Memorandum of Understanding Cooperation Arrangements between Australian Payments Plus Limited, NPP Australia Limited and the Reserve Bank of Australia regarding Observance of the Principles for Financial Market Infrastructures over 2024–2027

General provisions

1. Except for clause 26 which is intended to be legally binding, the RBA, AP+ and NPPA do not intend this MOU to create any enforceable rights or legally binding obligations on them.
2. Nothing in this MOU is intended to preclude the RBA from exercising its powers and functions under the Payment Systems (Regulation) Act 1998 or other legislation or otherwise limit the discretion of the RBA in any way in the discharge of its regulatory responsibilities.
3. Each of AP+, NPPA and the RBA acknowledges and agrees that each other party may publish on its website or otherwise make publicly available this MOU (as amended from time to time, excluding its attachments).
4. In this MOU, unless otherwise specified, or the context otherwise requires or permits, a reference to ‘AP+/NPPA’ is a reference to each of them.
5. The cooperation arrangements set out in this MOU are with respect to the RBA’s role as principal regulator of the payments system through the Payments System Board (PSB), which includes overseeing the safety and stability of the payments system. This role is distinct from the RBA’s role as owner and operator of the Reserve Bank Information and Transfer System, which includes the Fast Settlement Service used to settle NPP transactions. It is also distinct from the RBA’s role as provider of transactional banking services to the Australian Government and its agencies, which includes being a participant in the NPP system.^[1]

Motivation

6. Safe, efficient, and competitive payment systems are critical to the smooth functioning of financial markets and the Australian economy. With a very high share of payments being made electronically, the Australian economy is reliant on payment systems being resilient and secure. Reliability and security problems can impose significant costs on end users, cause economic disruption and damage public confidence in the financial system.
7. The PSB has identified strengthening the resilience of payments and market infrastructure as a key strategic priority for the RBA’s payments policy work. The Government’s Strategic Plan for Australia’s Payments System also prioritises promoting a safe and resilient payments system. Consistent with these priorities, AP+ is committed to uplifting and maintaining capabilities across the infrastructure it operates, including the NPP system, to ensure that payments continue to be secure and resilient.
8. The RBA considers that the NPP system is likely to meet one or more of the criteria for systemically important payment systems (SIPS) at some point in the years ahead; however, currently the RBA has not determined the NPP system to meet the SIPS criteria and NPPA/AP+ is not required to comply with the PFMI.^[2] The NPP is expected to continue to grow rapidly due to the migration of payments from legacy systems and new services. There is also the likelihood of increasing interconnectedness with other financial market infrastructure. Once the RBA determines that the NPP system meets the SIPS criteria, NPPA (and where relevant, AP+ in its capacity as owner of NPPA) will be expected by the RBA to demonstrate observance of all PFMI relevant to payment systems.^[3] Until such time, AP+/NPPA is entering these arrangements on a voluntary basis.

Approach

Graduated approach to assessing observance of the PFMI

9. The PFMI are international standards set by the Committee on Payments and Market Infrastructures and the Technical Committee of the International Organization of Securities Commissions (CPMI-IOSCO). The PFMI are widely used internationally by authorities, including the RBA, to assess the effectiveness of the risk management practices of financial market infrastructures, including payment systems.
10. Under the RBA’s graduated approach, the RBA will progressively assess observance of the principles set out in the PFMI by AP+/NPPA over a four-year period. While SIPS are assessed against all principles which apply to payment systems from the outset, the graduated approach is intended to assist AP+/NPPA to build understanding of the obligations articulated in the PFMI over time. This will facilitate progressive uplift in risk management practices and the implementation of improvement opportunities identified through the regular assessment process.
11. While AP+/NPPA focuses on the core NPP infrastructure most directly within its control, assessment of observance of the PFMI will have a broader focus on the NPP ecosystem. The RBA considers payment systems with an end-to-end focus, particularly when considering the potential for economic disruption and damage to public confidence in the financial system. This perspective is consistent with the PFMI, which encourages FMIs to understand their role within the broader ecosystem and consider interdependencies as part of the risk identification process.

Oversight program over 2024-2027

12. Attachment A sets out a proposed oversight program for assessing AP+/NPPA’s voluntary observance of all principles applicable to payment systems by the end of 2027. The RBA has identified the three foundational principles to be assessed in the first year (Principles 2, 3 and 17). Sequencing of subsequent principles will be revisited annually and mutually agreed by AP+/NPPA and the RBA, with flexibility to adjust the program to reflect changes to risk, material developments and other practical considerations.
13. AP+/NPPA is committed to:
    1. improving risk management practices relevant to the NPP system to a standard consistent with observance of the PFMI;
    2. engaging constructively and openly with the RBA to demonstrate its voluntary observance of the relevant PFMI principles and supporting the RBA’s efforts to assess AP+/NPPA’s adherence to the relevant principles. This will be achieved through an annual program of:
       1. self-assessment by AP+/NPPA (including provision to the RBA of supporting documentation and information), as outlined further in clauses 17 and 18; and
       2. an independent assessment of AP+/NPPA’s observance of the relevant PFMI principles (with recommendations for improvement) by the RBA, as outlined further in clauses 15 and 16 (Assessment); and
    3. acting in good faith throughout.
14. The RBA is committed to:
    1. providing AP+/NPPA with a clear scope, expectations and guidance prior to each self-assessment and Assessment against the relevant PFMI principles;
    2. engaging constructively and openly with AP+/NPPA in relation to the PFMI and each Assessment, and supporting AP+/NPPA’s efforts to assess its adherence to the relevant principles; and
    3. acting in good faith throughout.

Assessments and self-assessments

15. The RBA’s approach to conducting an assessment of PFMI observance is informed by the disclosure framework and assessment methodology published by CPMI-IOSCO (the disclosure framework).^[4] In undertaking its analysis, the RBA will also draw on other PFMI-related documents and guidance published by CPMI-IOSCO. Consistent with the disclosure framework, the RBA’s process for undertaking the Assessment will typically involve:
    1. determining the scope of the Assessment, and sharing the scope with AP+/NPPA to provide transparency regarding the RBA’s expectations;
    2. gathering facts and information on each applicable key consideration within the relevant PFMI principles as agreed in accordance with clause 19(a) (Relevant Principles);
    3. forming draft conclusions for each Relevant Principle;
    4. assigning draft ratings for each Relevant Principle;
    5. indicating an appropriate time frame for AP+/NPPA to address issues of concern, if any; and
    6. preparing an Assessment report which includes the RBA’s final conclusions and ratings in respect of each Relevant Principle.
16. The RBA’s Assessment report will typically include the following information:
    1. material developments relevant to the NPP system that occurred over the Assessment period, or which are expected to occur in the near future. Examples of material developments could include major policy or operational changes, reforms, initiatives, incidents or reviews;
    2. a summary of progress against recommendations and areas of oversight focus from previous Assessments;
    3. an overview of the principles assessed during the Assessment period, including ratings for each Relevant Principle and reasons for the ratings; and
    4. a summary of key findings and recommendations of the Assessment, including suggested steps to improve observance of the Relevant Principles, if any.
17. AP+/NPPA agrees to prepare an annual self-assessment against the Relevant Principles and to provide its self-assessment to the RBA. Self-assessments are intended to assist AP+/NPPA to build understanding of the obligations articulated in the PFMI and identify opportunities for uplift, if any. The RBA will draw on this material as a key input for the component of its Assessment described in clause 15(b) above, taking into consideration instances where AP+/NPPA is able to provide documentation demonstrating how areas for uplift have been self-identified and mitigated (including situations where uplift plans have been formally approved but are still being implemented).
18. At a minimum, self-assessments should include ratings at the principle level, details of how AP+/NPPA observes each of the Relevant Principles, and references to supporting artefacts (see clauses 22 to 25 on information sharing below).

Communication arrangements and pattern of engagement

19. The RBA and AP+/NPPA agree to regular engagement over the year to support the RBA Assessment program. Either AP+/NPPA or the RBA may request ad hoc meetings or communications in relation to any other matters. Consistent with the disclosure framework, the proposed annual cycle of engagement is:
    1. Phase 1 (December – March) – at least 3 meetings to:
       • Discuss and agree the Relevant Principles (PFMI to be assessed (or revisited) over the coming year, as set out in Attachment A).
       • Clarify interpretation of the Relevant Principles. RBA will provide additional guidance as relevant, and confirm the material and artefacts needed to demonstrate observance of the relevant PFMI principles (Attachment B).
       • Agree and schedule meetings across the coming year. This will include agreement around which AP+/NPPA representatives the RBA Assessment Team members should meet and when.
    2. Phase 2 (April – June): AP+/NPPA to undertake and deliver to the RBA a self-assessment against the Relevant Principles by 30 June. AP+/NPPA and the RBA will schedule at least two meetings to facilitate this process; a mid-point update on progress and an end-point discussion.
    3. Phase 3 (July – September): The RBA will undertake an assessment of AP+/NPPA’s observance of the Relevant Principles as at 30 September. The Assessment will be based on information and material provided by AP+/NPPA and other inputs sourced by the RBA as appropriate.
       1. There will be at least three touchpoints scheduled during Phase 3: two tranches of written questions from the RBA and at least one meeting to ask questions and confirm understanding. During Phase 3 the RBA will share draft observations and draft conclusions for fact checking once they are ready for review.
       2. AP+/NPPA may provide updates to their self-assessment and/or additional artefacts to demonstrate observance of the Relevant Principles during Phase 3.
    4. Phase 4 (October – November): RBA to provide a draft Assessment for review and fact checking to AP+/NPPA no later than five business days after 30 September. AP+/NPPA to provide all feedback on the RBA’s draft Assessment by end-October. The copy of the draft Assessment that is provided to AP+/NPPA may include any redactions that the RBA considers appropriate, including to protect confidential information received by the RBA from third-party sources. During Phase 4 AP+/NPPA may provide additional artefacts to demonstrate observance of the Relevant Principles.
20. The RBA’s draft Assessment, reflecting AP+/NPPA feedback as appropriate, will be presented at the November PSB meeting for review and endorsement by the PSB. A copy of the Assessment will be provided to the Chair and CEO of AP+ once approved by the PSB. The RBA will not publish the Assessment without the permission of AP+/NPPA.
21. Following finalisation of the Assessment, the RBA and AP+/NPPA will further discuss the RBA’s recommendations and the approach that AP+/NPPA proposes to take to address them.

Information sharing

Provision of data and information

22. AP+/NPPA will provide to the RBA the data and other information specified in Attachment B periodically or as otherwise specified in Attachment B.
23. During phase 1, AP+/NPPA and the RBA will review and agree the information to be provided to demonstrate observance of the Relevant Principles in the upcoming annual program. Attachment B can be updated from time to time in accordance with clause 28.
24. Unless otherwise agreed, information to be shared with the RBA will be uploaded via a dedicated folder in the RBA’s secure portal for information exchange.
25. AP+/NPPA may redact information that is commercial-in-confidence or outside the scope of the RBA’s requirements, as set out in this MOU. AP+ and NPPA acknowledge that the RBA will not be able to take any redacted information into consideration when undertaking an Assessment.

Confidentiality of information provided by AP+/NPPA

26. 1. The RBA must not disclose any Confidential Information provided by AP+ or NPPA to the RBA, except in the following circumstances:
       1. the disclosure is made to any of the RBA’s personnel (including its employees, contracted staff, officers and agents), any member of any board of the RBA, or any of the RBA’s contractors, consultants or advisers when required for the performance of their functions under or in connection with this MOU, or the activities contemplated by it;
       2. disclosure is made to the Department of the Treasury, the RBA’s responsible Minister or his or her staff or advisors;
       3. disclosure is made in response to a request by a House or a Committee of the Parliament of the Commonwealth or pursuant to an order made by a House of the Parliament of the Commonwealth;
       4. disclosure is made to a person that has the function, in Australia or in a foreign country, of supervising or regulating financial institutions (financial sector supervisory agency), if the RBA considers that disclosure of the information will assist that financial sector supervisory agency to perform its functions or exercise its powers;
       5. subject to section 79A of the Reserve Bank Act 1959, disclosure is required by law (including where required by a court);
       6. AP+ or NPPA (as applicable) expressly approves the disclosure in writing; or
       7. disclosure is otherwise authorised under this MOU.

       Each of AP+ and NPPA consents to any disclosure which is made by the RBA as contemplated in paragraphs (i) to (vii) above.

    2. In this MOU, Confidential Information means information or documentation disclosed by AP+/NPPA to the RBA whether before or after the date of this MOU that is provided under or in connection with this MOU and:
       1. is by its nature confidential;
       2. is designated confidential; or
       3. the RBA knows or ought to know is confidential,

          but does not include information that:

       4. is or becomes public knowledge, other than by breach of this MOU or any other confidentiality obligation.

Amendments to this MOU and Attachments

27. The RBA, AP+ and NPPA may review and agree to vary this MOU in writing from time to time.
28. The parties agree that Attachment A and/or Attachment B may be varied if the variation is accepted in writing for and on behalf of:
    1. the RBA by its Head of Payments Policy Department from time to time;
    2. AP+ by its CEO from time to time; and
    3. NPPA by its CEO from time to time,

    and unless otherwise agreed, any variation to Attachment A and/or Attachment B takes effect on and from the date that it has been accepted by each of those persons.

Signatures