Ultimately, the CJEU answered this question in the negative. It concluded that the Security Product did not meet the requirements of Service 3 and reasoned, on teleological grounds, that the provision of ancillary payment services should not in itself bring an entity within the scope of PSD2. It must be noted, however, that the CJEU stayed close to the factual basis of the case in reaching its judgment.

This may have a significant impact on certain commercial services that were previously thought to constitute the provision of payment services.

How did the CJEU reach this conclusion?

First, the CJEU noted that the service provided by Betaal Garant is the ‘similar security’ for which art. 7:767 DCC statutorily provides. The CJEU broke that similar security down into two sub-transactions: one from the consumer’s bank account to the payment account of the Foundation; and one instructed by the Foundation from its payment account to that of the contractor.

Second, the CJEU applied a literal interpretation, making two points. First, payment services are defined as the business activities listed in Annex I to PSD2. Second, after reciting the definitions of “payment transaction”, “credit transfer” and “payer”, the CJEU held that the execution of a credit transfer requires that the payment service provider (“PSP”) receives a payment order and holds (beheert) the payer’s payment account.

On the facts, the CJEU consequently points out, the payment transactions are executed by the banks of the consumers and of the Foundation, not by Betaal Garant, and it is those same banks that hold the payment accounts involved. Hence, the CJEU concludes, it is the banks that provide Service 3, not Betaal Garant.

Third, the CJEU discusses the contextual scope of PSD2. After noting that the Security Product itself (as based on art. 7:767 DCC) is out of scope of PSD2, the CJEU goes on to clarify that only entities providing payment services as their main activity are within the remit of PSD2. In principle, therefore, only the six categories of entities listed in art. 1(1) PSD2 (e.g., payment institutions, electronic money institutions and banks) are in scope. Where transfers of funds are only ancillary to another commercial main activity, the CJEU continues, the burden of compliance with PSD2 would be disproportionate.

Fourth, from a teleological perspective, the CJEU expands on why the consumer protection interest cannot prevail as a ground for stretching the scope of PSD2 beyond its existing wording: doing so would run counter to the legal certainty that PSD2 seeks to achieve.

In short, the CJEU deconstructs Service 3 into its constituent elements, articulates an exclusion for ancillary services and limits the ability of competent authorities to apply a broad interpretation in the consumer interest.

A legal reflection

The judgment of the CJEU in Betaal Garant v DNB is noteworthy for several reasons. First and foremost, for Dutch practice, is the limit the CJEU imposes on the broad interpretations used by competent authorities such as DNB to qualify activities as payment services. Equally, the express reference to Recital (24) PSD2, and the limitation it contains of PSD2’s scope to entities acting in a regular occupation or professional capacity, clarifies a longstanding ambiguity – though it is not entirely revolutionary. The CJEU stayed close to the factual circumstances of the case, so drawing overly general conclusions remains difficult. Even so, these two findings are sure to have a (large) impact on the market.

Decomposing Service 3

A further interesting point is the interpretation the CJEU gives to Service 3 (paragraphs 36 and 37). On that reading, Service 3 must consist of:

• A PSP receiving a payment order;
• Pertaining to an existing payment account;
• That is held by the same PSP receiving the payment order.

Interestingly, the CJEU passes over the first two elements identified above. Instead, the CJEU merely notes that the transfers of funds that are effected in the course of the Security Product are executed by the banks of the consumers and of the Foundation. The CJEU thereby foregoes the analysis of whether the instruction given by the consumer to Betaal Garant, specifically to release the security, constitutes a payment order as defined in art. 4(13) PSD2. Given the breadth of that definition, it is not clear-cut whether the payment order is given first to Betaal Garant and then to the bank, or directly to the bank.

Moreover, the CJEU also does not go into whether payment accounts are created by Betaal Garant or the Foundation. Instead, the CJEU simply asserts that they are not. It would have been interesting to understand the CJEU’s view on whether the administrative record of the security deposit, held by the Foundation in the customer’s name and from which funds can be transferred to the contractor, could be a payment account as defined in art. 4(12) PSD2. In this regard, we note that most Dutch non-bank PSPs operate (administrative) payment accounts through a Foundation, which itself holds a bank account at a bank where the customer’s funds are actually held.

Neither does the CJEU further develop the notion of ‘holding a payment account’. The AG gave a technical involvement interpretation to this notion – an interpretation which, however narrow, is not to be found in the CJEU’s judgment. It would have been interesting if the CJEU reflected on the ability of Betaal Garant to effectuate a transfer of funds (by instructing the account servicing bank) from the Foundation’s account following Betaal Garant’s receipt of the consumer’s instruction.

The fact that the Security Product is grounded in a statutory provision of the DCC makes the CJEU’s conclusion – that it should not be understood as the provision of payment services – understandable. However, it would have been useful for the practice if the CJEU had further developed the elements constituting Service 3, beyond the (mere) identification of those elements.

A closer look at the ancillary services exclusion

The CJEU’s consideration that only payment services provided by entities listed in art. 1(1) PSD2 are in scope of PSD2 must be unpacked a little. The CJEU appears to use this – in our view, somewhat, circular – argument to reason that only entities whose main business is payment services are, e.g., payment institutions and should therefore be in scope of PSD2. The CJEU notes that the application of PSD2 would (paragraph 46):

‘not [be] justified if transfers of funds are made only in order to carry out another service offered as the primary service, as is the case here, namely a service for the provision of an equivalent guarantee, […].’

This consideration is broader than Recital (24) PSD2, which requires entities to provide payment services as a regular occupation or in a professional capacity. After all, a company could have a predominantly commercial business but also provide ancillary payment services in a professional capacity.

Thus, the CJEU follows the AG in its conclusion that transfers of funds can be performed without being payment services, where such transfers are ancillary to a primary commercial service. In doing so, however, the CJEU arguably exceeds its role as a judicial body: it limits PSD2’s scope by weighing the burden of PSD2 compliance against the interest of businesses that transfer funds in an ancillary manner. It is principally for the legislature to make such assessments, and for the CJEU to apply and interpret PSD2 within the frame the legislature has set.

It appears that the CJEU might have sought to create a minimum threshold that a business involving transfers of funds must cross before coming within the scope of PSD2. After that threshold is crossed, the account servicing bank would be understood to provide payment services. Where exactly that threshold lies is, unfortunately, left unspecified.

The room offered by the CJEU for transferring funds in an ancillary manner should perhaps be effectuated through the interpretation of the elements of Service 3 discussed above. In that view, an entity would not be regarded as holding a payment account (or receiving payment orders in relation thereto) where it only effectuates transfers of funds in an ancillary capacity.

What this means in practice

The judgment is fact-bound, but it gives the practice three things to work with:

• First, entities that receive and pay on client funds as part of a wider commercial offering (e.g., escrow and quality-assurance providers) now have scope to argue that they do not provide payment services. That argument is at its strongest (a) where the fund flows are demonstrably subordinate to a distinct primary service, (b) where the accounts through which the funds pass are held and operated by a bank rather than by the entity itself, and (c) where, as here, the arrangement rests on an independent statutory footing. It is at its weakest where the transfer of funds is itself the product.
• Second, competent authorities that have taken a broad reading of PSD2 will need to revisit that approach. In the Netherlands, the judgment goes against a standing practice of broadly interpreting PSD2.
• Third, the CJEU declined to address “money remittance” services (Service 6), and an arrangement that escapes Service 3 may still be caught on that footing. Nor did the CJEU specify where the implicit “ancillary threshold” lies. Firms that are currently authorised, or in discussions with a supervisor for authorisation, should therefore treat the judgment as an argument to be tested with the competent authority – not as a licence to unwind an existing permission.