LexLint.ioBeta

Know the law your code answers to.

Law / Spain

Real Decreto-ley 19/2018 on Payment Services, Operational and Security Risk Management

Real Decreto-ley 19/2018, art. 66, servicios de pago

In force since .

A sector security regimes rule binding private bodies.

Obligation class
Security, Governance

What it requires

  • If you are a payment service provider (such as a credit institution, an e-money institution, a payment institution or the postal operator for its payment services), this binds you (Article 66).
  • Establish a framework, as the Banco de España provides, with mitigation measures and control mechanisms to manage the operational and security risks of the payment services you provide, including effective procedures to detect and classify major operational and security incidents (Article 66.1).
  • At least once a year, in the form the Banco de España sets, give it an updated and complete assessment of those risks and of whether your mitigation measures and controls are adequate (Article 66.2).

These lines are LexLint's reading of the law's text.

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 66.1 requires payment service providers to establish a framework, in accordance with what the Banco de España provides, with mitigation measures and control mechanisms to manage the operational and security risks of the payment services they provide, including effective incident management procedures to detect and classify major operational and security incidents.

Article 66.2 requires payment service providers to give the Banco de España, at least once a year and in the form it determines, an updated and comprehensive assessment of the operational and security risks of their payment services and of the adequacy of the mitigation measures and control mechanisms they apply. Payment service providers and their directors and managers are subject to the sanctions regime of Title IV of Ley 10/2014 and to Real Decreto 2119/1993. Titles II and III of the Real Decreto-ley apply three months after its publication in the Boletín Oficial del Estado.

When LexLint raises it

When your app profile says your app is a payment provider or is a bank.

Back to the example  ·  Lint your app

Page updated .