A payment institution means a legal person established in the Republic of Croatia, which has been authorised by the Croatian National Bank to provide one or several payment services.
Submission of the application for authorisation
A legal person established in the Republic of Croatia intending to provide payment services as a payment institution (hereinafter referred to as 'applicant') submits an application to the Croatian National Bank for an authorisation to provide payment services, accompanied by all the required documentation and information as prescribed by Article 85 of the Payment System Act.
The prescribed documentation and information to be submitted to the Croatian National Bank for the purpose of issuing an authorisation to provide payment services are specified in the Guidelines on the information to be provided for the authorisation of payment institutions and e-money institutions and for the registration of account information service providers under Article 5(5) of Directive (EU) 2015/2366.
Specific requirements concerning certain documentation and information, submitted by the applicant pursuant to Article 85 of the Payment System Act, are governed in more detail in the following regulations:
- with regard to the requirement referred to in Article 85, paragraph (2), item (4) of the Payment System Act for the submission of financial statements, where applicable, the applicant also submits the completed IPK-RK form referred to in Annex 1 to the Decision on own funds of payment institutions;
- with regard to the requirement referred to in Article 85, paragraph (2), item (5) of the Payment System Act for the submission of a business plan, including a calculation of financial statements projections for the next three years of business, the applicant also submits the completed projections of the level of own funds as at 31 December for the next three years of business on the forms referred to in Annexes 1 and 2 to the Decision on own funds of payment institutions;
- with regard to the requirement referred to in Article 85, paragraph (2), item (7) of the Payment System Act for the submission of a description of measures intended to be taken to safeguard payment service users' funds in accordance with Article 100 of that Act, the scope of and methodology for the calculation of safeguarded funds and the characteristics of the types of assets and the characteristics of the insurance policy or comparable guarantee as a form of safeguarding are prescribed in more detail in the Decision on safeguarding the payment service users and electronic money holders' funds;
- with regard to the requirement referred to in Article 85, paragraph (2), item (8) of the Payment System Act for the submission of a description of the rules for the use of the services of information and communication technology (ICT) are prescribed in more detail in Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA);
- with regard to the requirement referred to in Article 85, paragraph (2), item (9) of the Payment System Act concerning the incident reporting mechanism, incident reporting obligations, prescribed in more detail in Chapter III of Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), should be taken into account;
- with regard to the requirement referred to in Article 85, paragraph (2), item (11) of the Payment System Act for the submission of a description of business continuity arrangements, including a clear identification of the critical operations, effective ICT business continuity policy and plans, ICT response and recovery plans and a procedure to regularly test and review the adequacy and efficiency of such plans, are prescribed in more detail in Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA);
- with regard to the requirement referred to in Article 85, paragraph (2), item (13) of the Payment System Act for the submission of a description of security control and risk mitigation measures taken to ensure a high level of digital operational resilience, are prescribed in more detail in Chapter II of Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) and Guidelines EBA/2019/04 on ICT and security risk management should also be taken into account in addition to their latest amendment (Guidelines amending Guidelines EBA/2019/04 on ICT and security risk management);
- if the applicant intends to provide a payment initiation service and/or an account information service, with regard to the requirements for the submission of evidence of a concluded professional indemnity insurance contract or comparable guarantee referred to in Article 85, paragraphs (9) and (10) of the Payment System Act, the applicant submits the requested evidence in accordance with Article 101 of that Act or in accordance with the Guidelines on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantee under Article 5(4) of Directive (EU) 2015/2366;
- with regard to the requirement referred to in Article 85, paragraph (2), item (15) of the Payment System Act for the submission of a description of the organisational structure, the applicant intending to outsource certain operational activities of payment services is required to ensure that the intended outsourcing complies with Article 107 of the Payment System Act and the Guidelines on outsourcing arrangements.
In addition to the application and the prescribed documentation, the applicant should also submit a completed and signed Form for the collection and processing of personal data.
Decision of the Croatian National Bank
Based on the submitted application and information available to it, the Croatian National Bank issues the authorisation to provide payment services in an administrative procedure if all the conditions referred to in Article 84 of the Payment System Act have been met. Under the provisions of the Payment System Act, legal persons may enter payment services in the register of companies only after the Croatian National Bank has adopted a decision authorising the provision of one or more payment services.
Legal persons may provide payment services only after these payment services have been entered as business activities in the register of companies.
Based on the issued authorisation, a payment institution may, in accordance with the conditions set out in the Payment System Act, provide payment services in the territory of another Member State, under the right of establishment (through a branch with a head office in the host Member State or through an agent with a head office or place of residence in the host Member State) or based on the freedom to provide services (directly or through an agent with a head office or place of residence in the host Member State). The payment institution which intends to provide payment services in the territory of another Member State is required to notify the Croatian National Bank thereof in advance.