PRINCIPLES FOR FINANCIAL MARKET INFRASTRUCTURES Public ... of visa... · Visa Europe Public 1 of 31...

31
Visa Europe Public 1 of 31 PRINCIPLES FOR FINANCIAL MARKET INFRASTRUCTURES Public Disclosure of Visa Europe Internal Risk Review Self-Assessment submitted to the Bank of England (as authority overseeing Visa Europe) on: 19 August 2016 Disclaimer The information in this public disclosure of the Visa Europe Internal Risk Review is to the best of the knowledge of Visa Europe correct as of 30 June 2016. Visa Europe has made all reasonable efforts to ensure that information contained in this Disclosure Document is accurate as of the date of this disclosure but accepts no liability to any person for any errors or omissions that may be contained herein. For further information, please contact: Tel: +44 (0)20 7795 5777 (enquiries) or Tel: +44 (0)20 7937 8111 (switchboard) or E-mail: [email protected] This disclosure can also be found at: https://www.visaeurope.com

Transcript of PRINCIPLES FOR FINANCIAL MARKET INFRASTRUCTURES Public ... of visa... · Visa Europe Public 1 of 31...

Visa Europe Public 1 of 31

PRINCIPLES FOR FINANCIAL MARKET INFRASTRUCTURES

Public Disclosure of

Visa Europe Internal Risk Review

Self-Assessment submitted to the Bank of England (as authority overseeing Visa Europe) on: 19 August 2016

Disclaimer

The information in this public disclosure of the Visa Europe Internal Risk Review is to the best of the knowledge of Visa Europe correct as of 30 June 2016. Visa

Europe has made all reasonable efforts to ensure that information contained in this Disclosure Document is accurate as of the date of this disclosure but accepts no

liability to any person for any errors or omissions that may be contained herein.

For further information, please contact: Tel: +44 (0)20 7795 5777 (enquiries) or Tel: +44 (0)20 7937 8111 (switchboard) or E-mail: [email protected]

This disclosure can also be found at: https://www.visaeurope.com

Visa Europe Public 2 of 31

Table of Contents I | Executive Summary ........................................................................................................................................................................................................................ 4

II | Summary of major changes since the last update of the disclosure ...................................................................................................................................... 7

III | General background on the FMI ................................................................................................................................................................................................. 8

Introduction ....................................................................................................................................................................................................................................... 8

General organisation of the FMI .................................................................................................................................................................................................... 9

IV | Principle-by-Principle Narrative Disclosure – Summary ....................................................................................................................................................... 20

Principle 1: Legal Basis ................................................................................................................................................................................................................. 20

Principle 2: Governance ............................................................................................................................................................................................................... 21

Principle 3: Framework for the Comprehensive Management of Risks ................................................................................................................................ 21

Principle 4: Credit Risk .................................................................................................................................................................................................................. 22

Principle 5: Collateral .................................................................................................................................................................................................................... 22

Principle 7: Liquidity Risk .............................................................................................................................................................................................................. 23

Principle 8: Settlement Finality .................................................................................................................................................................................................... 24

Principle 9: Money Settlements ................................................................................................................................................................................................... 24

Principle 13: Participant-Default Rules and Procedures .......................................................................................................................................................... 24

Principle 15: General Business Risk ........................................................................................................................................................................................... 25

Principle 16: Custody and Investment Risks ............................................................................................................................................................................. 26

Principle 17: Operational Risk ..................................................................................................................................................................................................... 27

Principle 18: Access and Participation Requirements ............................................................................................................................................................. 28

Principle 19: Tiered Participation Arrangements ...................................................................................................................................................................... 29

Principle 21: Efficiency and Effectiveness ................................................................................................................................................................................. 29

Visa Europe Public 3 of 31

Principle 22: Communication Procedures and Standards ....................................................................................................................................................... 30

Principle 23: Disclosure of Rules, Key Procedures, and Market Data .................................................................................................................................. 30

Principles Not Applicable to Payment Systems ........................................................................................................................................................................ 31

Principles Not Applicable to Visa Europe ................................................................................................................................................................................... 31

Visa Europe Public 4 of 31

I | Executive Summary

Visa Europe Limited (“Visa Europe”) is a private limited company, incorporated in England and Wales, and is a fully owned subsidiary of Visa Inc.

which is a global payments technology company that connects consumers, businesses, financial institutions and governments in more than 200

countries and territories to ensure fast, secure and reliable electronic payments.

As a major provider of payment solutions, Visa Europe operates a proprietary network that facilitates the authorisation, clearing and settlement of

transactions through a processing platform for domestic and cross-border transactions in the Visa Europe territory. In this regard, Visa Europe’s

primary functions are to administer, operate, maintain and improve its payment system and programmes in which financial institution clients

participate, and to co-ordinate and regulate the participation of its clients in the payments system. Members herewith may also be interpreted as

Clients, as Visa Europe has gone through the process of updating relevant documentation to reflect its new ownership structure following

acquisition by Visa Inc. on 21 June 2016.

The services provided by Visa Europe enable merchant acquiring entities to connect with card issuing entities in a secure, efficient and reliable way,

so that they can authorise and settle electronic payments. Through Visa Europe's payment system, consumers (both individuals and businesses) are

able to purchase goods and services with payment cards (credit, debit, prepaid or similar payment cards) bearing the Visa trademarks; selling

merchants are able to receive confirmation that their consumers have sufficient funds on deposit or credit to make their purchases; and accounts

are settled among the payment service providers that issue the payment cards to consumers and make the payments to merchants. Pursuant with

EU Regulation 751/2015 on interchange fees for card based payment Transactions (Interchange Fee Regulation), since 9 June 2016 Visa Europe has

operated separate business units for Scheme and for Processing.

Visa Europe operates in a highly competitive market comprising a wide and diverse range of traditional and new payment options (including,

among others, MasterCard, American Express, PayPal, bank transfers and cash). This dynamic market continues to drive investment and innovation.

Against this dynamic market context, the regulatory framework for the payments industry is complex. Visa Europe welcomes the opportunity to

engage actively with its regulators, such as the Bank of England, and to assist in the development of its approach to the supervision of systemically

important payment systems.

Visa Europe Public 5 of 31

Recognition as a “payment system” for the purposes of the Banking Act 2009

By a recognition order dated 19 March 2015, HM Treasury categorised Visa Europe as a recognised “payment system” for the purposes of Part 5 of

the Banking Act 2009. As a result, the Bank of England has assumed oversight of Visa Europe pursuant to its statutory responsibility for the

oversight of designated payment systems and, more broadly, for monetary and financial stability. The Bank of England's supervisory regime in this

regard is framed by the CPMI-IOSCO1 Principles for “Financial Market Infrastructures” including securities settlement systems, central counterparties

and recognised payment systems such as Visa Europe. Of the 24 principles applicable to Financial Market Infrastructures, 17 are applicable to the

Visa Europe business.

Visa Europe has undertaken a rigorous and comprehensive internal assessment against the applicable principles and underlying key considerations.

This process included:

A review of the CPMI-IOSCO principles that apply to payment systems and the guidance published in the CPMI-IOSCO “Disclosure Framework

and Assessment Methodology”;

Previous meetings with the Bank of England to discuss its supervisory regime, how this applies to Visa Europe, the scope and applicability of the

principles to Visa Europe and insight into the operations and services provided by Visa Europe;

Regular meetings with the Bank of England related to the Bank of England’s supervision of Visa Europe;

Delegating responsibility for completing all aspects of the assessment to senior subject matter experts from across the Visa Europe business;

The consolidation and assessment of the responses provided by senior subject matter experts from across the Visa Europe business; and

Presenting the consolidated assessment against the principles to the Department Heads, Regulatory Committee and a panel of Members from

the Executive Leadership Team for comments and feedback prior to submission to the Chief Executive Officer of Visa Europe for approval and

sign-off.

1 Committee on Payments and Market Infrastructure (previously known as Committee on Payment and Settlement Systems (CPSS)) and Technical Committee of the International

Organization of Securities Commissions (IOSCO) published the Principles for Financial Market Infrastructures (PFMI). As noted in the PFMI, the main public policy objectives of the

CPMI and IOSCO in setting forth the principles were “to enhance safety and efficiency in payment, clearing, settlement, and recording arrangements, and more broadly, to limit

systemic risk and foster transparency and financial stability.”

Visa Europe Public 6 of 31

Visa Europe’s approach to regulatory policy is based on building constructive and collaborative relationships with regulators. Visa Europe is

committed to working with regulators to ensure that the payments market is a level playing field that delivers efficient, secure and innovative

payment solutions across the economy. Visa Europe’s corporate strategy is built on the vision of being at the heart of the payments ecosystem,

working in partnership with financial institutions, merchants and new industry partners to drive innovations that enable faster, simpler and more

secure payments globally.

The purpose of the self-assessment or Internal Risk Review (IRR) is to present to the Bank of England details of the risks that impact on Visa

Europe's business, how Visa Europe identifies and mitigates those risks, and to describe Visa Europe's adherence to the CPMI-IOSCO principles and

key considerations as these apply to Visa Europe's business. As agreed with the Bank of England, the content of the IRR and this public version

thereof is as of 30 June 2016.

Visa Europe Public 7 of 31

II | Summary of major changes since the last update of the disclosure

Following Visa Europe’s first assessment against the CPMI-IOSCO Principles in 2015 as a designated payment system, Visa Europe’s 2016 IRR has

been updated to reflect changes associated with:

The acquisition of Visa Europe by Visa Inc. on 21 June 2016;

The 2015 Internal Risk Review;

Requirements under EU Regulation 751/2015 on interchange fees for card based payment Transactions, including the required separation of

payment card schemes and processing entities under Article 7(6); and

Other commercial decisions, including the decommissioning of V.me by Visa.

Visa Europe Public 8 of 31

III | General background on the FMI

Introduction

Prior to Visa Inc.’s 2007 reorganization, Visa operated as a collection of member-owned associations, with each region serving its member financial

institutions and administering Visa programs within a global framework. In 2007, Visa reorganized, with all of the regions except Visa Europe

coming together to form Visa Inc., a Delaware corporation. Visa Europe remained owned by its European member financial institutions.

Visa was established in the United States in 1976 following all licensees of BankAmericard – the first credit card facilitating electronic payments –

uniting as an independent entity under a common global brand: Visa.

Visa Europe was incorporated in 2004 as a private limited liability company, a regional group member of the Visa International group of companies.

Following the 2007 reorganization of Visa Inc. in connection with its 2008 listing on the New York Stock Exchange, Visa Europe became a licensee of

Visa Inc., but remained owned by its European member financial institutions. Visa Europe has a perpetual irrevocable exclusive licence to operate

the Visa business within the Visa Europe territory. Although the two organisations, Visa Europe and Visa Inc., were separate and independent, they

are united by a common global brand. The two organisations, in partnership, ensured Visa’s integrity, interoperability, reliability and the security of

products and systems. The relationship between Visa Inc. and Visa Europe is governed by a series of agreements entitled the “Definitive

Agreements”: these agreements were put in place at the time of the separation of the two organisations. Visa Europe’s shareholders were its

Members.

On 21 June 2016 Visa Europe became a wholly owned subsidiary of Visa Inc. with strong local empowerment, offering customers, cardholders and

merchants the opportunity to conduct transactions using a globally interoperable, secure and efficient payment system.

Visa Europe Public 9 of 31

General organisation of the FMI

Structure and Governance

Visa Europe offers payment technology services to its Members, banks and payment providers across 382 markets that make up the Visa Europe

territory (which includes the EEA countries and Israel, Switzerland and Turkey). Visa Europe is fully owned by Visa Inc. Visa Europe Members are

Issuers and/or Acquirers who have a licence to offer Visa branded payment solutions to their respective Customers. The Visa Europe Limited Board

has the power to delegate authority to a subset of committees and to the Visa Europe Executive Leadership Team (ELT).

Each entity applying for membership must meet the eligibility criteria outlined in the Visa Europe Membership Regulations. Applicants entering into

a membership agreement with Visa Europe agree to comply with the Visa Europe Membership Regulations, the Visa Europe Operating Regulations

(VEOR), and the Fee Guide. As of 9 June 2016, and pursuant with the required separation of Scheme and Processing under Article 7 of the

Interchange Fee Regulation, Visa Europe now has two separate sets of VEOR, one for Scheme and another for Processing.

Visa Europe is currently working with stakeholders to implement a governance structure that forms part of a global organisation but also has a

strong sense of local empowerment within the Visa Europe region, supporting stakeholder stability objectives for local economies. The following

governance structure, which became effective on 21 June 2016, is currently in place. It is reflective of Visa Europe’s continuous aim to meet evolving

regulatory and stakeholder needs, as well as changing as required to align with market developments.

Visa Europe Board

Subject to the terms of the Visa Europe Membership Regulations, the Visa Europe Board is the organisation’s most senior governance body. The

Visa Europe Board retains decision-making authority with respect to Visa Europe matters, pursuant to Visa Europe’s requirements as a Bank of

England designated entity. It is responsible for taking decisions on strategy, finance, risk, corporate governance, legal and regulatory matters and is

2 The 38 markets are as follows: Andorra, Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark (including Faeroe Island and Greenland), Estonia, Finland, France

(including DOM-TOMs), Germany, Greece, Hungary, Iceland, Ireland, Israel, Italy, Liechtenstein, Latvia, Lithuania, Luxembourg, Malta, Monaco, Netherlands, Norway (including Bear

Island), Poland, Portugal , Romania, San Marino, Slovak Republic, Slovenia, Spain, Sweden, Switzerland, Turkey, United Kingdom (including the Channel Islands, Gibraltar and the Isle

of Man), Vatican City State

Visa Europe Public 10 of 31

comprised of six members, two non-executive directors (representing Visa Inc., one of whom is currently the chair of the Visa Europe Board), two

Visa Europe executive directors (Chief Executive Officer (CEO) and Chief Financial Officer (CFO)), and two independent non-executive directors.

The Visa Europe Board delegates certain decision-making responsibilities to the following:

The Risk, Audit and Finance (RAF) Committee; and

The Executive Leadership Team (ELT).

Board Committees

Board Committees have delegated authority from the Board.

Risk, Audit and Finance Committee – subcommittee of the Visa Europe Board from which it derives authority and to whom it reports; this

Committee endorses and provides oversight of Visa Europe’s risk appetite and controls to ensure that risks are managed so that they remain

within acceptable levels.

Executive Leadership Team

The Executive Leadership Team (ELT) is Visa Europe’s most senior internal decision-making body. It reports to the Visa Europe Board and has

delegated responsibility for operational matters through its CEO. It reports to the Board through the CEO.

Management Committees

The following committees, advisory groups and steering groups are responsible for providing the ELT with oversight and guidance in respect of

direction, strategy and approach for their respective areas of focus:

Seven committees (the Compliance Committee, Risk Committee, the Investment Committee, the European and National Regulatory

Committee and Committee’s relevant to each business unit (Scheme/Processing/Innovation)), which have delegated authority from the ELT;

Three advisory groups (the Risk, Control and Compliance Advisory Group, the Health, Safety and Environment Advisory Group, and the

Pricing and Interchange Advisory Group), which make recommendations to the various committees;

One steering group (the IT Steering Group), which monitors implementation and guides project taskforces.

Visa Europe Products and Services

Visa Europe is responsible for the European operations of a global payment network that connects consumers, businesses, financial institutions and

governments to innovative, globally accepted, secure and reliable electronic payments. Visa Europe provides members with access to tools,

Visa Europe Public 11 of 31

products and platforms that enable members to offer their customers a range of global, competitive and innovative payment solutions. Visa Europe

operates a globally interoperable processing network that authorises, clears and settles transactions quickly and securely.

The four parties involved in the payment processing are the issuer, acquirer, cardholder and merchant. Visa Europe facilitates the processing of the

transaction, which consists of an authorisation request, an authorisation response (collectively, “Authorisation”), clearing and settlement. Each of

these processes is described in further detail below in the diagram which sets out the role of each party within a Visa Europe transaction.

No Processing Mandate and Separation of Scheme and Processing

It is important to note that, in accordance with the requirements under the SEPA Cards Framework issued by the European Payments Council, Visa

Europe does not have a mandate regarding the processing of Visa Europe’s transactions. Accordingly, Members are free to use the services of

Visa Europe Public 12 of 31

processing companies different from Visa Europe and this is reflected in market behaviour. As of 9 June 2016, the mandate to separate the scheme

from the processing services became a legal requirement for all payment systems active in the EU, including Visa Europe, pursuant to EU Regulation

751/2015 on interchange fees for card based payment transactions (Interchange Fee Regulation).

Visa Europe Operating Regulations Framework

There are two separate sets of Visa Europe Operating Regulations (VEOR), which form part of each Member’s contractual agreement with Visa

Europe. Firstly, the VEOR – Scheme, is a set of scheme rules which set out the framework under which Members are required to operate with the

scheme business unit. Secondly, the VEOR – Processing sets out the framework under which Members are required to operate with the processing

business unit. They collectively define the precise way in which Visa cards must work, the manner in which payments should be processed, and the

roles and responsibilities of each participant in a transaction.

A Member’s adherence to the VEOR ensures system interoperability and provides assurance to the four participants (issuer, acquirer, cardholder

and merchant) that an electronic payment transaction involving a Visa payment card with wide acceptance globally and across different merchants,

will be processed by Visa in compliance with appropriate security requirements and with a high degree of reliability; that the transaction will be

successfully completed and that funds will be appropriately transferred.

Visa Europe also operates compliance programmes, as well as liability shifts and fines/fees for non-compliance, to monitor and prevent excessive

fraud. These initiatives incentivise Member compliance with payment industry standards (such as PCI DSS), while the adoption of new technologies

(such as Chip and PIN and Verified by Visa, which is an authentication method used to verify the identity of a cardholder for transactions occurring

in an e-commerce environment) are intended to increase the security of transactions and prevent fraud.

Payment Platforms

Visa Europe provides its Members with efficient, secure and reliable processing services. The core services offered by Visa Europe comprise:

Visa Europe Authorisation Service (VEAS)

Real-time service that routes and processes payment authorisation transactions.

Visa Europe Clearing and Settlement Service (VECSS)

Batch service that manages the clearing and settlement of transaction-related funds between Visa Europe's Members.

Visa Europe Exchange Rates Application (VERA)

The service that manages the exchange rates applied in Visa Europe’s systems.

Visa Europe Public 13 of 31

Regional Network Infrastructure (RNI)

The network that links Visa Europe and its Members banks (and their processors).

This includes Extended Access Servers (EAS) which are Visa Europe delivered end points deployed in Members’ data centres.

Payment Tools

Visa Europe offers the following payment tools which Members may offer to their cardholders to facilitate payments:

Card payments – facilitates payments of transactions using a Visa card;

Contactless – facilitates face-to-face transactions to be conducted over a wireless interface;

Mobile contactless – facilitates the use of mobile phones to conduct contactless transactions;

Premium card payments – a range of premium products designed to offer higher spending cardholders more flexible spending limits and

controls, and a greater selection of benefits and offers;

Visa personal payments – facilitates cardholders using their mobile phone to transfer funds from their own account to another cardholder’s

account.

Payment Products

Visa Europe offers the following payment card products, each with associated service features through which a Member provides payment services

to cardholders:

Business

Visa business cards give the owners of small businesses control and flexibility to better manage their professional expenses and the flow of

payments in and out.

Commercial

Visa company cards enable organisations to exercise control over who can make purchases and with which supplier, and how much can be

spent.

The product enables organisations to easily track, manage and analyse expenditure.

Visa Europe Public 14 of 31

The product features an ordering and payment tool that allows organisations to make purchases in a variety of ways, whether at home,

abroad or online.

Credit

The range of credit card products offered helps issuers give their customers what they want: flexibility, convenience, safety and control.

Repayments can be spread over a period of time so cardholders can adapt their outgoings to changes in their monthly financial position.

This also provides reassurance for people using their card abroad or buying online.

The diverse number of available products means customers can find the credit card best suited to their needs. Features include loyalty

reward schemes, cashback, air miles, retailer offers, or simply a low interest rate.

Debit

Debit cards provide consumers with immediate, anytime access to their money.

Debit cards enable Members to introduce innovative targeted and tailored debit products which can be used across more channels, more

often. Visa Europe helps Members to drive card activation and usage rates with new portfolio management disciplines and helps to create

debit-based loyalty programmes.

Prepaid

Prepaid cards are pre-loaded with a set amount of money, offering cardholders convenience, security and control.

Instead of being linked to a bank account or providing a line of credit, a prepaid card is used to access funds in a prepaid account or one

where monetary value is stored on a chip.

Depending on the option chosen, a Visa prepaid card can be either disposable (like a gift voucher it can be used until spent, then thrown

away) or re-loadable (like a prepaid mobile phone account, which can be topped up and re-used).

V PAY

V PAY is a chip-only, PIN based, European debit product that meets the needs of European banks by using EMV chip technology.

Visa Europe Public 15 of 31

Virtual Cards

Virtual cards are usually prepaid and are designed specifically for use via the internet, over the phone or by mail, so the applicant does not

receive a physical plastic card. Usually the issuer provides them with details of a card account, such as the number, expiry date, security code

etc., which can then be used to make purchases.

In the commercial space virtual cards do not have to be personalised, but they may be issued to a company and can be used for purchases

of goods and services in the card not present environment. The cards can be issued as either prepaid or charge/credit cards. They work in a

similar way to a physical plastic card.

Training and Consultancy Services

Visa Europe provides training and consultancy programmes to its Members, covering the fundamentals of the payment business – transaction

processing, fraud prevention, and risk management – in order to support Members in understanding the industry, and to educate them in how to

reduce risk by preventing fraud.

Due to the vast footprint of data it processes, Visa Europe can provide its Members with statistical fraud models. These models can be used to

power fraud detection services for issuers by using risk-based authentication and fraud detection technologies.

By offering a range of different payment products, tools and services which continue to be developed and improved, Visa Europe offers its

Members, large and small, the flexibility to choose from a variety of effective and innovative payment solutions and services appropriate to their

business. This contributes to increasing the payment options available to consumers and retailers, as well as improving the security and efficiency of

payments.

Markets served and the role of Visa Europe

Visa Europe serves banks and payment providers across 38 markets that make up the Visa Europe territory (which includes the EEA countries and

Israel, Switzerland and Turkey).

Each country forms part of one of seven regions: UK and Ireland, Central Europe, Central Eastern Europe, France, Southern Europe, South Eastern

Europe and the Nordics and Baltics.

Although each market will have a unique set of requirements, Visa Europe will work closely with each Member to understand their needs and to

support them in adopting and implementing the products, tools and platforms suitable to help them achieve their requirements and business

objectives. Members thereby benefit from the services, expertise and infrastructure that Visa Europe has acquired over the years.

Visa Europe Public 16 of 31

Performance and Reliability

Visa Europe’s processing systems perform a business critical function for Visa Europe, as well as for its Members and for those businesses that

accept Visa. Any sustained interruption in availability or reliability would have a significant commercial reputational impact for Visa Europe and its

Members.

The availability (and quality) of Visa Europe’s processing services are therefore under constant review, and is one of the most important key

performance indicators. It features prominently on Visa Europe’s scorecard, and is reviewed at every Visa Europe Board meeting.

Risk Management

Visa Europe has an Enterprise Risk Management Framework and methodology to enable the management of all risks that may prevent Visa Europe

from achieving its business objectives.

There are four main categories of risk which Visa Europe seeks to mitigate:

Business, operational and regulatory risk

Protecting the integrity and maintaining the availability of all key Visa Europe operations and services.

Membership, settlement and liquidity risk

Ensuring that Visa Europe and its membership are always able to meet settlement obligations, as well as protecting Visa Europe from

potential reputational risk exposures.

Payment system risk

Assessing, monitoring and policing the integrity of Visa Europe, Member and third party-owned acceptance, and processing infrastructures

against operational and reputational risk exposures.

Fraud-related risk

Guarding against criminal attack and minimising the related financial losses and reputational impacts.

Visa Europe uses an Enterprise Risk Management Framework to identify, assess, measure, report and manage all types of risk, and to align risk

management with its pre-defined business strategy and risk appetite.

Visa Europe Public 17 of 31

The ongoing development of the Enterprise Risk Management Framework is a company-wide initiative, involving all business units, functions and

departmental heads (who participate in workshops to identify risk exposures and agree mitigating actions). Under delegated authority from the ELT,

the process is governed by the Risk Committee, which meets at regular intervals throughout the year.

All significant risk exposures and mitigating actions are routinely reported to the RAF Committee of the Visa Europe Board. As well as reviewing

progress, this Committee agrees on Visa Europe’s risk appetite, tolerance and capacity levels and makes policy decisions about future controls. As

an additional control measure, the Enterprise Risk Management Framework and related policies are scrutinised by Visa Europe’s internal auditor

(PricewaterhouseCoopers).

Each year, KPMG LLP issues an ISAE 3402 Assurance Report covering the control environment on relevant systems in the UK and France that govern

the financial transactions.

Visa Europe also ensures that all processes and systems comply fully with the Payment Card Industry Data Security Standard (PCI DSS) and, as part

of its related compliance programmes, a series of continuous testing regimes are aligned to Visa Europe’s ongoing risk management improvement

programme.

Settlement Risk

In order to guarantee the integrity of Visa Europe’s payment system, Visa Europe assumes ultimate responsibility for settlement obligations for

transactions accepted by Visa Europe Members under the rules for settlement, as set out in the VEOR – Scheme.

To mitigate risks associated with a Member being unable to fulfil its settlement obligations, Visa Europe has an expert Member risk function and

utilises a range of risk management tools to monitor and control the risk. These include risk reviews for all new membership applications and the

ongoing monitoring of all Member and country risks.

Legal Framework

Visa Europe operates a four-party payment system that provides the brand, systems, services and rules to facilitate electronic payments between

millions of European consumers, businesses and governments.

Visa Europe operates in 38 markets that make up the Visa Europe territory (which includes the EEA countries and Israel, Switzerland and Turkey),

and is incorporated in England as Visa Europe Limited, under the Companies Act 2006. Visa Europe operates and is governed by its Articles of

Visa Europe Public 18 of 31

Association. Members of Visa Europe are issuing and/or acquiring payment service providers. Typically, Visa Europe does not have a direct

relationship with any cardholders or merchants; it is the issuing and acquiring Members of Visa Europe that have contractual relationships with

cardholders and merchants.

The obligations and liabilities of Members towards Visa Europe and other Members of the payment system are set out in the Visa Europe

Membership Regulations and the VEOR. Members of Visa Europe are obliged to comply with all such Visa Europe regulations.

Regulatory Framework

Visa Europe is a leading Europe-wide provider of payment solutions. It operates Visa’s global payment network in the Visa Europe territory,

facilitating the authorisation, clearing and settlement of credit and debit card transactions. As such, Visa Europe’s activities and those of its

Members in the payment area are subject to relevant European and national legislation in addition to Bank of England oversight;

The Interchange Fee Regulation (IFR)

The 2015/751/EC Regulation on interchange fees for card-based payment Transactions (IFR) entered into force on 8 June 2015. The regulation

contained wide-ranging legislation, including capping cross-border interchange fees as of December 2015 and requiring the separation of the

scheme and processing entities from 9 June 2016.

The Payment Services Directive (PSD) and revised Payment Services Directive (PSD2)

In December 2015 the revised Payment Services Directive (PSD2) was published and entered into force on 13 January 2016. Member states will have

to implement the Directive by January 2018, replacing the 2007/64/EC Payment Services Directive (PSD). The PSD2 will change, amongst other

things, rules for the access to payments, surcharging, and how to authenticate Cardholders. Both PSD2 and the IFR are expected to alter the ways in

which card payment systems and Payment Service Providers operate.

It also includes several other regulations, notably the 2009/110/EC e-Money Directive, 924/2009 Cross-border Payments Regulation and 1781/2006

Information on the payer accompanying transfers of funds directive. Visa Europe will continue to monitor the possible regulatory implications

following the Brexit vote, and to adapt our regulatory framework accordingly.

Visa Europe is also subject to regulatory oversight by European and national regulatory bodies. In addition to the Bank of England, this includes the

European Central Bank (ECB) and the Eurosystem of national central banks, and the UK Payment Systems Regulator (PSR).

Visa Europe Public 19 of 31

UK Payment Systems Regulator (PSR)

As of 1 April 2015, Visa Europe is subject to the oversight of the PSR. The PSR is tasked with supervising payment systems to ensure that they are

governed, operated and developed in a way that considers and promotes the interests of users and consumers, as well as promoting effective

competition and innovation.

ECB and Eurosystem Oversight

As of 2008, Visa Europe is subject to the oversight of the ECB and the Eurosystem of national central banks against the Oversight Framework for

Card Payment Schemes – Standards (2008). Visa Europe has been assessed against these oversight standards and a final assessment report was

sent to Visa Europe in June 2014. The findings concluded that the Visa Europe Scheme was, in the most part, fully compliant with the oversight

standards.

The ECB since extended the scope of its oversight framework and as such Visa Europe was required to undertake an assessment against these

additional standards during 2016 and currently awaits feedback from the ECB.

Visa Europe’s approach to regulatory policy is based on building constructive and collaborative relationships with regulators. We are committed to

working closely with regulators to deliver an efficient, secure and innovative payments market across the economy. Visa Europe’s corporate strategy

is built on the vision of being at the heart of the payments ecosystem, working in partnership with financial institutions, merchants and new

industry partners to drive innovations that enable faster, simpler and more secure payments globally.

Visa Europe Public 20 of 31

IV | Principle-by-Principle Narrative Disclosure – Summary

Principle 1: Legal Basis

An FMI should have a well-founded, clear, transparent, and enforceable legal basis for each material aspect of its activities in all relevant

jurisdictions.

Visa Europe is a private limited company registered in England and Wales and is a wholly owned subsidiary of Visa Inc. as of 21 June 2016. Visa Inc.

is a global payments technology company that connects consumers, businesses, financial institutions and governments in more than 200 countries

and territories to ensure fast, secure and reliable electronic payments.

The Visa Europe Membership Regulations and the VEOR for Scheme and for Processing, which Members are required to comply with and adhere

to, have resulted in there being a high degree of legal certainty between Members about their respective obligations and responsibilities, including

their obligations in the event of any default. The system devised is capable of being enforced by Visa Europe and provides a strong legal basis for

its activities.

Visa Europe now publishes two versions of the VEOR, one for Scheme and one for Processing, at intervals throughout the year, in order to operate

clearly and transparently in the Visa Europe territory. Prior to publication, the operating regulations are amended in accordance with business and

legal requirements. Both sets of the VEOR are reviewed on a regular basis throughout the year and updates may be communicated to Members via

the publication of a Member Letter or Visa Business News. As such, the legal framework of Visa Europe is constantly tested for its consistency,

robustness and relevance.

Visa Europe has a strong legal function which is backed by external legal support across the Visa Europe territory and Visa Inc. Legal function which

can support if required. Detailed advice was obtained prior to the creation of Visa Europe's legal framework and this advice is reviewed on a regular

basis, with particular consideration given to identifying and resolving any conflict of law issues. Advice is always obtained prior to launching new

products. Visa Europe interacts with national regulators and the EU institutions on a regular basis, and takes account of, and complies with,

applicable local requirements.

Visa Europe Public 21 of 31

Principle 2: Governance

An FMI should have governance arrangements that are clear and transparent, promote the safety and efficiency of the FMI, and support

the stability of the broader financial system, other relevant public interest considerations, and the objectives of relevant stakeholders.

Visa Europe maintains clear and transparent governance arrangements and objectives based on a governance structure with three distinct

elements: board level, internal and local market governance.

Visa Europe’s strategy recognises that risk management is a key element of the organisation’s culture to ensure the stability of the Visa Europe

payment system, and the UK financial system as a whole. Its overall strategic risk framework has been developed in line with the standards and

guidance published by the Committee of Sponsoring Organisations of the Treadway Commission (COSO). The risk framework is an enterprise-wide

initiative involving all divisional and departmental stakeholders to ensure the safety and efficiency of the Visa Europe payment system for its

Members and other relevant stakeholders.

To ensure the transparency of its governance arrangements and that Members have a sound understanding of their rights and obligations, Visa

Europe discloses its rules and VEOR to its Members in a clear and regular manner. Visa Europe also discloses information to the public, such as the

interchange fees of the Visa Europe territory, its operating regulations, and its eligibility criteria for becoming a Member.

Visa Europe considers that its governance arrangements are robust and effective in safeguarding Visa Europe’s ability to deliver a reliable, secure,

effective and innovative card payment services for its Members and their customers. In addition, Visa Europe is committed to keeping its

governance arrangements under constant review to ensure that its arrangements remain effective and transparent to all stakeholders as market

conditions develop over time.

Principle 3: Framework for the Comprehensive Management of Risks

An FMI should have a sound risk-management framework for comprehensively managing legal, credit, liquidity, operational, and other

risks.

Prudent risk management is a central feature of Visa Europe’s systems and controls. Visa Europe has established risk management systems which

identify and rate different categories of risk. Visa Europe’s risk assessment and risk tolerance are regularly assessed with individual Members of the

Visa Europe Public 22 of 31

senior management team and are subjected to regular reporting and scrutiny by the board. The risk assessment process is reviewed on a regular

basis and there is a detailed internal infrastructure for managing all risks and for dealing with above tolerance risks.

The Enterprise Risk Management Framework addresses settlement risk and fraud management and ensures that the systems Visa Europe deploys

are robust and reliable. Visa Europe also focusses on the systemic risks that can arise from relationships between acquirers, issuers, merchants and

other entities.

Visa Europe has detailed business continuity plans and processes. The plan is constantly reviewed and updated by all key stakeholders across the

business to ensure that if a force majeure event occurred, the business can continue to operate seamlessly to provide services in order to ensure

the stability of the Visa Europe system and minimise disruption to the wider financial community.

Principle 4: Credit Risk

An FMI should effectively measure, monitor, and manage its credit exposure to participants and those arising from its payment, clearing,

and settlement processes. An FMI should maintain sufficient financial resources to cover its credit exposure to each participant fully with a

high degree of confidence.

Visa Europe uses a detailed risk rating system to assess all Members and in particular credit exposure to institutions on a Member-by-Member

basis. The risk rating system also takes into account the risks associated with each jurisdiction in which a Member operates as well as other factors.

The risk rating system is reviewed on an annual basis.

Visa Europe holds financial resources to mitigate its financial exposure and has robust systems in place to recover amounts that have not been

settled by Members.

Principle 5: Collateral

An FMI that requires collateral to manage its or its participants’ credit exposure should accept collateral with low credit, liquidity, and

market risks. An FMI should also set and enforce appropriately conservative haircuts and concentration limits.

Visa Europe accepts only cash, guarantees and irrevocable standby letters of credit as collateral.

Visa Europe Public 23 of 31

Guarantees and irrevocable standby letters of credit are only accepted where there have been pre-existing arrangements with existing Members. In

such circumstances, the credit exposure is monitored on a quarterly basis by Visa Europe. If additional financial requirements are assessed by Visa

Europe, then any such request must be satisfied by the Member within two months of a request being made. In addition, credit reviews of

guarantors and issuers of irrevocable standby letters of credit are conducted annually.

Due to the nature of the financial safeguards, “haircuts” are not applied to collateral held by Visa Europe.

Collateral held in the form of cash is invested by Visa Europe in highly rated and highly liquid money market funds and is available on a same day

basis. Collateral from each Member is held in a segregated account specific to that Member and all interest belongs to that Member. Collateral is

not reused by Visa Europe.

Principle 7: Liquidity Risk

An FMI should effectively measure, monitor, and manage its liquidity risk. An FMI should maintain sufficient liquid resources in all

relevant currencies to effect same-day and, where appropriate, intraday and multiday settlement of payment obligations with a high

degree of confidence under a wide range of potential stress scenarios that should include, but not be limited to, the default of the

participant and its affiliates that would generate the largest aggregate liquidity obligation for the FMI in extreme but plausible market

conditions.

Visa Europe’s liquidity risk primarily arises as a result of the net settlement of card based transactions and represents the risk that a Member in a net

issuing position fails to meet its settlement obligations in a timely manner. Visa Europe’s settlement systems operate on the principle of

simultaneous settlement for debit and credit positions, where possible. In the UK, settlement occurs through the Bank of England. In some other

countries, commercial settlement agent banks are used. Settlement through central bank settlement systems reduces intraday liquidity risks that

may arise where commercial settlement banks are used, and where debits and credits may occur at different points throughout the working day.

Visa Europe calculates its liquidity requirements based upon the largest exposure it could encounter should the largest net issuer fail to settle in the

event of systems failure or insolvency. In order to cover this position, Visa Europe holds sufficient liquid assets to ensure settlement would complete

on the due value date.

Visa Europe Public 24 of 31

Stress testing is used to assess Visa Europe’s liquidity requirements and the quality of the planned liquid resources. This is assessed annually as part

of Visa Europe’s Internal Liquidity Adequacy Assessment (ILAA).

Principle 8: Settlement Finality

An FMI should provide clear and certain final settlement, at a minimum by the end of the value date. Where necessary or preferable, an

FMI should provide final settlement intraday or in real time.

Visa Europe operates a net settlement system on a batch processing basis; it does not operate on a real time settlement basis. Irrevocable payment,

in immediately available funds, of an amount due in respect of a settlement obligation discharges the settlement obligation to the extent of the

irrevocable payment made. The VEOR acknowledges and describes the obligations between Visa Europe and its Members including the discharge

of payment. VEOR provides the framework for the settlement process.

Principle 9: Money Settlements

An FMI should conduct its money settlements in central bank money where practical and available. If central bank money is not used, an

FMI should minimise and strictly control the credit and liquidity risk arising from the use of commercial bank money.

Visa Europe settles using central bank accounts wherever possible. In some circumstances however, commercial banks need to be used as neither

Visa Europe nor its Members have direct access to all relevant central bank accounts or it is not practical to use central bank accounts due to the

multi-currency or cross-border nature of a settlement service.

Where it is not possible or practical to effect settlement using central bank money, settlement is made in cash assets using settlement banks

selected on the basis of their credit standing, security and operational effectiveness. This is to minimise credit and liquidity risk. Commercial banks

are regularly reviewed to ensure their continued creditworthiness, and this is monitored by Visa Europe through regular reporting of transaction

volumes through settlement accounts.

Principle 13: Participant-Default Rules and Procedures

An FMI should have effective and clearly defined rules and procedures to manage a participant default. These rules and procedures should

be designed to ensure that the FMI can take timely action to contain losses and liquidity pressures and continue to meet its obligations.

Visa Europe Public 25 of 31

Visa Europe has systems in place to identify possible Member defaults, as well as clear rules and procedures that require each Member to indemnify

it against losses, claims, damages, costs or expenses that may arise as a result of the Member being unable to meet its settlement obligations. As

described above in respect of Principles 4 and 5, Visa Europe uses a detailed risk rating system to assess all Members and in particular credit

exposures to institutions, on a Member-by-Member basis. Consequently, some Members are required to provide cash or other collateral in certain

circumstances. The VEOR – Scheme covers settlement obligations. A redacted version of the operating regulations is available to the public on

request. All Members have access to full copies of the VEOR via Visa Online (VOL).

Where a Member does not meet its settlement obligations, Visa Europe engages with the Member to understand the cause of the failure to settle

and to arrange payment of outstanding settlement funds. If a Member is clearly unable to meet its financial obligations, Visa Europe will use the

cash and other collateral that it holds to meet the Member’s settlement obligations.

Visa Europe also has the power to suspend Member access to all or part of any element of the Visa Europe system in order to stop any further

transactions from taking place in relation to a defaulting Member. Where appropriate, Visa Europe will notify relevant regulators and central banks

and, in the event that any cash or other collateral held is insufficient to cover the amount lost, Visa Europe will fund settlement monies to be paid to

eligible end-users, and will liaise with the Member to agree reimbursement. Where appropriate, Visa Europe will engage administrators to obtain

reimbursement of outstanding funds.

In the event of a default, the Visa Europe ELT agrees appropriate action on a timely basis. Member defaults with the Visa Europe system are rare

events. There have been no involuntary terminations of UK members as a result of financial concerns within the past 5 years. Visa Europe has

controls in place to mitigate the risks raised by Member default.

Principle 15: General Business Risk

An FMI should identify, monitor, and manage its general business risk and hold sufficient liquid net assets funded by equity to cover

potential general business losses so that it can continue operations and services as a going concern if those losses materialise. Further,

liquid net assets should at all times be sufficient to ensure a recovery or orderly wind-down of critical operations and services.

Visa Europe has several governance bodies that are responsible for identifying and managing risk within Visa Europe. At the Board level, there is a

Risk, Audit and Finance Committee comprising directors from the Visa Europe Board. This Committee meets at least three times a year. Internal and

external auditing teams both report into this committee independently.

Visa Europe Public 26 of 31

At the business operational level, Visa Europe has a Risk and Compliance Division, headed up by the Chief Officer of Risk and Compliance. This

division manages and leads the Risk and Compliance Committee, monitors risk and compliance, and ensures that Visa Europe mitigates risk

wherever possible. The Archer system, a risk management tool accessible to all key staff and which currently has approximately 500 risks listed, is a

mechanism by which Visa Europe monitors and manages identified risks.

The Chief Financial Officer is ultimately responsible for ensuring there is adequate liquidity in the company. This includes measuring cash flow

exposure, executing investment strategies and monitoring the positions regularly through management reporting. Visa Europe also holds financial

resources against its operational risk in the form of net liquid assets on its balance sheet.

Visa Europe ensures that all risk management procedures that underpin its operations are solid, reliable and thorough, and that sufficient financial

resources are held to support Visa Europe’s risk appetite.

Principle 16: Custody and Investment Risks

An FMI should safeguard its own and its participants’ assets and minimise the risk of loss and delay in access to these assets. An FMI’s

investments should be in instruments with minimal credit, market and liquidity risks.

Visa Europe holds most of its liquid assets in cash. Visa Europe’s investment strategy is set out within the Treasury Policy that governs the

regulation of both Visa Europe’s own, and its Members’, cash assets. Credit, duration and concentration limits are all documented in this policy.

These limits are monitored continuously and reported on a monthly basis.

Minimum ratings standards must be met for all investment counterparties. Ratings are reassessed at least annually, with external ratings

continuously monitored and reported.

Cash held as Member collateral is subject to the same rules, except insofar as concentration limits are adjusted to reflect that all Member funds are

unlikely to be liquidated on the same day.

Visa Europe Public 27 of 31

Principle 17: Operational Risk

An FMI should identify the plausible sources of operational risk, both internal and external, and mitigate their impact through the use of

appropriate systems, policies, procedures, and controls. Systems should be designed to ensure high degree of security and operational

reliability and should have adequate, scalable capacity. Business continuity management should aim for timely recovery of operations and

fulfilment of the FMI’s obligations, including in the event of a wide-scale or major disruption.

Visa Europe has adopted an effective Enterprise Risk Management Framework to identify, assess, measure, report and manage all types of risks,

both internal and external.

This framework is designed to align Visa Europe’s risk management with its business strategy and risk appetite. The risk appetite, endorsed by the

Visa Europe Board, provides a framework for Visa Europe to operate, sets boundaries for risk taking, supports strategy setting and risk

management, and also sets and manages stakeholders’ expectations.

Visa Europe has an Enterprise Governance Risk and Compliance system, through which all identified operational risks are documented and

managed.

The Visa Europe Board makes all major decisions regarding Visa Europe strategy, finance, risk, corporate governance, legal and regulatory matters,

including approval of the risk appetite. In addition, risk exposures and mitigating actions are reported to the Risk, Audit and Finance Committee of

the Visa Europe Board. This committee consists of Visa Europe Board representatives, and its principal purpose is to provide oversight and advice to

the Board on the current risk exposures of Visa Europe. The committee also reviews Visa Europe’s accounting policies and future risk strategy.

Visa Europe has a fast and reliable processing platform in place. In support of this platform is a comprehensive and robust set of policies that deal

with threats to the organisation from an internal and an external perspective including, for example, physical security, information security,

accidents or cyber-security. These policies ensure that known or suspected threats do not impact Visa Europe’s operational reliability.

Visa Europe proactively monitors, analyses, models, optimises and initiates capacity-based changes to ensure that it meets increasing stress

volumes. Visa Europe has invested in two state-of-the-art data centres designed to operate independently; they have been specifically designed to

accommodate Visa Europe’s high transaction volumes, even during peak situations. Visa Europe’s business continuity plans are reviewed, updated,

approved and exercised (where appropriate) at least once a year.

Visa Europe Public 28 of 31

Visa Europe has a Business Continuity program that sets forth a list of processes that govern Visa Europe’s risk assessment, business impact

analysis, business continuity planning, exercising and testing. Across all areas of the business, Visa Europe conducts risk assessments and analyses

aimed at reducing those impacts, while supporting the continuation and timely recovery of critical assets, systems, services and business functions.

Visa Europe has set up a program through which risks posed by our Members are identified and mitigated through financial safeguards. In addition,

all external suppliers of Visa Europe are subject to comprehensive scrutiny documented in Visa Europe’s corporate supplier due diligence process.

Visa Europe ensures the rigorous application of a multi-faceted approach to operational risk management in order to maintain the stability and

integrity of its systems.

Principle 18: Access and Participation Requirements

An FMI should have objective, risk-based, and publicly disclosed criteria for participation, which permit fair and open access.

Visa Europe operates open and transparent membership criteria in compliance with the access requirements under Article 28 of the Payment

Services Directive (2007/64/EC) that requires payment systems to maintain objective and non-discriminatory access criteria and the Oversight

Framework for Card Payment Schemes – Standards (2008) by the Eurosystem.

Membership applications are subject to a thorough risk based review in order to protect the integrity of the Visa Europe system, and to assess

against potential reputational concerns. The different categories of membership offered by Visa Europe allow different entities to become Members

at a level appropriate to the risk exposure that the category of membership involves.

In order to become a Member of Visa Europe, the applicant must hold an appropriate authorisation in the jurisdiction in which it is based; must

have been assessed as being able to meet the creditworthiness obligations associated with its credit risk rating; and must also have passed tests on

anti-money laundering, sanctions, and anti-terrorist financing. Details of Visa Europe’s criteria for participation are publicly disclosed via Visa

Europe’s website.

Membership of Visa Europe may be terminated either voluntarily by the Member or involuntarily for cause by Visa Europe. It is rare for Visa Europe

to terminate a Member’s licence; however, should this occur, there is a defined process to be undertaken. At no stage would the termination of a

Member’s licence compromise the viability of the Visa Europe systems.

Visa Europe Public 29 of 31

Principle 19: Tiered Participation Arrangements

An FMI should identify, monitor, and manage the material risks to the FMI arising from tiered participation arrangements.

Visa Europe has five clear classes of membership: Principal Members; Associate Members; Participant Members; Cash Disbursement Members and V

PAY Members. All of these types of Member are considered to be direct participants in Visa Europe. Visa Europe has powers and a comprehensive

set of policies to monitor and manage the activities of all of these types of Members and to take action where a Member is outside Visa Europe’s

acceptable risk tolerance and credit exposure parameters.

In certain circumstances Visa Europe permits its Members to use third party agents for payment related services. Such agents are considered to be

indirect participants in the Visa Europe system. Third party agents are required to register with Visa Europe. Members are responsible and liable for

the actions of their third party agents, and are required to ensure that their agents have the necessary risk controls in place. Visa Europe has

detailed powers to review and control the appointment of third party agents and to reduce the scale of any Member’s activities when that Member

is using third party agents.

Principle 21: Efficiency and Effectiveness

An FMI should be efficient and effective in meeting the requirements of its participants and the markets it serves.

Providing services in an efficient and effective way is vital to Visa Europe’s business. Visa Europe operates in a highly competitive and dynamic

market. Visa Europe, therefore, must continually innovate to meet the evolving needs and options of service-users, including importantly

consumers. As a result, the market itself creates compelling incentives for Visa Europe to ensure that its services are designed and operated to meet

the needs of its members in particular in relation to: clearing and settlement processes and timing; the scope of payment products offered and

cleared; and its use of technology and procedures.

Visa Europe also has stringent quality requirements and controls for authorisations, clearing and settlement transactions and it also conducts an

annual satisfaction survey of its members which takes account of members’ overall satisfaction as well as Visa Europe’s value to them. Visa Europe

also participates in several externally run quality assurance projects and is audited internally and externally.

Visa Europe ensures that it has clearly defined goals for meeting the requirements of its members.

Visa Europe Public 30 of 31

Principle 22: Communication Procedures and Standards

An FMI should use, or at a minimum accommodate, relevant internationally accepted communication procedures and standards in order

to facilitate efficient payment, clearing, settlement, and recording.

The Visa Europe Core Processing network supports all internationally accepted communications procedures and standards and uses ISO 8583(97)

with transaction processing enhanced to reflect the cross-border nature of Visa’s processing system.

Principle 23: Disclosure of Rules, Key Procedures, and Market Data

An FMI should have clear and comprehensive rules and procedures and should provide sufficient information to enable participants to

have an accurate understanding of the risks, fees, and other material costs they incur by participating in the FMI. All relevant rules and

key procedures should be publicly disclosed.

Visa Europe is confident it communicates efficiently and thoroughly with its Members and other external stakeholders to ensure that participants

have an understanding relevant to the operations of the system.

Visa Europe has clear and comprehensive rules and procedures that are set out under various legal documents, namely the Membership Deeds,

Articles of Association, Membership Regulations and Bylaws and the VEOR for Scheme and for Processing. These documents outline the rights and

obligations of Visa Europe and its Members. Copies of these documents are provided to Members via Visa Online (VOL), a secure online portal. A

public version of the relevant rules and key procedures of the VEOR is available upon request. The framework documents provide a high degree of

legal certainty between Visa Europe and its Members, and assist Members with the assessment of risks incurred by participating in the Visa Europe

payment system. There is a comprehensive communication policy with Members to ensure that all rule changes are fully communicated and

understood ahead of implementation. Any changes to the rules are incorporated into the next edition of the VEOR. Licensing arrangements in the

form of Membership Deeds and Trademark licenses are currently under review following integration with Visa Inc.

Visa Europe’s system manuals, the implementation and user guides for Visa Europe’s systems and services, are designed to facilitate Members’

further understanding of the Visa Europe system. Additionally, Visa Europe provides a regular programme of communications for its Members, as

well as a dedicated customer support function to monitor and address queries from Members across the Visa Europe territory, ensuring these are

escalated to senior management for resolution where necessary. Tailored training programmes, such as fraud prevention and risk management

Visa Europe Public 31 of 31

consultancy, assists in ensuring Members continue to fully comprehend their participation, enabling a faster on-boarding of Members onto the Visa

Europe payment scheme.

Principles Not Applicable to Payment Systems

The following principles are not applicable to payment systems:

Principle 6: Margin;

Principle 10: Physical deliveries;

Principle 11: Central securities depositories;

Principle 14: Segregation and portability;

Principle 20: FMI links;

Principle 24: Disclosure of market data by trade repositories.

Principles Not Applicable to Visa Europe

The following principles are not applicable to Visa Europe:

Principle 12: Exchange-of-value settlement systems – not applicable because Visa Europe does not settle transactions that involve the

settlement of two linked obligations.