financial Supervisory Authority of Norway) and Norges Bank conduct a new survey of cash services for Norwegian bank customers once the new solution has been operational for a few months.36 The survey will provide the basis for an assessment of whether the cash services are satisfactory, or if there is a need for further regulation of banks’ obligations.

Availability – banks’ provision of cash services in a contingency

Effective electronic contingency arrangements are crucial for ensuring that the payment system can be restored quickly after a disruption. Nevertheless, cash is a part of overall contingency preparedness in the event of a disruption in electronic contingency arrangements. For cash to function in a contingency, it must be available and easy to use in a normal situation as well.

On the basis of a proposal from Finanstilsynet and Norges Bank, on 17 April 2018, the Ministry of Finance issued a regulation that clarifies banks’ obligations to provide cash as a back-up (see box: Section 16-7 of the Financial Institutions Regulation (excerpt). Contingency arrangements for meeting higher demand for cash).

Banks were given the deadline of 1 January 2019 to adapt to the contingency regulation. In February, Finanstilsynet sent out a survey to ascertain banks’ adaptation to the regulation. Finanstilsynet found that most banks had established and documented contingency arrangements to meet the regulatory requirements, eg arrangements for increased cash holdings at branches and ATMs. However, only one third of the banks had tested the arrangements and only approximately two-thirds had defined criteria for when they would be implemented. According to Finanstilsynet’s assessment, there is therefore uncertainty linked to the ability of banks to take measures in a timely and orderly manner and also the risk that decisions are founded on an erroneous basis.37

Ease of use – consumers’ right to pay cash in a normal situation

In order for cash to be a real alternative, users must also have the ability to pay cash. The right to pay cash has been frequently debated in the media over the past year.

Norges Bank has noted several examples of reduced ease of cash use by the public. Norges Bank is of the opinion that consumers’ right to pay cash should be specified in the Financial Contracts Act to prevent individual businesses from unilaterally stipulating in their standard terms that the right to pay cash does not apply. Appurtenant sanctions should be clearly defined. This was also argued by Norges Bank in the 2019 Report.

The Ministry of Justice and Public Security stated that it will further examine the rules on the right to pay cash.

Section 16-7 of the Financial Institutions Regulation (excerpt). Contingency arrangements for meeting higher demand for cash

“Banks must have contingency arrangements for meeting the requirement under Section 16-4, first paragraph, of the Financial Institutions Act, when demand for cash has increased as a result of disruptions in the electronic payment systems. The arrangements should be specified and documented in a separate plan.

The arrangements should be adapted to documented assessments of the risk of increased demand for cash arising from disruptions to the electronic payment systems. The risk-mitigating effects of electronic contingency arrangements can also be taken into account. The arrangements should be tested regularly and the results should be documented.”

3.2 CENTRAL BANK DIGITAL CURRENCIES

Norges Bank is considering whether there will also be a need in the future to provide the public with access to central bank money in digital form to ensure an efficient and secure payment system, and confidence in the monetary system.

A central bank digital currency (CBDC) is a digital form of central bank money denominated in the official unit of account for general purpose users. They are a claim on the central bank in the same way that banknotes and coins are today. By comparison, bank deposits are claims on private banks.

Many central banks are considering whether to issue CBDCs in the future. Boar et al (2020) found that of a broad selection of central banks, approximately 80% were working on CBDCs. This includes everything from purpose and impact assessments to pilot projects and other testing of technical solutions. The Riksbank has recently initiated a pilot project.38

Technological advances have increased the relevance of this topic: Payment patterns are changing, new digital currencies and payment systems are being launched39 and the platforms and market participants are becoming more global. At the same time, central banks also have access to more technology than previously.

Cash has important attributes that other means of payment do not. With falling cash usage – and the potential for structural changes to the monetary and payment system – Norges Bank must assess whether issuing a CBDC is suitable for ensuring that the public can also make NOK payments efficiently and securely in the future.

In Norges Bank (2018a), a working group from Norges Bank presented an overview of factors to which emphasis should be given when evaluating whether Norges Bank should introduce a CBDC in addition to cash. In Norges Bank (2019c), the working group took a closer look at potential purposes to be achieved by CBDCs as well as alternative means of achieving these.

In the working group’s assessment, CBDCs – as a supplement to cash – could function as a contingency solution in case of a failure in bank payment systems. The contingency perspective may grow in importance if banking systems become increasingly global or if the market structure and stakeholder profile change substantially in other ways. CBDCs could help maintain competition in the payments market and offer all the characteristics of legal tender.

The working group also considered how necessary and desirable characteristics of a CBDC could be safeguarded, by reference to two primary solution categories:

•Account-based money, the value of which is linked to a balance in an account belonging to an identifiable account holder, with identity confirmation required for account access (Chart 3.1). This is comparable to payments using bank deposits. When a payment is made, the balance of the one account increases by an amount that corresponds with a decrease in the other (assuming no fees are incurred). Settlement between banks occurs when corresponding amounts are transferred between the banks’ accounts in Norges Bank.

•Token-based money, where each token has a nominal value. This can be regarded as a digital variant of banknotes and coins. Funds are not associated with a named account. An electronic wallet gives a holder access to the money. Users are linked together in a system, either directly or through a bank or another service provider. Settlement takes place when the funds are transferred between individual network participants.

Chart 3.1 Token- and account-based money

Sources: Griffoli et al (2018) and Norges Bank

In an ongoing third phase, the working group is assessing in greater detail how necessary and desirable characteristics of a CBDC could be safeguarded in the proposed solutions. The working group gathers information from a broad spectrum of national and international sources, including technology companies, consulting firms, other central banks and international organisations and representatives of potential user groups.

The working group is also examining more closely the impact of introducing CBDCs on bank funding. A guiding principle of this work is that the existence and scope of such money should not undermine the scope for credit provision in the private sector.

Completion of this work is scheduled for spring 2021. Norges Bank will then determine whether to proceed with testing some of the technological solutions. This work also interfaces with other measures to ensure an efficient and secure payment system and confidence in the monetary system. Norges Bank must consider the combination of measures – by both public and private entities – that can best enable the Bank to perform its social mission.

33 Norges Bank (2019b).

34 Norwegian Government (2019).

35 Bits (2020).

36 Norwegian Government (2020b).

37 Norwegian Government (2020b).

38 Riksbanken (2020).

39 See further discussion in Sections 2.1 and 4.

4 Cryptocurrencies with stabilisation mechanisms

In recent years, there has been an emergence of cryptocurrencies with built-in stabilisation mechanisms – stablecoins – intended to make their value more stable than traditional cryptocurrencies. Standing behind some of them are institutions with large established customer networks utilising technology that can handle a large number of transactions. Such cryptocurrencies can potentially become widespread and have implications for financial stability and the security and efficiency of the payment system. To realise the gains and mitigate risks, sound regulation must be in place.

Cryptocurrencies are units in distributed ledger technology (DLT) systems, which are accessed using cryptographic codes and can be perceived as having value as a means of payment or as services provided by the ledger.40 Cryptocurrencies have been characterised by substantial volatility that have prevented them from being able to function as money.

Over the past year, a number of cryptocurrencies have emerged with built-in stabilisation mechanisms – stablecoins – which are designed to be stable against a national currency or benchmarks such as currency baskets, commodities and commodity indexes. Stablecoins are often backed by institutions and are to a lesser degree decentralised than traditional cryptocurrencies, which helps them to process a larger number of transactions within a given period. One example of a planned stablecoin is Libra, which was announced in June 2019 by Facebook among others (see box: Libra).

Many varieties of cryptocurrencies with stabilisation mechanisms exist.41 They serve different purposes, have different underlying technological infrastructures and different stabilisation mechanisms. Many stablecoins are intended for general purpose users. Issuers often have a stated ambition of promoting financial inclusion and streamlining cross-border trade and funds transfers. Others are created to enhance the efficiency of settlement between financial institutions by, for example, removing intermediaries and speeding up settlement of securities transactions.42

Most cryptocurrencies with stabilisation mechanisms are backed by assets, which can be securities or deposits in private banks, physical commodities such as gold or other cryptocurrencies. A minority are based on algorithms designed to stabilise supply and demand in order for the value to stabilise without being backed by external assets. In some cases, issuers guarantee the value and provide users with the right to redeem at face value or at the value of the underlying asset, while users in other cases must trust the stabilisation mechanisms without any direct claim on the issuer or underlying assets.

New money and payment solutions like these can be beneficial for society but can also be a source of increased risk. In October 2019, a G7 working group presented a report on the risks linked to cryptocurrencies with stabilisation mechanisms, particularly whether these would become widespread.43 Highlighted challenges are related to criminal applications, consumer protection, market integrity, privacy, financial stability and market power. The Financial Stability Board (FSB) is following up the report and has conducted a survey of regulatory approaches in different countries. In April 2020, a FSB report was published,44 summarising a survey of regulations in different countries45 and providing a number of overall recommendations for regulations based on internationally recognised principles.46 The European Commission has initiated a survey with a view to assessing appropriate regulations.47

Libra

The plans for the Libra currency and payment system were announced in June 2019. Although Facebook is the initiator and promoter of the system, it is just one of a number of the members of the Libra Association with equal voting rights that govern Libra developments. The Libra Association is registered in Switzerland and shares features of a cooperative. Following the Libra announcement, some of the members have pulled out, while others have joined. It is uncertain when and if Libra will be launched, partly owing to regulatory conditions.

Based on the initial plans of the Libra Association members, the Libra currency was to have a stable value backed by a basket of national currencies. These plans have been changed to multiple versions of Libra pegged to individual currencies. The members will continue to provide a proprietary currency, but this can be regarded as a pre-defined portfolio of individual currencies. The Libra Reserve, reserves consisting of low-risk securities and deposits in private banks, is designed to ensure Libra’s stability and value. Stability is to be preserved by selected third parties buying and selling Libra at a fixed value. The reserves are built up or reduced depending on whether there is excess demand or supply. These third parties, for example banks or cryptocurrency exchanges, act as intermediaries that sell Libra to end-users. The end-users have no direct claim on the Libra Association or the reserves, and those holding Libra will not receive any interest.

The infrastructure of Libra is to be based on a closed type of distributed ledger technology (DLT), where transactions have to be validated by Libra Association members before being recorded in a ledger. In open-source solutions, such as Bitcoin, everyone can compete to validate transactions.1 Cryptographic keys can be used to access Libra, as for other cryptocurrencies. In practice, this is done through a user interface, a wallet, on a mobile phone that administers the keys and interfaces with the ledger. Facebook plans to release its own wallet, Calibra, and payments will also be possible through Facebook’s messaging services. User interfaces can also be provided by independent third parties.

1 See Norges Bank (2019b) for more information on payment systems based on DLT.

How are cryptocurrencies with stabilisation mechanisms currently regulated?

One question is to what extent current regulations capture the risks of cryptocurrencies with stabilisation mechanisms and the degree to which they must be addressed in new or amended regulations. In Norges Bank (2019b), the Bank wrote that stable cryptocurrencies would not necessarily be covered by existing e-money regulations and that it would assess whether the existing e-money rules are sufficient to safeguard efficiency and financial stability.

Cryptocurrencies with stabilisation mechanisms designed for general purpose users where the issuer guarantees the face value will in principle fall within the definition of e-money in the Financial Institutions Act. Under Section 2-4 of the Act, e-money is defined as monetary value as represented by a claim on the issuer, which is stored on an electronic device, issued on receipt of funds for the execution of payment transactions and accepted as a means of payment by undertakings other than the issuer. Cryptocurrencies with stabilisation mechanisms that fall within this definition are e-money and will be regulated as such.

Cryptocurrencies with stabilisation mechanisms where the issuer does not guarantee the face value, but where users have claims on the assets used to stabilise the value, will in many cases be considered as financial instruments and be subject to securities regulations (cf Section 2-4 of the Securities Trading Act). In cases where e-money or securities regulations are applied, the issuer of the cryptocurrency is responsible for obtaining relevant authorisations and meeting obligations set out in the regulation. The supervisory authorities enforce the regulations and can provide guidance where there may be doubt regarding whether or not the regulations are applicable.

A large share of the cryptocurrencies with stabilisation mechanisms are excluded from regulated asset classes such as e-money and financial instruments. There is neither a claim on the issuer nor a requirement for underlying assets to secure the value. Even if such cryptocurrencies are excluded from regulated asset classes, the entities involved will be subject to rules and regulations. First, the entities that provide the currencies will be subject to the general statutory rules, which address many societal considerations and protect consumers. Entities that trade and store cryptocurrencies will, however, be subject to rules for combatting money laundering and suitability requirements. International bodies are also working on principles for the regulation of cryptocurrency exchanges 48 and banks’ exposure to cryptocurrencies and involvement in cryptocurrency-related activities.49 Finally, cryptocurrencies that play a major role in the payment system can be defined as financial infrastructure that must meet international principles for FMIs.50

Can cryptocurrencies with stabilisation mechanisms become widespread?

It is as yet unclear how widespread stablecoins will become. Although traditional cryptocurrencies and stablecoins continue to play a modest role in the payment system, their use may increase if they are offered by agents that can take advantage of large established customer networks, such as Facebook, other global tech giants and large financial institutions. For some issuers, it may also be relevant to subsidise their use to increase revenue in other areas.

The use of stablecoins will not only depend on their features, but also on the alternatives. For countries with a well-functioning money and payment system, such as Norway, the scale of use will likely be less than in countries with less developed payment systems. By holding cryptocurrencies that are not stabilised against the value of national currencies, users who receive salaries and pay tax in national currency will bear foreign exchange costs and foreign exchange risk. This may indicate that Norwegian customers will continue to have their loans in NOK and be exposed to banks’ lending rates, and that the impact of monetary policy will not be substantially affected. Nevertheless, it is possible that stablecoins may become attractive for certain types of payment, such as cross-border payments.

Regulation will also have an impact on the scope of use of stablecoins. Regulation that reduces risk for users may make holding stablecoins more attractive, but may also create a barrier for stablecoin issuers, particularly if the rationale behind a stablecoin is to avoid regulation associated with traditional payment solutions. Sound regulation will in any case help to ensure that any increase in scale takes place on sound premises.

If the use of stablecoins becomes widespread, their importance for financial stability will also increase. Stablecoin systems could become critical for the payment infrastructure. A disruption in such a system may then result in a large number of users losing their means of payment or being unable to make payments. This may in turn result in a loss of confidence and issuers having to liquidate large reserves. One effect of this may be a fall in asset values held and contagion in the financial sector, which may lead to financial instability. If the population holds large amounts of cryptocurrencies with stabilisation mechanisms at the expense of bank deposits, this could reduce the impact of banks’ interest rates on the economy and weaken the transmission of monetary policy. In addition to protecting consumers, regulation must therefore also underpin the central bank’s role in promoting financial and monetary stability.

Same risks, same rules

Risks involving cryptocurrencies with stabilisation mechanisms and the need to regulate them may vary depending on application, stabilisation mechanism and underlying technological infrastructure.

Similar activities that create the similar risks should be subject to the same regulations, irrespective of technology (“same business, same risks, same rules”).51 In addition, regulations should not stifle innovation and competition by providing regulatory advantages to certain technological solutions that cannot be justified on the basis of differences in risk.52 Cryptocurrencies with stabilisation mechanisms that are backed by assets in different ways will to a large degree generate risk similar to those generated by other money solutions or asset-backed securities and should generally be subject to similar regulation. For cryptocurrencies with stabilisation mechanisms backed by assets, it may therefore be appropriate to subject the issuer to relevant provisions of e-money regulation, securities regulation or similar rules, even if this is not the case at present.

The revised Payment Services Directive (PSD2) set out requirements for payment service providers to mitigate risk for users and the payment system, including security requirements for the technical solutions that are provided to users and for processing personal data. These requirements often depend on whether the service stems from a payment account, which is normally a bank account. The risks for users and the payment system are often the same when a payment service uses a cryptocurrency with stabilisation mechanisms for the payment. This implies same regulation irrespective of whether the payment service is based on stable cryptocurrencies or a bank account.

New technology-specific risks can entail a need for separate regulations

The principle of technology neutrality may be more difficult to follow if the risks are technology-specific. Certain types of risk related to cryptocurrencies with stabilisation mechanisms are technology-specific and such that the regulation cannot be completely technology-neutral. If, for example, the stabilisation of a cryptocurrency is based on algorithms instead of external assets, the risk will be somewhat different than for asset-based solutions. Solutions based on algorithms alone may be more vulnerable to attacks or loss of confidence and thus generate higher risk for users than secured solutions.53 On the other hand, such a solution is less sensitive to risk related to external assets, such as value fluctuations and poor management. Furthermore, systemic contagion effects related to the fire sales of underlying assets in the event of a loss of confidence will be absent. This implies that separate regulations may be appropriate for mitigating risk related to cryptocurrencies that solely use algorithms as a stabilisation mechanism.

Moreover the use of DLT raises some technology-specific regulatory issues. Rather than relying on general rules, separate rules may be needed to provide clarity on how to allocate liability in such systems. Furthermore, doubt may arise as to when a payment transaction in DLT system is finally settled, which partly reflects a risk of changes to previous ledger entries.54 Such doubt suggests a need for rules that remove legal uncertainty regarding when a payment transaction is settled with finality. These issues are related not only to cryptocurrencies with stabilisation mechanisms, but to DLT in general.

Need for an international and national response

The regulation of cryptocurrencies with stabilisation mechanisms requires international cooperation, and as mentioned above, many such initiatives are under way. Norges Bank is following international developments and is participating in international fora where it is natural for the Bank to participate.

At the same time there are few sources to draw on when it comes to the development of international regulations. Cryptocurrencies also fall under regulations that are primarily domestic, such as contract law, tort law and bankruptcy rules. Norges Bank will assess in further detail how national rules address new technology-specific risks that affect Norges Bank’s responsibilities.

Cryptocurrencies with stabilisation mechanisms fall under many jurisdictions including financial regulators. When global tech giants are involved, competition and privacy problems arise. New forms of money may also facilitate tax evasion. Cooperation across sector authorities are important for an efficient regulatory regime, under which measures in one area support, and certainly do not counteract, the measures implemented in others. Norges Bank will therefore contribute to an exchange of information and experience with a view to promoting efficient regulation across jurisdictions.

40 For a more detailed description of cryptocurrencies, see Norges Bank (2018a).

41 See Bullmann et al (2019) or Østbye (2019) for an overview.

42 See CPMI (2019) for a description of Wholesale Digital Tokens.

43 G7 Working Group on Stablecoins (2019).

44 FSB (2020).

45 Norges Bank responded on behalf of Norway in this survey.

46 FSB has requested feedback by July 2020.

47 A joint statement on stablecoins by the European Commission and the European Council concludes that “no global ‘stablecoin’ arrangement should begin operation in the European Union until the legal, regulatory and oversight challenges and risks have been adequately identified and addressed. See European Commission and European Council (2019).

48 IOSCO (2019).

49 BCBS (2019).

50 This is described in greater detail in Norges Bank (2019b). See also CPMI (2019) and FSB (2020).

51 FSB (2020).

52 ROFIEG (2019) specifies regulatory axioms for financial technology.

53 Østbye (2019).

54 Norges Bank (2019b).

5 New rules for securities settlement systems

How securities and derivatives trades are settled by central counterparties (CCPs) and central securities depositories (CSDs) has changed in recent years. Many of the changes are in response to a number of new statutory requirements for these institutions. The EEA Central Securities Depository Regulation was transposed into Norwegian law in January 2020, and the Norwegian CSD VPS intends to apply to the Norwegian authorities for CSDR authorisation by June 2020. European authorities have also made amendments to EMIR that regulate CCPs. These amendments have not yet been transposed into Norwegian law, but because Norwegian banks use foreign CCPs, it is already important for the Norwegian financial sector.

5.1 NEW OWNERS AND NEW RULES FOR VERDIPAPIRSENTRALEN ASA

In recent years, European authorities have facilitated closer integration and increased competition among FMIs. The EEA Central Securities Depository Regulation (CSDR), transposed into Norwegian law in January 2020, applies to central securities depositories (CSDs). For Norway, a step towards closer integration was the acquisition of the Norwegian CSD, VPS, along with Oslo Børs, by the international Euronext N.V. Group in 2019.

Verdipapirsentralen ASA (VPS) is undergoing restructuring with new owners and a new regulatory framework. Central securities depositories (CSDs) play a key role in the issuance, settlement and custody of financial instruments as well as collateral management. They are therefore systemically important institutions for the securities market. In 2019, VPS, along with Oslo Børs, was acquired by the international Euronext N.V. Group. The group owns a number of European exchanges and the Portuguese CSD (Interbolsa). Previous owners were mainly Norwegian and foreign banks. The change in ownership does not entail any changes to Norges Bank’s oversight of VPS’s notary and central maintenance service and securities settlement. On 23 April 2020, Euronext N.V. announced that it had entered into an agreement to purchase around 70% of the shares in the Danish CSD VP Securities A/S. If the purchase goes though, the Norwegian and Danish CSDs will be part of the same corporate group.

The regulatory framework for VPS has been changed by the transposition of the EEA Central Securities Depository Regulation (CSDR) into the new Central Securities Depository Act of 1 January 2020. The CSDR is intended to strengthen the safety and efficiency of CSDs and securities settlement systems and establish an internal market for such services in the EU. CSDs with CSDR authorisation are permitted to offer services across the EEA, which will better ensure effective competitions among CSDs.

VPS intends to apply to Finanstilsynet for CSDR authorisation by June 2020. A CSDR authorisation will supersede VPS’s licence under the previous legislation. Finanstilsynet must make its decision within six months after it has assessed whether the application is complete. Under the CSDR, Norges Bank will inform Finanstilsynet of its views on the application.

With a CSDR authorisation, VPS will be regulated like a CSD and not a securities register. The term securities register primarily covers notary and central maintenance services, while a CSD also covers settlement services. The new act is more comprehensive and detailed than the old one and will entail new requirements for VPS and the Norwegian securities settlement system.

European CSDs began the process of applying to their home member state authorities for new authorisations under the CSDR in autumn 2017. To date, 22 CSDs have received CSDR authorisation.55

5.2 STRICTER EU RULES FOR CENTRAL COUNTERPARTIES

European regulation of central counterparties (CCPs) takes place under the European Market Infrastructure Regulation (EMIR). EMIR was adopted in 2012 and entered into force in Norway in 2017. EMIR contains detailed provisions on CCPs’ risk management and on competent authorities’ supervision of CCPs. In December 2019, major changes were made to EMIR, which will be of particular importance for CCPs outside the EU and which will also apply to CCPs domiciled in the UK after Brexit.

Central counterparties (CCPs) enter into transactions between buyers and sellers of financial instruments and become the buyer to every seller and the seller to every buyer. CCPs often engage in cross-border activities in that they offer services on trading venues in more than one country. For example, there are now three CCPs on Oslo Børs: UK LCH, Swiss SIX x-clear and Dutch EuroCCP. These CCPs have customers in many countries. Norwegian banks also participate in CCPs both inside and outside the EEA.

Since 2012, CCPs in the EEA have been regulated by the European Market Infrastructure Regulation (EMIR), which entered into force in Norway on 1 July 2017. CCPs with EMIR authorisation may offer their services throughout the EEA and must comply with common collateral management and risk management requirements. EMIR authorisations are granted by home state competent authorities, which are required to chair a college of supervisors in affected states (called “EMIR colleges”).

EMIR also permits authorisation of CCPs domiciled outside the EEA (so-called “third countries”) to provide services to entities in the EEA. Third country recognition is granted by the European Securities and Markets Authority (ESMA) and requires a determination by the European Commission that the third country’s legal and supervisory arrangements are equivalent to those in the EEA (“equivalence assessment”). According to ESMA, 35 CCPs have third country recognition under EMIR.56

On 12 December 2019, the European Parliament and the Council adopted a number of amendments to EMIR, known as EMIR 2.2, which entered into force in EU on 1 January 2020.57 EMIR 2.2 strengthens the role of ESMA in supervising CCPs and sets new requirements for third country CCPs. EMIR 2.2 also gives central banks a greater role in overseeing CCPs. Central banks will be represented in a number of EMIR colleges and may impose penalties on third country CCPs.

New requirements for CCPs outside the EEA

EMIR 2.2 entails a change in the regulatory regime for most CCP inside and outside the EU.58 Probably the most important is that ESMA has been granted increased regulatory powers over third country CCPs, which will be subject to additional ESMA decisions if they offer services in the EEA. ESMA will also monitor regulatory and supervisory developments in third country CCP regimes. If equivalent requirements are insufficiently or inconsistently applied by third country authorities, the Commission may withdraw equivalence recognition. A third country CCP may lose recognition for its own failure to conform to EU law or if the third country regulatory regime no longer conforms to the EU regulatory framework.

EMIR 2.2 contains a number of new provisions for third country CCPs, especially CCPs deemed systemically important for the financial stability of the EU (“super-systemic”). If they wish to retain the right to offer services to EEA entities, they will have to relocate all or part of their operations to the EEA within a time limit that will be set to a maximum of two years of a determination that they are super-systemic (with a possible six-month extension).

A new requirement will also be for third country CCPs to establish EMIR colleges. Under EMIR, this was required only for CCPs domiciled in the EEA. Under EMIR 2.2., central banks of issue will be invited to participate in the EMIR college if the CCP is systemically important for the financial stability in that central bank’s home country. Central banks will thus have improved access to information and greater influence over the operation of third country CCPs.

Increased responsibility and a new organisation for ESMA

In order to enable ESMA to perform its new tasks, a new ESMA CCP Supervisory Committee has been established. The Committee shall perform tasks associated with supervising CCPs and will have particular responsibility for supervising third country CCPs. Any disagreements between national supervisory authorities and ESMA will be resolved by the ESMA Board of Supervisors. National authorities will not be permanent members of the Committee but will participate in supervision of relevant CCPs.

55 ESMA (2020a).

56 ESMA (2020b).

57 EMIR 2.2 has not yet been incorporated into Norwegian legislation.

58 Exceptions are CCPs not deemed to be of importance for financial stability. The requirements for third country recognition will not be tightened for them.

References

BankAxept (2019), “Bollesalget øker med tæpping av betalingskort” [Contactless payment card use increases sweet bun sales], press release, 22 January 2019 (Norwegian only). https://bankaxept.no/nyheter/bollesalget-oker-med-taepping-av-betalingskort/

BCBS (2019), “Designing a prudential treatment for crypto-assets”, Discussion Paper, Bank for International Settlements. https://www.bis.org/bcbs/publ/d490.htm

BITS (2020), Rundskriv nr. 2 [Circular No. 2] (Norwegian only). https://www.bits.no/document/bits-rundskriv-nr-2-2020-regler-om-kreditering-av-konto-som-folge-av-kontohavers-innlevering-av-kontanter/

Boar, C., H. Holden and A. Wadsworth (2020), “Impending arrival – a sequel to the survey on central bank digital currency”, BIS Papers No. 107. https://www.bis.org/publ/bppdf/bispap107.pdf

Bullmann, D., J. Klemm, A. Pinna (2019), “In search for stability in crypto-assets: are stablecoins the solution?”, ECB Occasional Paper Series No. 230/August 2019. https://www.ecb.europa.eu/pub/pdf/scpops/ecb.op230~d57946be3b.en.pdf

CPMI-IOSCO (2012), Principles for Financial Market Infrastructures. https://www.bis.org/ cpmi/publ/d101a.pdf

CPMI-IOSCO (2016), Guidance on cyber resilience for financial market infrastructures. https://www.bis.org/cpmi/publ/d146.pdf

CPMI (2016), Fast payments – Enhancing the speed and availability of retail payments. https://www.bis.org/cpmi/publ/d154.pdf

CPMI (2019), Wholesale Digital Tokens. https://www.bis.org/cpmi/publ/d190.htm

ECB (2018), “TIBER-EU framework. How to implement the European framework for Threat Intelligence-based Ethical Red Teaming”. https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework.en.pdf

ESMA (2020a), “CSD Register: Articles 21 and 58 of Regulation (EU) No 909/2014 (CSDR)”. The register was last updated on 17 April 2020. https://www.esma.europa.eu/sites/default/files/library/esma70-151-889_csd_register.pdf

ESMA (2020b), “List of third-country central counterparties recognised to offer services and activities in the Union”. The list was last updated on 3 December 2019. https://www.esma.europa.eu/sites/default/files/library/third-country_ccps_recognised_under_emir.pdf

ESRB (2020), Systemic cyber risk. https://www.esrb.europa.eu/news/pr/date/2020/html/esrb.pr200219~61abad5f20.en.html

European Commission (2019), “Consultation document Digital Operational Resilience Framework for financial services: Making the EU financial sector more secure”. https://ec.europa.eu/info/sites/info/files/business_economy_euro/banking_and_finance/documents/2019-financial-services-digital-resilience-consultation-document_en.pdf

European Commission and European Council (2019), Joint statement by the Council and the Commission on “stablecoins”. https://www.consilium.europa.eu/en/press/press-releases/2019/12/05/joint-statement-by-the-council-and-the-commission-on-stablecoins/

Finance Norway (2020), “Kjempevekst for kontaktløs betaling” [Stupendous growth in cashless payments], 10 February 2020 (Norwegian only). https://www.finansnorge.no/aktuelt/nyheter/2020/02/kjempevekst-for-kontaktlos-betaling/

Finanstilsynet (2019), Risk and vulnerability analysis 2018. https://www.finanstilsynet.no/contentassets/7493e8b4bef04b7db471b9091ac69df1/risk-and-vulnerability-analysis-2018.pdf

Finanstilsynet (2020a), Risk and vulnerability analysis 2020. (Norwegian only). https://www.finanstilsynet.no/contentassets/816cd5c4576a484ab41749a3ff985a69/risiko--og-sarbarhetsanalyse-2020.pdf

Finanstilsynet (2020b), presentation from the seminar on 23 January 2020 (Norwegian only). https://www.finanstilsynet.no/contentassets/ee627f34336d4db58a33c70ffd868a3b/psd2.pdf

FSB (2019), BigTech in finance: Market developments and potential financial stability implications. https://www.fsb.org/2019/12/bigtech-in-finance-market-developments-and-potential-financial-stability-implications/

FSB (2020), Addressing the regulatory, supervisory and oversight challenges raised by “global stablecoin” arrangements. https://www.fsb.org/2020/04/addressing-the-regulatory-supervisory-and-oversight-challenges-raised-by-global-stablecoin-arrangements-consultative-document/

G7 Working Group on Stablecoins (2019), “Investigating the impact of global stablecoins”. https://www.bis.org/cpmi/publ/d187.pdf

Griffoli, T., M. Peria, I. Agur, A. Ari, J. Kiff, A. Popescu og C. Rochon (2018). “Casting Light on Central Bank Digital Currency”, IMF Staff Disussion Note 18/08. https://www.imf.org/en/Publications/Staff-Discussion-Notes/Issues/2018/11/13/Casting-Light-on-Central-Bank-Digital-Currencies-46233

Hartmann, M., L. Hernandez-van Gijsel, M. Plooij, Q. Vandeweyer (2019), Are instant payments becoming the new normal? A comparative study, ECB Occasional Paper Series No 229 / August 2019. https://www.ecb.europa.eu/pub/pdf/scpops/ecb.op229~4c5ec8f02a.en.pdf

IOSCO (2019), Issues, Risks and Regulatory Considerations Relating to Crypto-Asset Trading Platforms. https://www.iosco.org/library/pubdocs/pdf/IOSCOPD627.pdf

National Security Authority (2020a), RISIKO 2020 [RISK 2020] (Norwegian only). https://www.nsm.stat.no/globalassets/rapporter/rapport-om-sikkerhetstilstanden/nsm-risiko-2020.pdf

National Security Authority (2020b), News item NSM 8 April 2020. Updated alert on digital risk in connection with COVID-19 (Norwegian only). https://www.nsm.stat.no/NCSC/ncsc-varsler/oppdatert-varsel-korona/

Nicolaisen, J. (2019), “How important is it for a nation to have a payment system?” Speech at Finance Norway’s payment conference, 14 November 2019. https://www.norges-bank.no/en/news-events/news-publications/Speeches/2019/2019-11-14-nicolaisen/

Norges Bank (2016), “Infrastruktur for betalinger i sann tid” [Infrastructure for real-time payments]. Norges Bank’s letter of 2 September 2016 to Finance Norway (Norwegian only). https://www.norges-bank.no/aktuelt/nyheter-og-hendelser/Brev-og-uttalelser/2016/2016-09-02-brev/

Norges Bank (2018a), “Central bank digital currencies”, Norges Bank Papers 1/2018. https://www.norges-bank.no/en/news-events/news-publications/Reports/Norges-Bank-Papers/2018/norges-bank-papers-12018

Norges Bank (2018b), Letter of 1 October 2018 to the Ministry of Defence (Norwegian only). https://www.regjeringen.no/no/dokumenter/horing---forskrifter-til-ny-sikkerhetslov/id2606681/?uid=4be4501b-8fe6-4a4f-ad28-875d53878694

Norges Bank (2018c), Financial Stability Report 2018. https://www.norges-bank.no/en/news-events/news-publications/Reports/Financial-Stability-report/2018-finansiell-stabilitet/

Norges Bank (2018d), Letter of 3 October 2018 to Finance Norway, DNB ASA, Nordea Norway, Danske Bank Norway, SEB Norway, Handelsbanken Norway and Swedbank Norway (Norwegian only). https://www.norges-bank.no/aktuelt/nyheter-og-hendelser/Brev-og-uttalelser/2018/2018-10-03-brev/

Norges Bank (2019a), Norway’s financial system 2019. https://www.norges-bank.no/en/news-events/news-publications/Reports/norways-financial-system/2019-dnfs

Norges Bank (2019b), Financial Infrastructure Report 2019. https://www.norges-bank.no/en/news-events/news-publications/Reports/Financial-Infrastructure-Report/financial-infrastructure-2019/

Norges Bank (2019c), “Central bank digital currencies”, Norges Bank Papers 2/2019. https://www.norges-bank.no/en/news-events/news-publications/Reports/Norges-Bank-Papers/2019/memo-219-cbdc/

Norges Bank (2019d), Høring: Ny låneforskrift [Consultation: New lending regulation], Norges Bank’s letter of 25 October 2019 to Finance Norway (Norwegian only). https://www.norges-bank.no/aktuelt/nyheter-og-hendelser/Brev-og-uttalelser/2019/2019-10-25/

Norges Bank (2020), “Retail payment services”, Norges Bank Papers 1/2020.

Norges Bank and Finanstilsynet (2019), Norges Bank and Finanstilsynet request input on a possible introduction of a cyber resillience testing framework in Norway (Norwegian only). https://www.norges-bank.no/aktuelt/nyheter-og-hendelser/Brev-og-uttalelser/2019/2019-10-10-naeringen/

Norwegian Directorate for Civil Protection (2012), Vital functions in society. https://www.dsb.no/globalassets/dokumenter/rapporter/kiks-ii_english_version.pdf

Norwegian Government (2019), Financial Markets Report 2019 (Norwegian only). https://www.regjeringen.no/no/dokumenter/meld.-st.-24-20182019/id2642702/

Norwegian Government (2020a), EU consultations on cyber resilience and a regulatory framework for cryptoassets (Norwegian only). https://www.regjeringen.no/no/aktuelt/eu-horinger-om-motstandsdyktighet-mot-cyberangrep-og-et-regulatorisk-rammeverk-for-kryptoeiendeler/id2685842/

Norwegian Government (2020b). Financial Markets Report 2020 (Norwegian only). https://www.regjeringen.no/no/dokumenter/meld.-st.-22-20192020/id2699066/

Østbye, P. (2019), “Kan kryptovalutaer stabiliseres” [Can cryptocurrencies be stabilised?], Bankplassen blogpost (Norwegian only), https://bankplassen.norges-bank.no/2019/09/11/kan-kryptovalutaer-stabiliseres/

Riksbanken (2020), “The Riksbank to test technical solutions for the e-krona”, press release, 20 February 2020. https://www.riksbank.se/en-gb/press-and-published/notices-and-press-releases/notices/2020/the-riksbank-to-test-technical-solution-for-the-e-krona/

ROFIEG (2019), Expert Group on Regulatory Obstacles to Financial Innovation, “Final report of the Expert Group on Regulatory Obstacles to Financial Innovation: 30 recommendations on regulation, innovation and finance”. https://ec.europa.eu/info/publications/191113-report-expert-group-regulatory-obstacles-financial-innovation_en

Annex1

1 For tables showing developments in retail payment services, see Norges Bank Papers 1/2020.

Table 1: Average daily turnover in clearing and settlement systems (transactions)

20092

2010

2011

2012

2013

2014

2015

2016

2017

2018

2019

NICS

NICS Gross

524

568

548

594

659

624

772

980

1 021

1 567

1 859

NICS Net (million)1

6.5

6.8

7.2

7.8

8.2

8.7

9.1

9.5

9.9

10.5

11.1

NBO

Total number of transactions

1 165

1 146

1 138

1 274

1 406

1 367

1 565

1 835

1 958

2 555

2 745

RTGS Gross transactions excl. NICS

463

477

479

549

595

592

658

700

793

841

859

1 Previous NICS Retail and NICS SWIFT Net payments below NOK 25m are included as from June 2010 in NICS Net.

2 For NBO, the figures for 2009 are calculated for the period 17 April to 31 December.

Sources: The figures under NICS are from Bits. The figures under NBO are from Norges Bank

Table 2: Average daily turnover in clearing and settlement systems (in billions of NOK)

20092

2010

2011

2012

2013

2014

2015

2016

2017

2018

2019

NICS

213.1

196.5

221.4

247.8

253.5

262.8

285.9

284.1

297.0

315.3

323.2

NICS Gross

124.1

107.2

119.1

138.6

136.0

140.9

160.1

158.7

163.3

175.2

176,0

NICS Net1

82.9

89.3

102.3

109.2

117.5

121.9

125.8

125.4

133.7

140.1

147.2

NBO

168.4

162.2

172.1

201.9

188.3

198.0

219.3

221.2

235.8

247.6

259.3

NICS Gross

113.2

106.3

119.0

137.7

135.2

140.8

157.5

156.1

159.0

172.2

158.0

RTGS Gross transactions excl. NICS

40.2

42.5

42.4

51.1

38.5

42.5

46.0

40.4

42.1

57.3

81.7

NICS Net1

9.6

7.1

6.3

8.7

10.3

10.8

11.9

12.4

13.1

13.3

13.5

VPO and SIX x-clear

4.5

5.3

4.5

4.4

4.2

3.9

3.8

3.7

4.2

4.8

6.0

1 Previous NICS Retail and NICS SWIFT Net payments below NOK 25m are included as from June 2010 in NICS Net.

2 For NBO, the figures for 2009 are calculated for the period 17 April to 31 December.

Sources: The figures under NICS are from Bits. The figures under NBO are from Norges Bank

Table 3: Number of participants in clearing and settlement systems (at year-end)

2009

2010

2011

2012

2013

2014

2015

2016

2017

2018

2019

Norges Bank’s settlement system (NBO): Banks with account in Norges Bank

140

134

129

131

128

131

129

129

124

127

129

Norges Bank’s settlement system (NBO): Banks with retail net settlement in Norges Bank

21

21

21

22

22

21

22

22

21

21

21

DNB

106

105

103

98

98

97

94

94

93

92

90

SpareBank 1 SMN

16

13

12

11

11

11

11

11

11

10

10

Norwegian Interbank Clearing System (NICS)

145

142

138

132

131

130

128

128

125

124

122

Source: Norges Bank