Whether the digital euro will be successful depends on monetary design but also by whether banks and other payment providers are able to offer digital euro services securely and conveniently on smartphones.
Article 33 of the European Commission’ proposed Regulation establishing the digital euro, would require companies that control relevant mobile-device hardware and software, including operating systems, authentication tools and secure functions, to provide effective access to – and interoperability with – features offering digital euro services on fair, reasonable and non-discriminatory terms. This would influence whether banks and payment providers are able to offer digital euro services across devices.
That’s why the EU should set out common requirements for a secure and interoperable digital euro while ensuring technological neutrality, effective access and flexibility for providers to develop their own solutions.
Why this matters
A recent CEPS study argues that Article 33 will impact how responsibilities are distributed throughout the broader digital euro payments ecosystem. Its consequences will reverberate beyond the companies that are directly covered, which would shape consumer choice, competition and the interchangeability of digital euro services across devices.
Yet some of the above features are intimately related to device security. Requirements that are too broad or prescriptive could put security-critical components at risk or hinder the development of innovative solutions. Thus, there must be a balance between user-friendliness and security on the one hand and competition and innovation on the other. The European Central Bank’s (ECB) coordinating role will be crucial but implementation, enforcement and dispute resolution responsibilities should be assigned based on the institutions concerned.
Only standardise what’s necessary
Any pan-European payment system requires common rules. Digital euro payments must work securely and reliably across providers and devices throughout the euro area, supported by common requirements for interoperability, authentication, fraud prevention, operational resilience and certification.
Shared technical interfaces may be needed, but providers shouldn’t have to use identical applications, onboarding processes or technical architectures. Once common requirements are met, providers should be free to design their services and device manufacturers should have the flexibility to provide effective and non-discriminatory access. This would limit fragmentation while still preventing the digital euro from being locked into today’s technologies.
Access and security aren’t mutually exclusive
In practice, access must be timely and technically satisfactory for payment providers to offer the essential digital euro services that users would expect from them. Access mustn’t be denied, delayed or granted on terms that puts a provider at a disadvantage to others.
At the same time, device and operating system providers must be able to protect sensitive elements, such as authentication mechanisms and other security-related functions. That’s why the final Regulation must have an explicit safeguard for restrictions that are necessary, proportionate and justified in terms of security, system integrity and/or resilience.
Providers using the safeguard should thoroughly explain why they’re using it. This would be reviewed by the competent authority or dispute-settlement mechanism, which would protect legitimate security interests but also prevent the use of security as a general reason to deny access.
The Council’s position maintains the original proposal’s explicit security safeguard, while the European Parliament’s position doesn’t replicate this safeguard in the same terms.
Coordinating with the DMA
Article 33 would operate alongside the Digital Markets Act (DMA), which has an interoperability requirement that already requires designated gatekeepers (large platforms controlling key gateways between businesses and users) to provide third parties with access to certain hardware and software features. Yet the DMA only applies to gatekeepers, while Article 33 applies more broadly. The regimes also differ because of economic conditions and who the ultimate beneficiaries are, meaning that the DMA can require free access, while Article 33 stipulates fair, reasonable, and non-discriminatory terms.
Article 33 should thus be a self-standing, principle-based access regime with clear and enforceable conditions, which doesn’t advocate for a specific technical method. If both regimes covered the same functionality, the final Regulation should clarify how these technical and economic conditions interact and how competent authorities should coordinate with each other to preserve the DMA where applicable.
Clear responsibilities for implementation and enforcement
Effective access rules require credible enforcement and a transparent mechanism for assessing compliance. These rules should be applied by providers, and, if necessary, more intervention could address a situation where the Regulation’s requirements aren’t complied with.
The Regulation should set out durable principles, rights, safeguards and institutional responsibilities on access. Commission implementing measures and ECB reference standards should reinforce these principles through evolving operational requirements that consider technology development, market practices and security risks. This would ensure legal certainty and at the same time preserve the flexibility to avoid commitment to any particular technology.
Individual disputes over whether access has been given on fair, reasonable and non-discriminatory terms would be best dealt with by an impartial mechanism backed up where necessary by independent technical expertise. This would balance well the ECB’s system-level expertise with the credibility of individual adjudication.
It’s all about governance
SEPA and the Eurosystem’s TARGET services are examples of how common European standards can be combined with a decentralised approach to implementation, while at the same time underlining the significance of stakeholder participation, testing, transparency in decision-making processes and predictable procedures for updating standards.
These principles should underpin the digital euro project. Public authorities should elaborate on the common principles and functional requirements needed to develop a secure and genuine European payment system but still leave sufficient flexibility to providers on how to implement it. The ECB has already involved payment providers, merchants, consumers and technical experts in developing a digital euro scheme rulebook. Structured participation should continue during the testing, implementation and any subsequent updates of the digital euro, to help identify and solve potential challenges as the system evolves.
Whilst technical, Article 33 has far-reaching implications. It should ultimately guarantee timely, technically sufficient and non-discriminatory access and allow restrictions which are necessary and proportionate to ensure security, as well as providing for enforcement, dispute resolution and coordination with the DMA. Combined with strong ECB coordination and stakeholder participation, such a framework would facilitate the successful launch of a secure and interoperable digital euro, while maintaining technological neutrality and scope for market-led innovation.
About the author:
Apostolos Thomadakis is a Senior Research Fellow and Head of the Financial Markets and Institutions Unit at CEPS. He is also Head of Research at the European Capital Markets Institute (ECMI), an independent research institute managed by CEPS’ Financial Markets and Institutions Unit.