Norges Bank

Oslo 2019

Address: Bankplassen 2

Postal address: P.O. Box 1179 Sentrum, N-0107 Oslo

Phone: 22 31 60 00

Fax: 22 41 31 05

E-mail: central.bank@norges-bank.no

Website: https://www.norges-bank.no

Editor: Øystein Olsen

Design: Brandlab

Layout and print: 07 Media AS

The text is set in 9.5 pt Azo Sans Light

ISSN 1894-8634 (online)

Norges Bank’s Financial Infrastructure Report

In its annual Financial Infrastructure Report, Norges Bank discusses developments, vulnerabilities and risks in the financial infrastructure. The Report is a part of Norges Bank’s work to promote financial stability and an efficient financial infrastructure. An efficient financial infrastructure carries out payment transactions swiftly, safely, at low cost and tailored to users’ needs.

Norges Bank’s other reports on financial stability

In the annual Financial Stability Report, Norges Bank assesses vulnerabilities and risks in the financial system, with a focus on the long-term, structural features of banks, financial markets and the Norwegian economy that are of importance for financial stability.

Norges Bank’s quarterly Monetary Policy Report with financial stability assessment includes an ongoing assessment of financial imbalances and the banking sector, Norges Bank’s monetary policy assessments and the decision basis for the countercyclical capital buffer for banks.

The annual Norway’s Financial System provides a comprehensive overview of Norway’s financial system, its tasks and the performance of these tasks.

Selected key figures

Daily turnover in Norges Bank’s settlement system: Average for 2018. Source: Norges Bank.

Daily number of transactions in the Norwegian Interbank Clearing System (NICS): Average for 2018. Source: Bits.

Daily turnover in securities settlement: Gross turnover. Average for 2018. Source: VPS.

Daily NOK turnover in the CLS foreign exchange settlement system: Average for 2018. Sources: CLS and Norges Bank.

Card transactions per capita per year: 2018. Source: Norges Bank.

Number of banks: Number of banks with an account in Norges Bank. At year-end 2018. Source: Norges Bank.

Executive Board’s assessment

The Financial Infrastructure Report is part of Norges Bank’s work to promote financial stability and an efficient payment system in Norway. The Executive Board discussed the content of the Report on 8 May 2019.

Norges Bank supervises and oversees key systems in the financial infrastructure, issues cash and facilitates interbank payment settlement. In addition, Norges Bank promotes change that could make the payment system more efficient.

An efficient payment system carries out payment transactions swiftly, safely, at low cost and tailored to users’ needs. The payment system in Norway, which has long featured standardised and cost-efficient solutions, is changing. To keep the payment system operating efficiently, improvements are needed.

Payment options where the funds are available in the payee’s account seconds after the payment are initiated (real-time payments) is an important feature of an efficient payment system. Banks’ shared infrastructure for real-time payments is primarily aimed at retail customers. This infrastructure does not accommodate real-time payments for corporate customers, and there are amount limits owing to the credit risk banks incur. Since autumn 2016, the banking industry and Norges Bank have collaborated on improving the infrastructure for real-time payments in Norway. The plan is for an improved infrastructure to go live before the end of 2019. Norges Bank assumes that banks will then offer services that will enable retail and corporate customers to make the most of the new infrastructure’s potential.

Global tech giants have entered the Norwegian payments market. So far, they have based their payment services on customers’ bank accounts and payment cards. The revised Payment Services Directive (PSD2) will make smaller providers less dependent on existing platforms and agreements. At the same time, new technologies may make it easier to provide payment services outside the traditional infrastructure. A larger role for global tech giants may give them greater influence on payment system security and efficiency. Norges Bank will monitor developments closely and consider measures if necessary, including whether it may be relevant to consider whether current e-money rules are appropriate and sufficient.

Electronic solutions are widely used to make payments. Electronic contingency arrangements are the first line of defence in the event of a disruption in the payment system. New digital technologies are emerging. Norges Bank is examining whether a central bank digital currency (CBDC) can help to support confidence in the monetary system and promote payment system efficiency, as cash does today. Cash remains an important means of payment and is a part of overall contingency preparedness in the event of a disruption in the payment system.

In the 2019 Financial Markets Report, the Ministry of Finance cites banks’ obligation to ensure that customers can deposit and withdraw cash. Banks can meet this obligation either by providing their own facilities or by agreement with other parties. In the same Report, the Ministry adds:

“If banks do not quickly, and by no later than year-end 2019, agree on appropriate joint solutions, or individually enter into agreements that otherwise ensure all bank customers access to satisfactory cash services, the Ministry will consider whether banks’ obligations should be clarified in law or regulation”.

Norges Bank assumes that all banks will follow up their responsibilities.

The 2019 Financial Markets Report cites the consumer’s right in all cases to settle payment with the recipient in cash. Norges Bank is of the opinion that the right to pay in cash should be clarified so that it cannot be contracted away by standard terms and conditions.

Increasing risks associated with cyber crime and attacks against key ICT systems are a challenge to payment system efficiency and security. In 2018, the European Central Bank (ECB) published TIBER-EU, a framework for testing financial sector cyber security, with the aim of enhancing cyber security and promoting financial stability. TIBER-EU facilitates standardised and harmonised assessments of security across systems. An important aim is sharing comparable information among authorities at a national and European level. The framework is also suited for comparing the maturity of security work in different parts of the payment system. Several of Norway’s neighbours, including Denmark and Sweden, have conducted or are considering conducting testing in accordance with TIBER-EU. Norges Bank will invite the industry, Finanstilsynet and other relevant authorities to a dialogue that will serve as the basis for an assessment on the suitability of TIBER-EU for testing cyber security in the payment system in Norway as well.

The ICT Security Commission has proposed measures to enhance the organisation and regulation of national ICT security. The Commission, which presented its report in December 2018, notes that the supervision of key ICT providers may be inadequate. Concentration and systemic risks associated with ICT providers are difficult for individual system owners to manage on their own. In its consultation response to the Ministry of Justice and Public Security, Norges Bank recommends further study of how ICT providers and data centres can best be supervised.

Norges Bank’s responsibility

Under the Norges Bank Act, Norges Bank shall “promote an efficient payment system domestically as well as vis-à-vis other countries.” The payment system comprises any means, systems or instruments that can be used to execute or facilitate payment transactions. An efficient payment system carries out payment transactions swiftly, safely, at low cost and tailored to users’ needs.

Under the Payment Systems Act, Norges Bank is the licensing and supervisory authority for systems for clearing, settling and transfer of funds between credit institutions (interbank systems).

Norges Bank exercises its authority under these Acts by:

• Overseeing the payment system and other FMIs. Oversight is aimed at individual systems. In this work, the systems are assessed according to international standards. Oversight also involves monitoring developments and being a driving force for change that can make the financial infrastructure more efficient.

• Supervising individual participants.

• Providing secure and efficient settlement of interbank payments in banks’ accounts with Norges Bank.

• Issuing banknotes and coins and ensuring their efficient functioning as a means of payment.

The financial infrastructure

The financial infrastructure can be defined as a network of systems, called financial market infrastructures (FMIs), that enable users to perform financial transactions. The infrastructure must ensure that cash payments and transactions in financial instruments are recorded, cleared and settled.

Virtually all financial transactions require the use of the financial infrastructure. Thus, the financial infrastructure plays a key role in ensuring financial stability. The costs to society of a disruption in the financial infrastructure may be considerably higher than the FMI’s private costs. The financial infrastructure is therefore subject to regulation, supervision and oversight by the authorities.

The financial infrastructure consists of the payment system, the securities settlement system, central counterparties (CCPs), securities registers and central securities depositories (CSDs) and trade repositories.

1 Changing payment landscape

Since autumn 2016, the banking industry and Norges Bank have worked together to improve the real-time payments infrastructure in Norway. The improved infrastructure is set to go live by the end of 2019. Norges Bank assumes that banks will then offer services that enable retail and corporate customers to make full use of the opportunities provided by the new infrastructure.

New regulations and technologies enable new payment service providers to play a more important role in the payment system, which may lead to better and cheaper services for users, but could also present some challenges for payment system efficiency. Norges Bank will monitor developments and, if necessary, propose measures. In this context, the Bank may also consider whether current e-money rules are appropriate and sufficient.

1.1 improved real-time payment infrastructure in norway

Real-time payments are transactions where funds are made available in the payee’s account only seconds after payment is initiated. Such payments have become increasingly common worldwide. Work to improve the Norwegian infrastructure for real-time payments started in autumn 2016 and the improved infrastructure is set to go live by the end of 2019.

A well-functioning real-time payment platform is a key part of an efficient payment system. Such a platform must have a number of characteristics in order to be considered well-functioning. For example, it must not expose banks to credit risk, it must be available for all bank customers and it must enable the use of a broad spectrum of payments.

Global real-time payments

Examples of countries and areas with real-time payments solutions:

South Korea – EBS (2001)

Brazil – SITRAF (2002)

Mexico – SPEI (2004)

South Africa – RTC (2006)

Chile – TEF (2008)

UK – Faster Payments (2008)

Poland – Express ELIXER (2008)

India – IMPS (2010)

Nigeria – NIP (2011)

Sweden – BiR (2012)

Singapore – Fast (2014)

Denmark – RealTime24/7 (2014)

EU – TIPS (2018)

Norwegian banks established a common real-time payments infrastructure in 2013, but this infrastructure has a number of weaknesses. Banks are exposed to credit risk because payees are credited prior to settlement.1 Furthermore, the infrastructure does not allow for the exchange of information between payer and payee, which is often necessary for corporate payments. Use of the system is also limited owing to an individual payment limit of NOK 500 000.

On account of the shortcomings of the Norwegian real-time payment platform, Norges Bank took the initiative to improve the infrastructure for such payments in 2016. Finance Norway, private banks and Norges Bank initiated a project to introduce an improved infrastructure, which is scheduled to go live by the end of 2019.

Interbank positions arise because customers of different banks make payments to one another. There are primarily two models for settling interbank real-time payments that do not entail credit risk. Under the first model, payments are settled continuously and individually in banks’ accounts at the central bank. Under the second model, banks deposit liquidity earmarked for real-time payments in the central bank, and the positions are settled in central bank money at set times. The second model will be used for the improved Norwegian infrastructure.

The proposed key elements of the new and improved infrastructure are:

• The payee’s bank credits the payee’s account a few seconds after the payment is initiated.

• The infrastructure is to be available to customers of all banks 24 hours a day, 365 days a year, and handle consumer-to-consumer, consumer-to-business and business-to-business payments.

• The infrastructure must be able to handle the exchange of information between payer and payee.

• To forestall credit risk, each bank deposits liquidity in a separate account at Norges Bank. The sums set aside in this account ensure that banks can cover the liabilities they incur.

• Interbank positions are settled in central bank money during the opening hours of Norges Bank’s settlement system (NBO)

• Banks will be able to place their own retail payment solutions, such as mobile banking apps, on top of the platform.

Norges Bank will establish sub-accounts for real-time payments, which banks can use to set aside lliquidity and settle positions arising from such payments. Norges Bank will ensure that there are processes and procedures for the settlement of real-time payments and develop efficient communication solutions with banks.

When the original infrastructure for real-time payments was established in 2013, several years passed before many banks made substantial use of it. The aim is for the new infrastructure to be adopted by selected banks by the end of 2019 and by the other Norwegian banks in 2020. Norges Bank assumes that banks will offer improved services that are tailored to customers’ needs and that make full use of the opportunities provided by the new infrastructure.

In a later phase, the infrastructure must be further developed, for example by establishing solutions for the exchange of information in accordance with international message standards.2 To assess this and other issues, Norges Bank has appointed a working group to consider the future of the payment and settlement systems.

Project for a pan-Nordic payment infrastructure (P27)

Last year’s report referred to an initiative launched by seven Nordic banks to establish a pan-Nordic payment infrastructure (called P27). One of the aims of this common infrastructure was to facilitate interbank real-time payments. In June 2018, Norges Bank and the other Nordic central banks responded positively to the vision to improve the efficiency of the payment system in the Nordic region. At the same time, the central banks pointed out that a number of issues needed clarification, which could take some time and would involve other authorities.

However, the work to achieve an improved Norwegian real-time payment platform was put on hold in order to establish whether P27 would cover the same needs. In October 2018, in a letter to Finance Norway, Norges Bank wrote that it was necessary to resume the work to introduce a Norwegian platform to give both corporate and retail customers in Norway access to an improved real-time payment platform. Norges Bank also pointed out that it appeared reasonable to assume that it would take more time than originally planned to clarify the premises for P27. At the same time, establishing a satisfactory Norwegian platform would decouple further P27 work from requirements and expectations specific to Norway.

In March 2019, DNB decided that it would not participate in P27, and Finance Norway stopped its work to report on the participation of Norwegian banks in P27. The P27 banks from the other Nordic countries are continuing their work to carry out the project.

1.2 New providers and services

Global tech giants have entered the Norwegian payments market. So far, these companies have based their services on the existing payment infrastructure. The revised Payment Services Directive (PSD2) will make new providers less dependent on existing providers to provide payment services based on customer bank accounts. At the same time, new technologies can make it easier to provide services that are also completely independent of the traditional payment infrastructure. These developments may result in better and cheaper services for users, but also give rise to challenges in the payment system related to security and efficiency.

Important events in 2018–2019

•The merger of Vipps, BankAxept and BankID was approved by the relevant authorities.

•The Ministry of Finance’s proposition to implement the public-law provisions of PSD2 was passed by the Storting and entered into force on 1 April 2019. A regulation from the Ministry of Justice that implements the private-law provisions of PSD2 entered into force at the same time.

•Contactless payments using near-field communication (NFC) have become more common both in payments using cards and through mobile phone payment apps. BankAxept reports that there has been strong growth in the use of contactless card payments in 2018 and expects further growth in 2019.

•During 2018, both Apple Pay and Google Pay entered the Norwegian payments market with their payment apps. These companies collaborate with certain banks in Norway on the use of underlying payment cards in the payment apps.

•Vipps announced a collaboration with a Chinese PSP, AliPay, enabling Chinese visitors to use AliPay’s payment app in Norway. So far, AliPay does not provide services to Norwegian customers.

PSD2 entered into force in Norwegian law on 1 April 2019. PSD2 gives payment initiation services (PIS) and account information services (AIS) the right to initiate payments and access customer account information on behalf of the customer. Apple Pay and Google Pay entered the Norwegian payments market in 2018 with their payment apps. Vipps is expected to offer a solution for mobile payments in shops.3 A possible result of these developments is that banks will no longer own the customer interface and will be less able to influence customers’ payment service choices. For example, using Vipps means that the customer interface is with Vipps, and not, as previously, directly with the bank. Banks will be able to provide payment services across one another’s accounts. Sbanken has already developed an application that gives customers an overview of their account balances at different banks.

Using mobile phones to make payments facilitates competition in a number of dimensions. The use of apps enables payment service providers (PSPs) to compete not only on price but also on the provision of ancillary services. Providers of goods and services can, for example, have specifically tailored payment platforms embedded in their apps. Marketing and loyalty programmes can thus be combined with a payment function. The barrier to creating services that integrate payments will be lower when such providers can rely on regulated access under PSD2.

Mobile apps also facilitate greater diversity and competition with regard to authentication and security solutions. In addition to increased diversity in the competitive landscape, the use of mobile phones allows for alternative authentication solutions such as passwords, biometric scanning and solutions based on machine learning.

Competition and innovation may result in improved payment services. At the same time, the payments market is facing efficiency challenges. Some of the PSPs entering the market already enjoy market power in other segments. This pertains particularly to global tech giants, which already have large user bases and can exploit network effects. If market power in other markets is transferred to the provision of payment services, competition may weaken over time.

Payment app providers currently rely on bank cards as the payment instrument. If payment app providers choose instead to offer payment services that access accounts directly under PSD2, card companies may play a diminished role in the payments market. Currently, the use of card schemes is regulated with a view to counteracting market power and reducing fees.4 If new providers achieve market power, they may impose fee structures that the regulations have sought to counteract. One possible consequence is less favourable terms for merchants for accepting payment solutions.5

Displacement of card schemes by direct access under PSD2 will not impact payment accounts in banks as the underlying payment infrastructure. As long as banks provide a competitive infrastructure, they will likely remain an attractive alternative for PSPs. There are, however, alternative payment infrastructures including closed e-money platforms provided by e-money companies such as PayPal. E-money providers are regulated and subject to requirements intended to protect customers’ funds.6

Global tech giants can choose e-money platforms to provide payment services. The use of closed e-money platforms will shift payments out of the banking system. The Chinese payment platform AliPay provides payment services on an e-money platform. AliPay was recently required to keep the funds held by customers on the platform as reserves in China’s central bank.7

Global giants may want to develop their own monetary units that are designed to be stable against a domestic currency or other benchmark, but whose stability is not guaranteed (“stablecoins”).8 These would then be means of payment that are not necessarily covered by current e-money regulations and therefore do not provide the same consumer protection and security as e-money.9

A shift of payments on a large scale to global giants’ closed platforms could amplify the challenges to competition. Network effects associated with a specific platform may become stronger if there is less interoperability between platforms. Offering customers an array of options for storing funds on a PSP’s platform may make it difficult to determine just how secure those funds are. If privacy policies depend on which funds are used for making payments, customers may also have difficulty determining the privacy of their transactions. A disruption in the payment solutions on a large PSP’s closed platform may have serious consequences. If a large share of payments shifts to closed platforms, Norges Bank will assess whether to oversee such platforms more closely or whether they should be subject to stricter regulation. In this context, the Bank will assess whether the existing e-money rules are sufficient to safeguard efficiency and financial stability.

1.3 Distributed ledger technology

Distributed Ledger Technology (DLT), which underlies crypto-assets such as Bitcoin, has been the focus of considerable attention in recent years. There is an international effort to test applications of DLT in the traditional financial infrastructure. In order to realise gains and mitigate risks, the use of DLT must comply with international principles pertaining to FMIs. Use of DLT must not lead to diffusion of responsibility or reduced accountability for operators.

A bank’s account system is an example of a centralised system in which a single user – the bank – administers the transaction register. A distributed ledger is an accounting system that is updated without the need for a central user. The ledger’s integrity is protected by mechanisms which ensure that users can only update the ledger with valid transactions. DLT has been the focus of considerable attention in recent years as the technology underlying crypto-assets such as Bitcoin. The authorities have pointed to risks involving crypto-assets and the need to regulate them (see box: Crypto-assets – risks and the need for regulation).

DLT may yield gains in the financial infrastructure in cases where a large number of participants can benefit from a shared ledger. In some cases, DLT may increase ledgers’ resilience to manipulation and attack. DLT may also be appropriate for use in “smart contracts”, because they can ensure the simultaneous transfer of funds or other assets without the need for intermediaries.10 For example, the transfer of both securites and cash is settled simultaneously and interdependently. Work is in progress internationally to test applications of DLT in the financial infrastructure. A number of pilot projects are testing DLT’s potential for improving the efficiency of interbank systems and cross-border payments. Product development and testing are being conducted by tech firms and traditional financial institutions and in collaborative projects. For specific examples, see box: Use of DLT in the financial infrastructure.

Norges Bank oversees the financial infrastructure and supervises interbank systems (see Section 4). In carrying out these tasks, Norges Bank applies international principles drawn up by CPMI-IOSCO.11 The principles contain a number of requirements for ensuring that these systems operate efficiently and promote financial stability. These principles will also apply if system operators employ DLT solutions. Thus, DLT will not reduce the requirements applied to these systems.

The use of DLT raises a number of issues related in particular to the characteristics of this technology (see box: Challenges posed by the use of DLT in the financial infrastructure). In connection with oversight and supervision of systems planning to adopt DLT, Norges Bank will in particular take note of the challenges highlighted by international sources, especially government bodies.

Crypto-assets such as Bitcoin are open-source, where in principle anyone can participate and perform various tasks. Those who wish to can use the system, participate in updating the ledger and also contribute to further development of system rules and software. The DLT solutions being considered by the participants in the financial infrastructure are generally more closed solutions. In a closed system, an institution will be responsible for developing software and system rules, including eligibility criteria for network participation, assigning roles to participants and determining access criteria.12

A closed system will be more centralised than the open systems for crypto-assets. It is more dependent on a single operator, but at the same time, the centralisation this entails will mitigate some risks compared with open systems. In closed solutions, governance structures will be clearer, and identifying the individual participant’s responsibilities will be simpler. It will also be simpler for individual participants to take responsibility, eg for enhancements and system upgrades. A closed system can more easily comply with requirements for governance structure, finality and information security. Participants will also be less vulnerable to informal and concealed concentrations of power than can affect a crypto-asset if a few participants gain control over parts of the system. A closed system also avoids the risks associated with splitting a crypto asset in two (“forks”).13 Nor will closed solutions require energy-intensive mechanisms for maintaining ledgers, such as with Bitcoin. A closed system will not necessarily be linked to a crypto-asset. Users will then not be exposed to fluctuations in the value of that asset. In view of the risks associated with open systems, at the present time, closed DLT solutions appear to be best able to operate in compliance with the principles drawn up by CPMI-IOSCO.

In its work on central bank digital currencies (CBDC) (see 2.3 Norges bank’s work on central bank digital currencies), Norges Bank has evaluated various designs, including the degree to which DLT or elements of DLT can contribute to realising desirable attributes of a CBDC. It is too early to draw a conclusion with regard to the introduction of a CBDC or any underlying technology.

Crypto-assets – risks and the need for regulation

In Norges Bank (2018c), consumer protection, market integrity and prevention of criminal use of crypto-assets were discussed as the most important regulatory needs related to crypto-assets. Warnings from European financial regulators were cited, including from Finanstilsynet. It was also pointed out that trading in, and use of, crypto-assets might develop into a risk to financial stability, and in that case, regulation could be required to mitigate this risk.

In 2018, the Financial Stability Board (FSB) published a guide1 for assessments of the potential risks to financial stability posed by crypto-assets, with various metrics that can be used in these assessments. Crypto-assets were not deemed to pose a risk to global financial stability. In May 2019, the ECB2 published a report from a working group assessing the implications of crypto-assets for financial stability, monetary policy and the financial infrastructure. Its conclusion is that crypto-assets are not currently a threat to euro area monetary policy and financial stability, but the ECB will monitor developments. Norges Bank shares these assessment and does not consider crypto-assets to be a threat to financial stability in Norway today. Norges Bank will monitor developments and propose measures if the situation should change.

During 2018, governments have implemented measures to protect consumers, promote market integrity and prevent criminal use. The rules for combatting money laundering have been expanded to include certain activities associated with crypto-assets. Both the European Banking Authority (EBA)3 and the European Securities and Markets Authority (ESMA)4 have prepared assessments of how these activities relate to existing financial regulations and have proposed changes where the existing regulatory framework is unsatisfactory. In spring 20195, the BIS published a statement on how banks and regulators should deal with situations where banks’ balance sheets are directly or indirectly exposed to crypto-assets. Regulatory initiatives are discussed in the 2019 Financial Markets Report.6

1 FSB (2018).

2 ECB (2019).

3 EBA (2019).

4 ESMA (2019).

5 BIS (2019).

6 See Section 3.6.5.

Use of DLT in the financial infrastructure

Solutions for cross-border payments are being developed by firms such as IBM1 and J.P. Morgan.2 These solutions are often based on the transfer of funds via tokens in a ledger, ie a digital representation of value accessed by cryptographic keys. The tokens can have a floating value or be based on a value guaranteed by a participant, eg at a fixed rate against USD. SWIFT has recently entered into a partnership with the blockchain consortium R3 to test a DLT-based solution, where users of SWIFT’s payment platform can initiate payments and receive payment-related information.3

Investment firms are assessing whether securities trading can be made more efficient using DLT. This may apply to both notary functions and clearing and settlement functions. The Australian exchange ASX is working to replace the current system for recording, clearing and settling trades (CHESS) with a DLT-based system.4 An objective is better coordination of delivery and settlement by ensuring that these can take place simultaneously in a common register.

There are also a number of projects involving central banks. An example is “Project Jasper” in Canada.5 Jasper is a collaboration between the Bank of Canada and the financial industry. In the initial phases, use of DLT for interbank clearing and settlement was evaluated, while securities settlement was added later. One of the assessments from the project is that DLT has the potential to yield the greatest gains if it can be used as a system for settlement between multiple assets.

Another example is “Project Stella”, a joint effort by the ECB and the Bank of Japan.6 Like Jasper, Stella covers interbank clearing and settlement and securities settlement. Similar projects are also underway in Singapore and South Africa.

1 IBM (2019).

2 J.P. Morgan (2019).

3 SWIFT (2019).

4 ASX (2019).

5 Payments Canada (2016).

6 ECB (2018a).

Challenges posed by the use of DLT in the financial infrastructure

CPMI (2017) points in particular to operational risk, settlement finality, legal risk, governance structure and information security as topics that merit further evaluation when DLT solutions in the financial infrastructure are being considered.

ESMA (2019) points to a number of risks associated with the underlying technology, including if it does not work as expected, a lack of qualifications among those who use it, privacy challenges and lack of settlement finality. ESMA points out that some risks can be addressed by using closed DLT solutions.

The International Securities Services Association (ISSA (2018)) points to governance structure and information security as important topics if investment firms use DLT in their functions.

1 A real-time payment in Norway currently involves the payee’s bank crediting the payee’s account immediately, before the banks have settled. The payee’s bank thus assumes credit risk until it has received funds from the payer’s bank. See also the description of credit risk associated with current Norwegian real-time payment platforms in Norges Bank (2017a).

2 ISO 20022 is an international payment message standard that will replace legacy, national and proprietary payment message formats and standards.

3 E24 (2019) (Norwegian only).

4 Regulation on interchange fees for card-based payment transactions etc. (Norwegian only).

5 Levitin (2017).

6 See Chapter 3 of the Financial Institutions Act, which also implements the E-Money Directive.

7 Carstens (2019).

8 Bloomberg (2018) and Dagens Næringsliv (2019) (Norwegian only).

9 EBA (2019).

10 Norges Bank (2018c).

11 CPMI-IOSCO (2012). See Assessments according to international principles.

12 See Rauchs et al (2018) for a detailed description of possible organisational structures for DLT systems.

13 A “fork” will often arise because the developers are in disagreement about further development of the characteristics of a crypto-asset. A possible outcome of such a disagreement is that the crypto-asset splits into two competing crypto-assets each with its own characteristics. These crypto-assets will then become two independent crypto-assets each with its own ledger and value. Bitcoin has, on several occasions, split into forks.

2 Cash and central bank digital currencies

Electronic solutions are widely used to make payments. Electronic contingency arrangements are the first line of defence in the event of a disruption in the payment system. New digital technologies are emerging. Norges Bank is examining whether a central bank digital currency (CBDC) can help to support confidence in the monetary system and promote payment system efficiency, as cash does today. Cash remains an important means of payment and is a part of overall contingency preparedness in the event of a disruption in the payment system. In Norges Bank’s opinion, there is a need for measures to ensure that cash is available and easy to use.

2.1 Banks’ provision of cash services

Over time, options to withdrawl and deposit cash have decreased. Banks are under a statutory obligation to provide cash services. Some important cash services are provided by agents that are not bound by a statutory obligation the provision of cash services is vulnerable.

Access by the public to central bank money is a key characteristic of the financial system. This access helps to support confidence in the monetary system and contributes to the efficiency of the payment system (see box: Properties of cash). Under the Financial Institutions Act, banks are obliged to offer cash services in accordance with customers’ expectations and needs.

Over time, options available to the public to make cash deposits and withdrawals have decreased. This was discussed in detail in the 2018 Financial Infrastructure Report.

At the request of the Ministry of Finance, in 2019 Q1, Finanstilsynet (Financial Supervisory Authority of Norway) prepared an overall assessment of developments, prospects and the need for measures with regard to banks’ provision of cash services. This is a follow-up of the 2018 Financial Markets Report, which states:

“If banks do not maintain adequate services, the Ministry is empowered to lay down rules pursuant to Section 16-4 of the Financial Institutions Act. However, specific obligations for individual banks laid down in a regulation may entail needlessly high costs compared with well-organised collaborative interbank arrangements. The Ministry of Finance will follow up these matters in collaboration with Finanstilsynet and Norges Bank and in a dialogue with the financial industry, and will give the Storting an updated briefing in next year’s Financial Markets Report.”

Finanstilsynet shared data and assessments with Norges Bank.14 Norges Bank’s assessment is that the information gathered by Finanstilsynet does not provide reassurance that banks’ provision of cash services has improved compared with the situation in 2018.15 The trend is toward fewer options for deposits and withdrawals, and a substantial portion of cash services are provided by agents not obliged to maintain those services. Examples are grocery shops, which offer point-of-sale cashback, and the ATMs and night depositories operated by cash handling companies. In the assessment of Norges Bank, the cash provision obligation under the Financial Institutions Act applies to all banks, ie banks must ensure that their customers are able to deposit and withdraw cash, either by providing their own facilities or by agreement with other parties.

In Norges Bank’s opinion, the current provision of cash services is not fully satisfactory. Reliance on agents not obliged to maintain these services under contracts with banks for a considerable portion of cash services is a source of vulnerability.

In a letter of 13 February 2019, Norges Bank expressed the view that banks’ statutory obligation to provide cash services in a normal situation should be clarified in a regulation.16 In Norges Bank’s assessment, banks that do not provide their customers with real opportunities to made cash deposits or withdrawals – by providing their own facilities or by agreement with other parties – are not complying with the obligation under the Financial Institutions Act.

In the 2019 Financial Markets Report, published in April 2019, it states:

“Banks have yet to implement measures in concert to ensure satisfactory provision of cash services ahead, but are favourably disposed to collaborating on new solutions. Finance Norway and Bits AS (the financial industry’s infrastructure company) established a project in 2019 to consider specific collaborative solutions. The objective is to come up with a proposal that can be presented to the banking sector later in 2019.

(…)

However, all bank customers should be ensured access to satisfactory cash services, even if they have not explicitly expressed a desire for this to their bank. In the Ministry’s assessment, Section 16-4 of the Financial Institutions Act entails such an obligation on the part of banks. To comply with the Act, individual banks must see to it that customers have the opportunity to deposit and withdraw cash, by providing their own facilities or by agreement with other providers of cash services. All banks, including those who have stated to Finanstilsynet that they do not need to ensure their customers access to cash, have a responsibility to contribute to sustainable overall cash services. If banks do not quickly, and by no later than year-end 2019, agree on appropriate joint solutions, or individually enter into agreements that otherwise ensure all bank customers access to satisfactory cash services, the Ministry will examine whether banks’ obligations should be clarified in law or regulation.”

Norges Bank assumes that all banks will follow up their responsibilities.

Properties of cash

•Cash is a credit risk-free alternative to bank deposits. Cash promotes competition and enables users to choose the option that overall best serves their needs and preferences in a given situation.

•Settlement in cash is immediate and final and is not dependent on a third party or electronic systems.

•Cash is legal tender that can be used by anyone.

•Cash functions as an independent back-up solution for the ordinary electronic payment systems.

Possible new solutions for the provision of cash

In February 2019, Finance Norway and Bits AS established a project to specifically assess the joint solutions for the provision of cash.

Vipps is planning a new in-store banking solution that will initially be made available in NorgesGruppen retail outlets. The solution will be card-based and enable both retail and corporate customers to make deposits and withdrawals. So far, DNB has signalled that it will be affiliated from the start. Consequently, DNB will terminate its agreement with Norway Post to provide banking services through in-store postal outlets in the course of 2020.1

The proposed solution is in principle open to all banks. Norges Bank views bank-neutral common solutions as an economically efficient way for banks to meet their obligation to provide cash services.

1 DNB Nyheter (2019) (Norwegian only).

2.2 Consumers’ right to pay cash

Many physical points of sale do not accept payment in cash. Norges Bank is of the opinion that the right to pay cash should be clarified so that it cannot be contracted away by standard terms and conditions.

In practice, there are currently two type of means of payment: cash (banknotes and coins), which are claims on the central bank, and deposit money (bank deposits), which are claims on private banks. Electronic payments using deposit money are the dominant payment method in Norway. Around 2% of means of payment is accounted for by cash (Chart 2.1).

Cash is primarily used for payments at retail outlets and other physical points of sale, and for payments between private individuals. Surveys conducted by Norges Bank indicate that overall, cash is used in about one payment in ten at physical points of sale (Chart 2.2). In some sectors, eg the grocery trade, cash usage is higher than this.17

Receiving payments is associated with some fixed costs. When the number of payments falls, the costs per payment will rise. Nevertheless, the ability to pay cash contributes to payment system efficiency.

• Ensuring the general public a real opportunity to choose between cash and deposit money promotes competition, and users are able to choose the option that best serves their needs and preferences in a given situation.

• Cash represents a part of overall contingency preparedness in the event of a disruption in electronic contingency arrangements. If providers of goods and services to the public largely refuse to accept cash, the demand for and circulation of cash are likely to fall. This will call into question the ability of cash to serve as a real contingency solution.

Under the Norges Bank Act, cash is legal tender in Norway. Under the Financial Contracts Act, a consumer is “entitled in all cases to effect settlement with the recipient of the payment in legal tender”.

In view of the apparent reduction in the ability of consumers to pay cash, Norges Bank has proposed that the provision of the Financial Contracts Act regarding the right to pay cash should be clarified.18 First, the scope of the provision should be clarified, to prevent consumers’ right to pay cash for being contracted away by standard terms and conditions at locations where goods and services are offered to the general public. Second, regulating the scope of the provision in cases of doubt should be considered, as well as making exceptions from the provision when warranted by special considerations. Moreover, failure to comply with the provision should also be subject to public sanctions. This is in line with Norges Banks’ consultation response to the Ministry of Justice and Public Security’s proposal for a new act on financial contracts.19

In the 2019 Financial Markets Report, the Ministry of Finance writes:

“The current Financial Contracts Act was enacted in 1999, and since then there have been sweeping changes in the availability of payment solutions and in the manner in which financial contracts are entered into. There may thus be a need to see whether the current rules are appropriate. The point of departure should continue to be the consumer’s right to pay in cash, and there may be a need to strengthen or clarify this right in certain situations.

(…)

The Ministry of Justice and Public Security will examine further the rules on the right to pay in cash following the work on a new act on financial contracts.”

2.3 Norges bank’s work on central bank digital currencies

Norges Bank is studying whether there may be a need to introduce a central bank digital currency (CBDC), and if so, in what form. This is a long-term undertaking, and Norges Bank has not drawn any conclusions.

Central bank money is a claim on the central bank. By comparison, bank deposits are claims on private banks. For households and businesses, there is currently only one kind of central bank money: cash. The question is whether they should also have access to a central bank digital currency (CBDC) as a supplement to cash.

Access to central bank money by the general public is a key characteristic of the financial system. This access helps to support confidence in the monetary system and contributes to the efficiency of the payment system (see box: Properties of cash in Section 2.1). It is important to Norges Bank that these attributes are secured in an economically efficient manner.

Legal tender ensures that the parties to the settlement of a payment have a fall-back solution if they do not agree on a method of payment. Cash is currently legal tender.

Norges Bank will issue cash for as long as it is appropriate. Cash is likely to exist for many years. But at some point, cash usage may become so low as to make it more difficult for cash to contribute to the desirable attributes of the payment system.

This is the background for Norges Bank’s analysis of CBDCs. A key question is whether important attributes of the monetary and payment system may be lost if at some point cash disappears and a CBDC is not introduced. Norges Bank must also assess whether a CBDC can contribute to a payment system that better meets the needs of the future.

A Norges Bank working group20 has identified three possible main purposes of introducing a CBDC as a supplement to cash:

• Functioning as an independent back-up solution for the ordinary electronic payment systems,

• Ensuring a credit risk-free alternative to deposit money, which also promotes competition in the payment market, and

• Ensuring suitable legal tender.

A CBDC can be a payment system that is technically independent of the ordinary payment systems. A CBDC can also ensure national control over payments in NOK. This may be particularly important if other payment infrastructure is relocated outside of Norway.

There will be benefits, costs and risks associated with a CBDC. The assessment of whether a CBDC is desirable must therefore be based on an economic cost-benefit analysis of a specific solution.

There are two main categories of CBDC:

• A digital variant of banknotes and coins, often referred to as “tokens”. Funds are not associated with a named account. Instead, users’ funds will be stored in an electronic wallet with code- and password-protected access. As with cash, confidence that the money is genuine is essential.

• Account-based money, the value of which is linked to a balance in an account belonging to an identifiable account holder.

Within each category, numerous variants are conceivable. For example, a system of token-based money can be linked to a register that records payments and ownership. There are also a number of forms of account-based money. In PayPal’s system, both the payer and payee maintain accounts in a closed system. Whereas in banks’ systems, the payer and payee may have accounts in separate banks.

There are currently instrumentalities that ensure confidence in money and the payment system. But the structure of the payment system, the operator landscape and technologies used are evolving quickly. Thus, the division of roles in the payment system may also change. This may also affect the need for and design of a CBDC.

Norges Bank has not drawn any conclusions on whether to introduce a CBDC. This is a long-term undertaking. Any decision will also affect other authorities. In its further work, Norges Bank will examine more closely the optimal design and potential impact of any CBDC. Norges Bank will also follow work on CBDCs at other central banks.

Swedish e-krona

In recent years, Sveriges Riksbank has studied the purpose and impact of introducing a CBDC, called the e-krona, in the face of falling cash usage. The Riksbank is assessing whether an e-krona is needed to ensure that the role of cash can be filled in a digital world. Over the next two years, the Riksbank will build and test a technical CBDC solution, which along with another study will serve as the basis for deciding whether to introduce an e-krona. According to Sveriges Riksbank (2018), the pilot version will be token-based, be interest-free and facilitate off-line payment. In this way, the pilot version will be fairly similar to cash.

14 Finanstilsynet and Norges bank (2019).

15 Norges Bank (2018a).

16 Norges Bank (2019b).

17 Aera Payment & Identification (2018).

18 Norges Bank (2019a).

19 Norges Bank (2017b).

20 Norges Bank (2018b).

3 Cyber security and the payment system

The payment system’s dependence on technology makes it vulnerable to cyber attacks. The European Central Bank (ECB) has drawn up a framework for testing financial institutions’ detection, protection and response capabilities against sophisticated cyber attacks. Norges Bank will invite the financial industry, Finanstilsynet (Financial Supervisory Authority of Norway) and other relevant authorities to a dialogue that will serve as the basis for an assessment on the suitability of the framework for testing the cyber resilience of the payment system in Norway.

A number of payment system participants have outsourced the operation of their systems to a small number of ICT service providers. This is a source of concentration risk. In Norges Bank’s view, how key ICT service providers and data centres can best be supervised merits further study.

3.1 Penetration testing to strengthen cyber resilience

Technological advances are altering the balance of risks and giving rise to new challenges that must be addressed. The owners of financial market infrastructures (FMIs) are responsible for keeping their systems secure. Penetration testing can be an effective tool for identifying specific vulnerabilities in ICT systems. Norges Bank will assess whether a new framework for penetration testing of ICT systems will be suitable for testing the cyber resilience of the payment system in Norway.

A cyber attack could have systemic consequences if the financial system lacks sufficient capacity to absorb shocks, rectify faults and ensure continuity of the most important economic functions in society.21 FMI owners are responsible for keeping their systems secure, which means, for example, sound security procedures and recovery plans. For the financial system as a whole, cyber security can also be strengthened through well-established cooperation between the authorities and system participants.

Penetration testing can be an effective tool for identifying specific vulnerabilities in ICT systems. Penetration testing or "red teaming" means that a red team (preferably an external service provider) carries out a controlled cyber attack against a company’s ICT systems. A report is then prepared with recommendations for risk-reduction measures. Based on the test results, FMI owners can remediate vulnerabilities and thereby mitigate the risk of successful attacks. The test results can also be used by the authorities to assess the cyber resilience of systems within their purview.

The Government refers to penetration testing as a tool that is becoming increasingly important in ensuring that critical digital infrastructure is sufficiently secure and robust.22

Norges Bank follows up the FMIs it supervises to ensure that they have satisfactory defence mechanisms in place. Norges Bank’s general supervisory and oversight work is discussed in more detail in Section 4. The supervision and oversight of cyber security is based on international principles drawn up by CPMI-IOSCO23. CPMI-IOSCO has issued a guidance on cyber resilience24, which supplements the principles. This guidance on cyber resilience includes emphasis on the importance of penetration testing of FMIs. A framework for how such penetration testing should be conducted has not previously been drawn up.

The ECB published the European framework for Threat Intelligence-based Ethical Red Teaming (TIBER-EU) in May 2018 (see box: TIBER-EU). TIBER-EU provides guidelines for the standardised testing of financial institutions’ detection, protection and response capabilities against sophisticated cyber attacks. The aims of TIBER-EU are to enhance the cyber resilience of the financial sector and promote financial stability. The framework is based on similar test programmes in the United Kingdom and the Netherlands.25

A standardised format for testing seeks to ensure consistent assessments of cyber resilience across systems and jurisdictions and facilitate information sharing between national and European authorities. The framework is also suited for comparing the maturity level of cyber security in different parts of the payment system, including among key ICT service providers, in banks and in the central settlement and clearing system. Chart 3.1 provides an overview of the TIBER-EU testing process.

The European supervisory authorities (ESAs)26 issued joint advice27 for the financial sector to the European Commission, stating that the development of a coherent cyber resilience testing framework28 in the European financial sector could provide benefits. TIBER-EU is specifically referred to in the joint advice as a penetration testing framework. The recommendation from the European supervisory authorities to the European Commission is being processed by Finanstilsynet.

TIBER-EU can be adapted to the specificities of different jurisdictions. Relevant authorities are encouraged to cooperate on drawing up a national framework, but a single authority should have ownership. The market participant to be tested will be responsible for the testing. It is up to national authorities to decide whether testing should be voluntary or mandatory. Denmark and Belgium introduced the framework in 2018 as TIBER-DK and TIBER-BE, respectively. Sweden is in the process of implementing the TIBER-EU framework.

The introduction of TIBER-EU may provide clear benefits, while costs must be taken into account and the duplication of tasks avoided. Norges Bank will invite the industry, Finanstilsynet and other relevant authorities to a dialogue to serve as the basis for an assessment of the suitability of TIBER-EU for testing cyber resilience in the payment system in Norway. In the assessment, it will be relevant to examine, for example, whether TIBER-EU can supplement and improve current practices and regulations.

TIBER-EU1

TIBER (Threat Intelligence-based Ethical Red Teaming). The use of targeted threat intelligence and external test specialists ensures realistic testing of critical ICT systems.

External test specialists (red teams) simulate tactics, techniques and procedures (TTPs) on the basis of bespoke threat intelligence, used by real-life threat actors.

The aim is to enhance the detection, protection and response capabilities of key financial sector participants against sophisticated cyber attacks.

Core objectives:

•Enhancing the cyber resilience of specific entities in particular and the financial sector more generally.

•Standardising and harmonising the way entities perform intelligence-led red team tests across the EU, while also allowing each jurisdiction a degree of flexibility to adapt the framework according to its specificities.

•Providing guidance to authorities on how they might establish, implement and manage this form of testing at a national and European level.

•Supporting cross-border, cross-jurisdictional intelligence-led red team testing for multinational entities.

•Enabling supervisory and/or oversight equivalence discussions where authorities seek to rely on each other’s assessments carried out using TIBER-EU, thereby reducing the regulatory burden on entities and fostering mutual recognition of tests across the EU.

•Creating the protocol for cross-authority/border collaboration, result sharing and analysis.

1 Based on Danmarks Nationalbank (2018a) and ECB (2018b).

3.2 Key ICT service providers and concentration risk

In the payment system, ICT development and operations are largely outsourced. The fact that a number of the payment system participants have outsourced their ICT operations to a small number of service providers entails potential concentration risk. A disruption in a critical ICT service provider can have an impact on important parts of the payment system and other key public functions. Norges Bank is of the opinion that there is a need to explore how concentration risk associated with key ICT service providers should be managed.

Outsourcing involves transferring tasks to an external contractor rather than performing them internally. Even so, FMI owners are responsible for outsourced tasks and are required to have sufficient resources and qualified personnel in-house to manage and monitor the performance of their service providers and any subcontractors effectively.

Professional ICT service providers may have more resources and expertise to develop more resilient solutions than individual FMI owners, and thereby reduce the risk of unintended and intended incidents. A high level of fixed costs is associated with ICT, and to realise economies of scale, several participants use the same service provider. The outsourcing of the operation of ICT systems to a small number of service providers by a large number of payment system participants entails concentration risk.29 A disruption in a key ICT service provider can impose substantial costs on society and weaken confidence in the financial system.

It is difficult for individual FMI owners to address concentration risk among ICT service providers. In the 2018 Financial Infrastructure Report, Norges Bank recommended examining how ICT service providers and data centres, which are critical for the payment system, and other key public functions could best be supervised, and whether such supervision should be coordinated to ensure coherent regulation. It was also pointed out that an evaluation must not duplicate the ongoing work of the ICT Security Commission. The Commission published its report “IKT-sikkerhet i alle ledd — Organisering og regulering av nasjonal IKT-sikkerhet” [ICT security at all levels – Organisation and regulation of national ICT security] on 3 December 2018.

In its report30, the ICT Security Commission cites Norges Bank’s recommendation, and points out that long and complex digital value chains can result in inadequate supervision, given the traditional distinction between supervisor and supervised entity.31 The Commission adds that the supervision of subcontractors may present a challenge for a number of systemically critical institutions. The ICT Security Commission makes no specific recommendations. In Norges Bank’s consultation response32 to the Ministry of Justice and Public Security, the Bank wrote that the following points should be followed up in particular:

• The significance and management of concentration risk because many critical functions rely on a small number of ICT service providers and data centres.

• The supervisory frameworks for ICT service providers and data centres that are important for key public functions, including the payment system.

• Whether the contingency arrangements of key ICT service providers and data centres are sufficient.

21 Norges Bank (2018d).

22 Norwegian Ministries (2019).

23 CPMI-IOSCO (2012). See Assessments according to international principles.

24 CPMI-IOSCO (2016). See Norges Bank (2016) for further details on the guidance.

25 CBEST (United Kingdom) and TIBER-NL (the Netherlands).

26 European Insurance and Occupational Pensions Authority (EIOPA), European Banking Authority (EBA), European Securities and Banking Authority (ESMA).

27 EIOPA, EBA and ESMA (2019). The recommendation was a follow-up of the European Commissions FinTech action plan from March 2018. European Commission (2018).

28 This refers to TLPT (Threat Led Penetration Testing) that is considered to be the most advanced form of penetration testing. TIBER-EU is a framework for such testing.

29 Norges Bank (2017a) and Norges Bank (2018c).

30 Official Norwegian Reports (NOU 2018: 14) (Norwegian only).

31 Official Norwegian Reports (NOU 2018: 14) (Norwegian only).

32 Norges Bank (2019c) (Norwegian only).

4 Supervision and oversight of FMIs

Virtually all financial transactions require the use of the financial infrastructure. Thus, the financial infrastructure plays a key role in ensuring financial system stability. The costs to society of a disruption in the financial infrastructure may be considerably higher than the FMI’s private costs. The financial infrastructure is therefore subject to regulation, supervision and oversight by the authorities.

4.1 Supervision and oversight of FMIs

Norges Bank grants licences to and supervises Norwegian interbank systems. In addition, Norges Bank oversees the payment system and other FMIs. Oversight is aimed at individual systems. In this work, the systems are assessed according to international standards. Oversight also involves monitoring developments and being a driving force for change that can make the financial infrastructure more efficient and secure.

Definitions in the Payment Systems Act

Payment systems are interbank systems and systems for payment services.

Interbank systems are systems for the transfer of funds between banks with common rules for clearing and settlement.

Systems for payment services are systems for the transfer of funds between customer accounts in banks or other undertakings authorised to provide payment services.

Securities settlement systems are systems based on common rules for clearing, settlement or transfer of financial instruments.

Norges Bank oversees the payment system according to the Norges Bank Act.33 The payment system comprises any means, systems or instruments that can be used to execute or facilitate payment transactions, with cash, deposit money and other means of payment.

Part of the payment system is customer-oriented, which the public generally has access to, such as cash, card schemes and payment applications. Finanstilsynet (Financial Supervisory Authority of Norway) supervises many of the individual customer-oriented systems (systems for payment services). Norges Bank’s oversight of the payment system according to the Norges Bank Act includes the payment system as a whole, including the customer-oriented systems that Finanstilsynet supervises.

As part of its oversight, Norges Bank can obtain information and encourage the participants to make changes that can make the systems more efficient and secure. In this area, the Bank also gives advice and makes recommendations to the Ministry of Finance and other relevant authorities when, in the Bank’s opinion, action is deemed necessary and the Bank itself does not have instruments at its disposal. Norges Bank’s oversight of international FMIs that are important for the financial sector in Norway takes place through participation in international collaborative arrangements.

The payment system also consists of systems for clearing and settlement between credit institutions (interbank systems). Norges Bank is the supervisory authority for certain interbank systems under the Payment Systems Act.34 The supervision of interbank systems means that Norges Bank is a licensing authority and has a right and an obligation to require changes if the interbank system is not arranged in accordance with the Payment Systems Act and licence terms.

The main categories of FMI that Norges Bank supervises or oversees are interbank systems and securities settlement systems (see further discussion in Sections 4.2 and 4.3). An overview of these FMIs is FMIs shown in Table 4.1.

TABLE 4.1 FMIs subject to supervision and oversight by Norges Bank

System

Instrument

Operator

Norges Bank’s role

Other designated authorities

Interbanksystemer

Norges Bank’s settlement system (NBO)

Cash

Norges Bank

Supervision

(Norges Bank’s Supervisory Council) and oversight

Supervision: Norwegian National Security Authority

Norwegian Interbank Clearing System (NICS)

Cash

Bits AS

Licensing and supervision

DNBs settlement bank system

Cash

DNB Bank ASA

Licensing and supervision

Licensing and supervision of the bank as a whole: Finanstilsynet

SpareBank 1 SMNs settlement bank system

Cash

SpareBank 1 SMN

Oversight

Licensing and supervision of the bank as a whole: Finanstilsynet

CLS

Cash

CLS Bank International (CLS)

Oversight in collaboration with other authorities

Licensing: Federal Reserve Board

Supervision: Federal Reserve Bank of New York

Oversight: Central banks whose currencies are traded at CLS (including Norges Bank)

Verdipapiroppgjørssystemer

Norwegian securities settlement system

Securities and cash

Verdipapir-sentralen ASA (VPS)

Oversight

Supervision: Finanstilsynet

VPS’s central securities depository (CSD) function

Securities

VPS

Oversight

Licensing: Ministry of Finance

Supervision: Finanstilsynet

SIX x-clear’s central counterparty system

Financial instruments

SIX x-clear Ltd.

Oversight in collaboration with other authorities

Supervision: Swiss financial supervisory authority

Oversight: Swiss National Bank, Finanstilsynet and Norges Bank

LCH’s central counterparty system

Financial instruments

LCH Ltd.

Oversight in collaboration with other authorities

Supervision: Bank of England

Oversight: EMIR College and Global College (including Norges Bank)

EuroCCP’s central counterparty system

Financial instruments

EuroCCP N.V.

Oversight in collaboration with other authorities

Supervision: Dutch central bank

Oversight: EMIR College (including Norges Bank)

Assessments according to international principles

Norges Bank assesses the FMIs that are subject to supervision and oversight in accordance with principles drawn up by the Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO). The CPMI is a committee comprising representatives of central banks, and the IOSCO is the international organisation that regulates securities markets.

The objective of the principles is to ensure a robust financial infrastructure that promotes financial stability. The principles cover areas such as governance structure and management of different types of risk. Norges Bank will conduct a new assessment of the individual systems against the principles during 2020.

4.2 Supervision and oversight of interbank systems

Interbank systems are systems based on common rules for clearing, settling or transferring money between credit institutions.

NORGES BANK’S SETTLEMENT SYSTEM (NBO)

The system in brief

Norges Bank is the ultimate settlement bank in the Norwegian payment system. Settlement between banks and other institutions with an account at Norges Bank takes place in NBO. Most payments in NOK are ultimately settled in NBO (See Chart 4.1).

Payments can be settled either one at a time (gross) or as part of a clearing (net) in NBO. While net settlements take place at set times during the day, gross settlements take place throughout NBO’s opening hours. Norges Bank settles clearings from NICS, VPS and CLS (see separate discussions for each of these systems).

Supervision and oversight

Norges Bank’s Supervisory Council has the overriding responsibility for supervising the Bank’s operations – including NBO – and compliance with the rules for the Bank’s activities. The members of the Supervisory Council are appointed by the Storting (Norwegian parliament) and an annual report on the supervision of the Bank is submitted to the Storting. The Supervisory Council is served by a General Secretariat, which performs secretariat and supervisory tasks.

The Supervisory Council’s supervisory role follows from the Norges Bank Act. The provisions of the Payment Systems Act concerning interbank systems do not apply to Norges Bank.

Under the Security Act, NBO is classified as a sensitive installation under the Security Act. The Norwegian National Security Authority (NSM) supervises Norges Bank’s compliance with the Security Act’s provisions.

An oversight arrangement for NBO has been established within Norges Bank. Oversight is performed by a separate internal unit, which will also facilitate compliance with international principles drawn up by CPMI-IOSCO.35 Norges Bank performs regular self-assessments of NBO in accordance with the principles. The self-assessments are primarily performed by the Norges Bank unit responsible for NBO system ownership, albeit with input from the oversight unit on certain principles.

Supervision

Under Section 2 of the Payment Systems Act, Norges Bank is the licensing authority for the clearing and settlement systems for transfers of funds between banks (interbank systems). Norges Bank awards licences and supervises the interbank systems’ compliance with the Payment Systems Act and licence terms.

Should Norges Bank uncover any non-compliance with the Act or licence terms, it will instruct the operator of the system to rectify the matter. As a last resort, the Bank may revoke its licence.

Instructions to rectify shortcomings are also given to the operator in cases where Norges Bank uncovers shortcomings among external FMI service providers. The operator, which is licensed and responsible for operations, must then ensure that the service provider addresses the shortcomings.

Norges Bank may grant exemptions from the licensing requirement for interbank systems considered to have no significant effect on financial stability.

Oversight

Norges Bank oversees a number of FMIs. Oversight is a central bank task that promotes efficient and secure FMIs by:1

•Monitoring the FMI, ie supervising operations, system changes etc.

•Assessing the FMI against targets and standards for efficiency, security and stability.

•Initiating changes to the FMI where necessary.

Norges Bank’s oversight is based on Section 1 of the Norges Bank Act and international principles for FMIs.

If Norges Bank identifies any issues that are reducing the FMI’s efficiency, Norges Bank will urge its owners to rectify the deficiencies and, if necessary, raise the issue with the relevant supervisory authority. In other words, in its oversight, Norges Bank cannot impose requirements on FMI owners.

1 CPSS (2005) and CPMI-IOSCO (2012).

NORWEGIAN INTERBANK CLEARING SYSTEM (NICS)

The system in brief

NICS is the banks’ common platform for clearing payment transactions. Nearly all payment transactions in Norway, including card transactions, are sent to NICS. Most of the transactions received by NICS are included in a multilateral clearing in which each bank’s net position against all other banks is calculated. The clearing result is sent to NBO, where the net positions are settled with transfers between the accounts of the participating banks. Clearings are settled five times daily each working day at 5.30 am, 9.30 am, 11.30 am, 1.30 pm and 3.30 pm.

Banks also send transactions via NICS that are not included in a multilateral clearing. These transactions are settled individually (gross) in NBO. Gross transactions can also be sent directly from banks for settlement in NBO. Payments can be settled gross throughout NBO’s opening hours, i.e. between 5.30 am and 4.35 pm. These are generally payments with a value of more than NOK 25m.

Supervision

Bits has a licence from Norges Bank to operate NICS. Norges Bank conducts semi-annual supervisory meeting with Bits. In the past year, Norges Bank gave particular weight to cyber security.

PRIVATE SETTLEMENT BANKS

The systems in brief

Private settlement banks perform correspondent bank services for other banks in the domestic payment system. This means that they take over the positions of other banks after they are cleared in NICS and settle on their behalf in NBO. Following settlement participating banks’ accounts are credited or debited at the private settlement bank. There are three private settlement banks in Norway – DNB, SpareBank 1 SMN and Danske Bank – that perform settlement services for 91, 10 and one participant bank(s), respectively.

Supervision and oversight

DNB has a licence from Norges Bank for its settlement system. Norges Bank holds semi-annual supervisory meetings with DNB concerning its settlement system. Outsourcing and cyber risks have been included on the meeting agendas over the last year.

SpareBank 1 SMN is exempt from holding a licence and is therefore not subject to supervision by Norges Bank, but Norges Bank nevertheless oversees its operations and holds regular meetings with SpareBank 1 SMN. Topics at these meetings include the operating situation, exercises carried out and any system changes.

Danske Bank’s settlement system is too small to require either supervision or oversight by Norges Bank.

CLS

The system in brief

CLS Bank International (CLS) operates the world’s largest multicurrency cash settlement system, settling payment instructions related to foreign exchange (FX) transactions in 18 currencies, including the Norwegian krone (NOK). Payment instructions are settled on a gross basis across settlement members’ accounts on the books of CLS. CLS calculates funding as a net position for each settlement member in each currency. Ingoing and outgoing currency payments are transacted through CLS and member banks’ accounts with the various central banks, such as Norges Bank.

Traditionally, FX transactions are settled in different countries’ payment systems and in different time zones. Parties have therefore been exposed to a risk that a counterparty will default on its leg of a foreign exchange transaction (referred to as “Herstatt risk”). In CLS, settlement of one leg of a foreign exchange transaction are settled simultaneously, eliminating the Herstatt risk in foreign exchange settlement.

At year-end 2018, 71 banks were settlement members of CLS. DNB was the only Norwegian settlement member. Institutions that are not settlement members may use a settlement member to settle foreign exchange transactions in CLS on their behalf (third parties).

CLS rules are governed by English law and the settlement member agreements are governed by New York law. CLS Bank International, which operates the settlement system, is located in the United States and is chartered by the Board of Govenors of the Federal Reserve Act. In December 2018, the Norwegian parliament passed an amendment to the Payment Systems Act to ensure that UK interbank systems would continue to be protected by the Settlement Finality Directive even if the UK leaves the EU.36

Supervision and oversight

CLS is subject to both supervision and oversight. CLS is regulated and supervised by the Federal Reserve, while 23 central banks, including Norges Bank, cooperate on oversight of CLS via the CLS Oversight Committee (OC). The Federal Reserve Bank of New York provides the chair of the OC. This cooperative oversight arrangement is based on international principles drawn up by CPMI-IOSCO.37

Outsourced ICT operations

In its supervisory and oversight work, Norges Bank attaches weight to sufficient management and control of outsourced ICT operations by FMI owners.

Norwegian FMIs are served by the following ICT providers:

NBO: EVRY Norge, SIA and Vermeg Solutions.

NICS: Nets Norge Infrastructure.

DNB’s settlement system: EVRY Norge, HCL Technologies and Tata Consultancy Services.

SpareBank 1 SMN’s settlement system: EVRY Norge.

VPS’s register function and settlement system: VPS’s ICT operations are in-house.

4.3 Oversight of securities settlement systems

Systems based on common rules for clearing, settlement or transmission of financial instruments are considered to be securities settlement systems.

REGISTRATION OF SECURITIES IN THE CENTRAL SECURITIES DEPOSITORY (VPS)

The system in brief

Under the Securities Register Act, shares and subscription rights issued by Norwegian public limited companies and Norwegian bearer bonds shall be entered into a central securities depository (CSD) licenced by the Ministry of Finance. For other financial instruments, such registration is optional.

VPS is the only CSD licenced in Norway. There are now approximately 1.3m VPS accounts and the market value of securities registered with the VPS is approximately NOK 6 000bn.

Oversight

Norges Bank oversees VPS’s CSD function and Finanstilsynet supervises VPS. CSD function oversight takes place in connection with oversight of the VPS settlement system.

VPS SETTLEMENT SYSTEM

The system in brief

VPS is the operator of the Norwegian securities settlement system (VPO). VPO performs settlement of securities denominated in NOK, such as equities, equity certificates and fixed income securities. In VPO, rights to securities are registered to VPS accounts, while the cash leg is settled in NBO (see box: Key data for securities settlement). Transactions sent to VPO for settlement come from a number of trading venues.

CCPs participate in VPO because they enter into equity trades on regulated trading venues, becoming the counterparty to both the buyer and the seller of the equities, a process known as clearing (See Chart 4.2).

For equity trades that are centrally cleared, the CCPs calculate a net cash position and a net equity position for each participant. As a result of this netting, fewer transactions are sent for settlement in VPO. Trades in NOK bonds are not cleared by CCPs.

In the period between 2019 and 2023, VPS is conducting a modernisation programme covering IT systems, organisation, skills and market practices. The programme involves, among other things, adjustments to new EU rules (the Central Securities Depositories Regulation (CSDR)) (see box: New rules for securities settlement and central securities depositories). To comply with the CSDR, VPS must make changes to its services and operations. VPS will apply to Norwegian authorities for CSD authorisation, which will replace the current licence VPS has as a Norwegian CSD.

Oversight

Norges Bank oversees VPO, while Finanstilsynet supervises VPS, including VPS’s settlement operation. The Bank holds semi-annual oversight meetings with VPS, with Finanstilsynet invited as observer. Additional meetings on specific issues are conducted as necessary. Over the past year, Norges Bank’s oversight activities have focused on VPS’s preparations for the new EU rules. VPS has made improvements to VPO in accordance with international principles drawn up by CPMI-IOSCO.38 VPO now fully observes the principles of legal basis and default procedures, while these principles were broadly observed last year (for more details, see Norges Bank (2018c).

VPS is one of the subsidiaries of Oslo Børs VPS Holding ASA. The Ministry of Finance has approved the applications of the international excange group Euronext N.V. and Nasdaq AB to acquire shares in Oslo Børs VPS Holding ASA.39

Key data for securities settlement

Thirty-six market participants (investment firms, banks and CCPs) participate directly in VPS. Of these, 20 also participate directly in the cash leg of settlement in NBO (17 private banks, Norges Bank and two CCPs). There are also a number of indirect participants.

Up until 14 March 2019, VPO settlement took place twice a day, at 6 am and 12 noon. VPO settlement is a multilateral net settlement. The net daily settlement volume in 2018 was NOK 4.8bn, with 73% of transactions settled in the early morning settlement.

From 15 March 2019, VOP settlement has taken place three times a day, in order to comply with the EU Central Securities Depositories Regulation (CSDR). The new settlement takes place around 2.30 pm. The volumes in the new settlement have so far been small.

Before each settlement, VPS calculates both cash and security legs of participants’ positions. These cash positions are settled through the participants’ VPO settlement accounts in NBO and rights to securities recorded on VPS accounts (delivery versus payment). Once the cash leg is complete, the rights to the securities are registered to VPS accounts (delivery versus payment). These rights are registered individually (gross). In 2018, such transactions in VPS averaged a good 53 000 per day. Average gross settlement volume in VPS in 2018 was NOK 68.1bn, much higher than the aforementioned net amount of NOK 4.8bn.

The standard procedure for securities trades on registered trading venues is settlement after two days. Some trades are not settled on the agreed date, primarily because either the seller or buyer lacked cover. In 2018, 95.96% of transactions and 89.43% of the value of settlements in VPO were settled on the agreed date. Most transactions that were not settled on the agreed date were settled one or two days later, and only 0.2% were cancelled.

New rules for securities settlement and central securities depositories

Securities settlement will become regulated more extensively when new EEA rules that correspond to the EU regulation on securities settlements and CSDs, CSDR (Central Securities Depository Regulation), are introduced in Norway. The Ministry of Finance has presented a bill on the implementation of the new EEA rules in the new CSD Act1 The law has been passed, but it has not been determined when it will enter into force. CSDR is intended to help ensure secure and efficient CSDs and securities settlement systems, as well as create competition between CSDs.

The CSDR will require changes to the Norwegian securities settlement system (VPO) and more extensive regulation of CSDs. As CSDs play a key role in the issuance, settlement, safekeeping and pledging of financial instruments, they are systemically important institutions for the securities market.

In autumn 2017, European CSDs began the process of applying to their home state authorities for CSDR authorisation. CSDR authorisation will enable CSDs to offer services throughout the EU, promoting competition among CSDs. Currently 13 CSDs have CSDR authorisation, according to ESMA's web page.

VPS is planning to obtain CSDR authorisation. The application will be sent to Finanstilsynet which will be the competent authority under the CSDR. Norges Bank, as a relevant authority under the CSDR, will be given the opportunity to state its opinion on the application to Finanstilsynet.

The new CSD Act, which will implement the CSDR in Norway, will replace the current Securities Register Act.

1 Prop. 7 L (2018–2019) (Norwegian only).

CENTRAL COUNTERPARTIES

The systems in brief

Central counterparties (CCPs) enter into transactions between buyers and sellers of financial instruments and become the buyer to every seller and the seller to every buyer, a process known as clearing (See Chart 4.3). Banks and other participants in financial markets thus reduce their exposure to one another, but on the other hand, CCPs must handle substantial exposures. CCPs are therefore subject to extensive regulation. In periods of market turmoil, resilient CCPs can make an important contribution to financial stability.

Losses for CCPs primarily occur if a participant fails to meet payment obligations. Such losses are normally covered by the margins paid in by the defaulting participant. However, very large losses are distributed among the other CCP members. Through a solid risk management framework, a CCP ensures that the risk of such losses occurring is very low.40

The European Market Infrastructure Regulation (EMIR) entered into force in Norway on 1 July 2017 and includes the implementation of a clearing obligation for certain types of OTC derivatives41 and a reporting obligation for all derivatives.42 EMIR makes central clearing mandatory for a number of standardised OTC derivatives, but for Norwegian market participants, the clearing obligation for interest rate derivatives is what matters.

On 5 February 2019, the European Commission, the European Parliament, and the European Council agreed to make a number of ammendments to EMIR. The aim of the ammendments is to remove the provisions that are difficult for participants to comply with but that are not vital for financial stability. An important example of such an adjustment is that banks with small interest rate derivative positions will not be subject to the central clearing requirement. The changes are expected to be approved during spring and to enter into force during summer 2019.

Since no CCPs are headquartered in Norway, Norwegian market participants’ trades in financial instruments are settled through foreign CCPs. Foreign CCPs with broad-based Norwegian membership are the UK LCH, Swiss SIX x-clear, Dutch EuroCCP and Swedish Nasdaq Clearing AB.

Brexit has led to challenges for UK CCPs that provide services to participants in the EEA. However, provisional measures taken by the EU and the UK enable institutions in the EEA to participate in UK CCPs even if the UK is no longer an EU member country. The provisional measures will apply for a period of 12 months after the UK has left the EU. This is important because UK CCPs clear a high proportion of the derivatives in the EU (Chart 4.4). The Ministry of Finance follows up the measures taken by the EU in the area of financial markets, and ensures that these measures in Norway are correspondingly and simultaneously effective.

While LCH, SIX x-clear and EuroCCP clear equities on Oslo Børs and other trading venues, Nasdaq Clearing AB clears commodity derivatives on the Norwegian commodity derivatives exchange, Nasdaq Oslo ASA. LCH also clears OTC derivatives.

In September 2018, a Norwegian participant in Nasdaq Clearing AB defaulted on its obligation. Posted margins from participants were insufficient to cover the resulting losses, which the participants therefore had to absorb parts of (see box: Member default in Nasdaq Clearing AB).

Oversight

Norges Bank’s oversight of CCPs that are important for the financial sector in Norway is performed through participation in international collaborative arrangements:

• The Dutch central bank has set up an EMIR College to oversee EuroCCP. Norges Bank participates as an observer without voting rights.

• The Bank of England has set up an EMIR College to oversee LCH, and has also established a Global College with a broader composition than the EMIR College. Norges Bank participates in the global college without voting rights.

• Norges Bank and Finanstilsynet have signed a collaboration agreement with the Swiss authorities on the oversight of SIX x-clear.

Through this work, the authorities will ensure that the risk management of CCPs is sound.

Member default in Nasdaq Clearing AB

If a member is unable to meet its obligations to a CCP, the CCP could incur losses. These are normally covered by collateral posted in advance by the defaulting member. In rare circumstances the loss is so large that the member’s collateral is insufficient, and the other members must then share in absorbing the loss. Such an incident occurred in the Swedish CCP Nasdaq Clearing AB on 12 September 2018. A  member from Norway incurred a loss that could not be covered. The loss was related to positions in energy derivatives that were traded on the Norwegian commodity exchange, Nasdaq Oslo ASA.

Closing out the position resulted in a EUR 114m loss for Nasdaq Clearing and the other participants. Two thirds of the other participants’ contributions to the default fund were lost, and these members had two days to replenish the fund.

Nasdaq Clearing AB is subject to the supervision of the Swedish financial supervisory authority (Finansinspektionen), which has described the event in Finansinspektionen (2018). According to the report, Nasdaq Clearing AB did not have any rules for how large a position a clearing member may hold as long as the margin requirements were met. In this case, there was a very large position relative to market depth. The size of the position resulted in a complicated auction process with probably larger losses than would have been the case if the position had been small or the market more liquid. Finansinspektionen notes that it has conducted an initial analysis of the event, that it takes the incident seriously and will continue to work on issues related to requirements and follow-up of members, default procedures, concentration risk and risk models.

The Norwegian commodities exchange, Nasdaq Oslo ASA, is subject to the supervision of Finanstilsynet, which published a supervisory review on 7 January 2019. In the review, Finanstilsynet pointed out a number of matters that the exchange should address.

Norges Bank does not oversee or supervise any Nasdaq companies.

33 See Section 1 of the Norges Bank Act.

34 See Section 2 of the Payment Systems Act. Norges Bank may grant exemptions from the requirement for a license to interbank systems that are considered to have limited significance for financial stability. Norges Bank can then choose to monitor these instead. SpareBank 1 SMN's settlement system is one such system.

35 CPMI-IOSCO (2012). See Assessments according to international principles.

36 See box on Brexit and the Settlement Finality Directive in Norges Bank (2018c).

37 CPMI-IOSCO (2012). See Assessments according to international principles.

38 CPMI-IOSCO (2012). See Assessments according to international principles.

39 Norwegian Government (2019).

40 Norges Bank (2015).

41 OTC (over the counter) trading is not conducted on a regulated exchange.

42 Which OTC derivatives are subject to the central clearing obligation is set in EMIR’s technical standards.

References

Aera Payment & Identification (2018): “Skapt av handelen – for handelen” [Created by commerce – for commerce], Payment Conference, 6–7 March 2018 (Norwegian only). https://static1.squarespace.comstatic/562a32b0e4b0e6f4ec3104ae/t/5aaa5f5c53450a6f4dea99b7/1521114995286/Aera+Betalingskonferansen+Mars+2018+Light.pdf

ASX (2019): “CHESS Replacement”. https://www.asx.com.au/services/chess-replacement.htm

Bank of England (2018): Financial Stability Report, Issue No 44, November 2018. https://www.bankofengland.co.uk/financial-stability-report/ 2018/june-2018

BIS (2019): “Statement on crypto-assets”. https://www.bis.org/publ/bcbs_nl21.htm

Bloomberg (2018): “Facebook Is Developing a Cryptocurrency for WhatsApp Transfers, Sources Say”. https://www.bloomberg.com/news/articles/ 2018-12-21/facebook-is-said-to-develop-stablecoin-for-whatsapp-transfers

Carstens (2019): Carsten, A., “Bigtech in finance and new challenges for public policy”, SUERF Policy Note Issue No 54, January 2019. https://www.bis.org/speeches/sp181205.pdf

CPMI (2017): “Distributed ledger technology in payment, clearing and settlement: An analytical framework”, Committee on Payments and Market Infrastructures, February 2017. https://www.bis.org/cpmi/publ/d157.htm

CPMI-IOSCO (2012): “Principles for Financial Market Infrastructures”, 5 April 2012. https://www.bis.org/cpmi/publ/d101a.pdf

CPMI-IOSCO (2016): “Guidance on cyber resilience for financial market infrastructures”, 29 June 2016. https://www.bis.org/cpmi/publ/d146.pdf

CPSS (2005): “Central bank oversight of payment and settlement systems”, May 2005. https://www.bis.org/cpmi/publ/d68.pdf

Dagens Næringsliv (2019): “Facebook utvikler egen kryptovaluta: – Vanvittig interessant å se hvor dette ender” [Facebook is developing its own cryptocurrency – Insanely interesting to see where this ends] (Norwegian only). https://www.dn.no/utenriks/facebook-utvikler-egen-kryptovaluta-vanvittig-interessant-a-se-hvor-dette-ender/2-1-597058

Danmarks Nationalbank (2018a): “Test skal øge cyberrobustheden i Danmark” [Testing to increase cyber resilience in Denmark], Nyt nr. 7, 18 December 2018, (in Danish only). http://www.nationalbanken.dk/da/publikationer/Documents/2018/12/NYT_nr%207_Test%20skal%20oege%20cyberrobustheden%20i%20Danmark.pdf#search=tiber

Danmarks Nationalbank (2018b): “TIBER-DK General Implementation Guide”, 18 December 2018. http://www.nationalbanken.dk/da/finansielstabilitet/fsor/Documents/TIBER%20Implementeringsguide.pdf#search=tiber

DNB Nyheter (2019): “DNB går for ny løsning for kontanttjenester i 2020” [DNB opts for new cash services solution], 26 April 2019 (Norwegian only). https://www.dnbnyheter.no/nyheter/dnb-gar-for-ny-losning-for-kontanttjenester-i-2020/

E24 (2019): “DNB ser tøff konkurranse fra Apple, Google og Facebook” [DNB sees tough competition from Apple, Google and Facebook], 2 April 2019 (Norwegian only). https://e24.no/boers-og-finans/bank/dnb-ser-toeff-konkurranse-fra-apple-google-og-facebook/24594568

EBA (2019): “Report with advice for the European Commission on crypto-assets”, EBA Report, 9 January 2019.

ECB (2018a): “Second Stella report published”, 27  arch 2018. https://www.ecb.europa.eu/paym/intro/news/html/ecb.mipnews180327.en.html

ECB (2018b): “TIBER-EU Framework: How to implement the European framework for Threat Intelligence-based Ethical Red Teaming”, May 2018. https://www.ecb.europa.eu/pub/pdf/other/ecb.tiber_eu_framework.en.pdf

ECB (2019): “Crypto-Assets: Implications for financial stability, monetary policy, and payments and market infrastructures”, ECB Crypto-Assets Task Force, Occasional Paper Series No 223, May 2019. https://www.ecb.europa.eu/pub/pdf/scpops/ecb.op223~3ce14e986c.en.pdf?f2e9a2596a8f9c38c95f4735 c05a0d47

EIOPA, EBA and ESMA (2019): “Joint advice of the European Supervisory Authorities”, 10 April 2019. https://www.esma.europa.eu/sites/default/files/library/jc_2019_25_joint_esas_advice_on_a_coherent_cyber_resilience_testing_framework.pdf

ESMA (2019): “Advice on Initial Coin Offerings and Crypto-Assets”, 9 January 2019, ESMA 50157-1391. https://www.esma.europa.eu/sites/default/files/library/esma50-157-1391_crypto_advice.pdf

European Commission (2018): “FinTech Action plan: For a more competitive and innovative European financial sector”, COM(2018) 109 final, 8 March 2018. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52018DC0109

Finansinspektionen (2018): “Stability in the Financial System”, 27 November 2018. https://www.fi.se/contentassets/86382ed610304769b77c5a 35aa54891f/stability-financial-system-2018-2nn.pdf

Finanstilsynet and Norges Bank (2019): “Letter of 28 februar 2019 to the Ministry of Finance”.

FSB (2018): “Crypto-asset markets: Potential channels for future financial stability implications”, 10 October 2018. http://www.fsb.org/wp-content/uploads/P101018.pdf

IBM (2019): “IBM Blockchain World Wire”, https://www.ibm.com/blockchain/solutions/world-wire

ISSA (2018): “Distributed Ledger Technology Principles for Industry-Wide Acceptance”, Version 1.0, Report, June 2018. https://www.issanet.org/e/pdf/2018-06_ISSA_DLT_report_version_1.0.pdf

J.P. Morgan (2019): “Blockchain and Distributed Ledger”. https://www.jpmorgan.com/global/blockchain

Levitin, A. J. (2017): “Pandora’s Digital Box: The Promise and Perils of Digital Wallets,” University of Pennsylvania Law Review 166, 305.

Norges Bank (2015): Financial Infrastructure Report 2015, pp 11–14, 13 May 2015. https://www.norges-bank.no/aktuelt/nyheter-og-hendelser/Publikasjoner/Finansiell-infrastruktur---rapport/Finansiell-infrastruktur-2015/

Norges Bank (2016): Financial Infrastructure Report 2016, 24 May 2016. https://www.norges-bank.no/en/news-events/news-publications/Reports/Financial-Infrastructure-Report/Financial-infrastructure-2016/

Norges Bank (2017a): Financial Infrastructure Report 2017, 18 May 2017. https://www.norges-bank.no/en/news-events/news-publications/Reports/Financial-Infrastructure-Report/financial-infrastructure-2017/

Norges Bank (2017b): “Letter of 12 December 2017 to the Ministry of Justice and Public Security”. https://www.norges-bank.no/aktuelt/nyheter-og-hendelser/Brev-og-uttalelser/2017/2017-12-12-brev/

Norges Bank (2018a): “Letter of 20 February 2018 to Finanstilsynet”.

Norges Bank (2018b): “Digitale sentralbankpenger” [Central Bank Digital Currency], Norges Bank Memo no. 1/2018, 18 May 2018 (Norwegian only). https://static.norges-bank.no/contentassets/166efadb3d73419c8c50f9471be26402/nbmemo- 1-2018-digitalesentralbankpenger.pdf?v=05/18/2018121951&ft=.pdf

Norges Bank (2018c): Financial Infrastructure Report 2018, 24 May 2018. https://www.norges-bank.no/en/news-events/news-publications/Reports/Financial-Infrastructure-Report/financial-infrastructure-2018/

Norges Bank (2018d): Financial Stability Report 2018: vulnerabilities and risks, 29 October 2018. https://www.norges-bank.no/en/news-events/news-publications/Reports/Financial-Stability-report/2018-finansiell-stabilitet/

Norges Bank (2019a): “Letter of 31 January 2019 to the Ministry of Finance”.

Norges Bank (2019b): “Letter of 13 February 2019 to Finanstilsynet”.

[Norges Bank (2019c): “Letter of 20 March 2019 to the Ministry of Justice and Public Security”. https://www.norges-bank.no/aktuelt/nyheter-og-hendelser/Brev-og-uttalelser/2019/2019-03-22/

Norwegian Government (2019): “Approval of acquisition of Oslo Børs VPS Holding ASA”, Press Release, 13 May 2019. https://www.regjeringen.no/en/aktuelt/oslo-bors/id2644913/

Norwegian Ministries (2019): “Tiltaksoversikt til nasjonal strategi for digital sikkerhet” [Overview of measures for the national digital security strategy”, January 2019 (Norwegian only). https://www.regjeringen.no/contentassets/c57a0733652f47688294934ffd93fc53/tiltaksoversikt---nasjonal-strategi-for-digital-sikkerhet.pdf

Official Norwegian Reports (NOU 2018:14): “IKT-sikkerhet i alle ledd – Organisering og regulering av nasjonal IKT-sikkerhet” [ICT security in all segments – Organisation and regulation of national ICT security], 3 December 2018 (Norwegian only). https://www.regjeringen.no/contentassets/0d408600df2f4738a9bbb85040b02b59/no/pdfs/nou201820180014000dddpdfs.pdf

Payments Canada (2016): “Project Jasper”. https://www.payments.ca/industry-info/our-research/project-jasper

Prop. 7L (2018-2019) to the Storting: The Act on Central Security Depositories and Securities Settlement etc. (Central Securities Depository Act) (Norwegian only). https://www.regjeringen.no/no/dokumenter/prop.-7-l-20182019/id2617402/

Rauchs, M., Glidden, A., Gordon, B., Pieters, G. C., Recanatini, M., Rostand, F., and Zhang, B. Z. (2018): Distributed Ledger Technology Systems: A Conceptual Framework, Cambridge Centre for Alternative Finance. https://www.jbs.cam.ac.uk/fileadmin/user_upload/research/centres/alternative-finance/downloads/2018-10-26-conceptualising-dlt-systems.pdf

Sveriges Riksbank (2018): “Riksbankens e-kronaprojekt – rapport 2” [Riksbankens e-krona project – report 2], October 2018 (in Swedish only). https://www.riksbank.se/globalassets/media/rapporter/e-krona/2018/riksbankens-e-kronaprojekt-rapport-2.pdf

SWIFT (2019): “SWIFT to bring benefits of gpi to DLT and trade ecosystems”, 30 January 2019, https://www.swift.com/news-events/news/swift-to-bring-benefits-of-gpi-to-dlt-and-trade-ecosystems

World Bank (2018): World Bank national accounts data and OECD national accounts data files, https://data.worldbank.org/indicator/ny.gdp.mktp.cd

Laws and regulations

Payment Systems Act. Act No 95 of 17 December 1999 relating to payment systems etc. https://www.norges-bank.no/en/topics/about/Mission-core-responsibilities/Legislation/Payment-Systems-Act/

European Market Infrastructure Regulation (EMIR). Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32012R0648

Financial Institutions Act. Act No 17 of 10 April 2015 relating to financial companies and financial groups (Norwegian only). https://lovdata.no/dokument/NL/lov/2015-04-10-17?q=finansforetaksloven

Regulation No 827 of 1 September 2016 on interchange fees for card-based payment transactions etc. (Norwegian only) https://lovdata.no/dokument/SF/forskrift/2016-06-27-827

Norges Bank Act. Act No. 28 of 2 May 1985 relating to Norges Bank and the Monetary System etc. https://www.norges-bank.no/en/topics/about/Mission-core-responsibilities/Legislation/Norges-Bank-Act/

Central Securities Depository Act. The Act on Central Security Depositories and Securities Settlement etc (Norwegian only). https://lovdata.no/dokument/NL/lov/2019-03-15-6?q=verdipapirsentralloven

Annex1

1 For tables showing developments in retail payment services, see Norges Bank Papers 1/2019.

Tablel 1: Average daily turnover in clearing and settlement systems (transactions)

2008

2009³

2010

2011

2012

2013

2014

2015

2016

2017

2018

NICS

NICS Gross

605

524

568

548

594

659

624

772

980

1 021

1 567

NICS SWIFT Net1

6 390

6 269

-

-

-

-

-

-

-

-

-

NICS Net (million)2

5.9

6.5

6.8

7.2

7.8

8.2

8.7

9.1

9.5

9.9

10.5

NBO

Total number of transactions

1 165

1 146

1 138

1 274

1 406

1 367

1 565

1 835

1 958

2 555

RTGS Gross transactions excl. NICS

463

477

479

549

595

592

658

700

793

841

1 Phased out in June 2010.

2 Previous NICS Retail and NICS SWIFT Net payments below NOK 25m are included as from June 2010 in NICS Net..

3 For NBO, the figures for 2009 are calculated for the period 17 April to 31 December. There is a break in the series this year.

Sources: The figures under NICS are from Bits. The figures under NBO are from Norges Bank

Table 2: Average daily turnover in clearing and settlement systems (in billions of NOK)

2008

2009³

2010

2011

2012

2013

2014

2015

2016

2017

2018

NICS

246.6

213.1

196.5

221.4

247.8

253.5

262.8

285.9

284.1

297.0

315.3

NICS Gross

165.9

124.1

107.2

119.1

138.6

136.0

140.9

160.1

158.7

163.3

175.2

NICS SWIFT Net¹

7.3

6.1

-

-

-

-

-

-

-

-

-

NICS Net2

73.4

82.9

89.3

102.3

109.2

117.5

121.9

125.8

125.4

133.7

140.1

NBO

224.9

168.4

162.2

172.1

201.9

188.3

198.0

219.3

221.2

235.8

247.6

NICS Gross

163.9

113.2

106.3

119.0

137.7

135.2

140.8

157.5

156.1

159.0

172.2

RTGS Gross transactions excl. NICS

45.6

40.2

42.5

42.4

51.1

38.5

42.5

46.0

40.4

42.1

57.3

NICS SWIFT Net1

1.1

0.9

1.1

-

-

-

-

-

-

NICS Net2

9.2

9.6

7.1

6.3

8.7

10.3

10.8

11.9

12.4

13.1

13.3

VPO and Oslo Clearing⁴

5.1

4.5

5.3

4.5

4.4

4.2

3.9

3.8

3.7

4.2

4.8

VPO

4.9

4.4

5.2

4.5

4.4

4.2

3.9

3.8

3.6

4.2

4.8

Oslo Clearing

0.3

0.1

0.1

0.1

0.0

0.0

0.1

-

0.0

0.0

0.0

1 Phased out in June 2010.

2 Previous NICS Retail and NICS SWIFT Net payments below NOK 25m are included as from June 2010 in NICS Net.

3 For NBO, the figures for 2009 are calculated for the period 17 April to 31 December. There is a break in the series this year.

4 From May 2015, legally integrated with SIX x-clear.

5 See note 4.

Sources: The figures under NICS are from Bits. The figures under NBO are from Norges Bank

Table 3: Number of participants in clearing and settlement systems (at year-end)

2008

2009

2010

2011

2012

2013

2014

2015

2016

2017

2018

Norges Bank’s settlement system (NBO): Banks with account in Norges Bank

143

140

134

129

131

128

131

129

129

124

127

Norges Bank’s settlement system (NBO): Banks with retail net settlement in Norges Bank

22

21

21

21

22

22

21

22

22

21

21

DNB

103

106

105

103

98

98

97

94

94

93

92

SpareBank 1 Midt-Norge

16

16

13

12

11

11

11

11

11

11

10

Norwegian Interbank Clearing System (NICS)

143

145

142

138

132

131

130

128

128

125

124

Source: Norges Bank