Banking Regulation Comparative Guide -

1 Legal framework

1.1 Which legislative and regulatory provisions govern the banking sector in your jurisdiction?

The banking sector has become increasingly highly regulated in recent years, at both national and European level, which makes it impossible to comprehensively cover all legislative and regulatory provisions governing the banking sector in Portugal here. However, useful further information can be found at:

The foundational legal framework governing the banking sector in Portugal is the Legal Framework of Credit Institutions and Financial Companies, approved by Decree-Law 298/92 of 31 December 1992, as amended from time to time, which is complemented and developed by several regulations of the Bank of Portugal.

Regarding investment services and ancillary investment services, the foundational legal framework governing investment banking in Portugal is the Portuguese Securities Code, approved by Decree-Law 486/99 of 13 November 1999, as amended, complemented and developed by several regulations issued by the Portuguese Securities Commission (SEC).

Several European regulations apply directly in Portugal and govern retail and investment banking – in particular, those listed at https://ec.europa.eu/info/law/law-topic/eu-banking-and-financial-services-law_en.

1.2 Which bilateral and multilateral instruments on banking have effect in your jurisdiction? How is regulatory cooperation and consolidated supervision assured?

Portugal has been:

a member state of the European Union since 1 January 1986;
a member of the Eurozone since 1 January 1999; and
a member country of the Schengen Area since 26 March 1995.

All actions taken by the European Union are founded on multilateral treaties approved voluntarily and democratically by the EU member states.

The foundational pillars of the European Union to which Portugal is a party are:

the Maastricht Treaty, known as the Treaty on European Union, which established the European Central Bank (ECB) and the European System of Central Banks and described their objectives, among other things;
the Treaty on the Functioning of the European Union; and
the Charter of Fundamental Rights of the European Union.

As regards consolidated supervision, Portugal participates in the Single Supervisory Mechanism (SSM). The SSM comprises the ECB and the national competent authorities of participating member states. The SSM is responsible for the prudential supervision of all credit institutions in participating member states. It ensures that EU policy on the prudential supervision of credit institutions is implemented in a coherent and effective manner, and that credit institutions are subject to supervision of the highest quality.

1.3 Which bodies are responsible for enforcing the applicable laws and regulations? What powers (including sanctions) do they have?

Under the terms set forth in Article 17 of its Organic Law, the Bank of Portugal is responsible for supervising credit institutions, financial companies and other entities subject to its supervision by law – in particular, by:

issuing directives to guide their actions;
providing credit risk centralisation services; and
applying preventive and corrective intervention measures under the legislation regulating financial supervision.

The Portuguese Securities Commission is the competent supervisory authority regarding the provision of investment services and ancillary services.

Under Article 4 of the Portuguese Securities Commission Statutes, the Portuguese Securities Commission regulates and supervises financial instruments markets, as well as the entities that act therein in accordance with the Securities Code and the relevant complementary legislation.

The Supervisory Authority for Insurance and Pension Funds is responsible for ensuring the proper functioning of the insurance and pension funds market in Portugal, in order to protect policyholders, insured persons, participants and beneficiaries.

The Bank of Portugal, the Portuguese Securities Commission and the Supervisory Authority for Insurance and Pension Funds perform their duties within the scope of the National Council of Financial Supervisors and the European System of Financial Supervisors.

Other generic supervisory entities – such as the Data Protection Commission and the Competition Authority – also have supervisory powers over banks.

Where necessary, the Portuguese courts enforce the applicable laws and regulations, ensuring the application of the sanctions provided for by law.

1.4 What are the current priorities of regulators and how does the regulator engage with the banking sector?

In the Portuguese banking sector, the regulator and the supervisory authority are the same: the Bank of Portugal, one of three members of the National Council of Financial Supervisors.

The Strategic Plan 17-20 defines the Bank of Portugal's priorities for 2017 to 2020, organised under four broad strategic guidelines, as follows:

Emphasise the Bank of Portugal's capacities as a monetary authority at both domestic and international level;
Participate in the definition of regulatory frameworks and the implementation of supervisory practices in order to ensure the soundness and stability of the national financial system and build confidence among economic agents;
Promote a deeper understanding of the Portuguese economy and European integration, helping to inform and educate; and
Be among the most efficient central banks in the Eurosystem.

2 Form and structure

2.1 What types of banks are typically found in your jurisdiction?

There are several types of credit institutions in Portugal, as follows:

banks;
savings banks;
the Central Mutual Agricultural Credit Fund and the mutual agricultural credit banks;
credit financial institutions;
mortgage lending institutions; and
other companies that are qualified as such by law.

Banks may carry out the operations set forth in Article 4 of the Legal Framework of Credit Institutions and Financial Companies.

The Legal Framework for Savings Banks was approved by Decree-Law 190/2015 of 10 September 2015. Savings banks may be categorised as:

attached savings banks, which may not carry out as many operations as banks; and
banking savings banks, which are treated as banks in terms of everything that is not specifically regulated in that framework, as regards the activities that they can undertake.

The Central Mutual Agricultural Credit Fund is regulated by Decree-Law 24/91 of 11 January 1991, as amended. The fund grants credit and undertakes other acts inherent to banking activities, on the same terms as banks.

Mutual agricultural credit banks are also regulated by Decree-Law 24/91, as amended, and provide a narrower range of services than banks.

Credit financial institutions are regulated by Decree-Law 186/2002 of 21 August 2002 and can carry out all activities of banks, with the exception of receiving deposits.

Mortgage lending institutions are regulated by Decree-Law 59/2006 of 20 March 2006 and provide a narrower range of services than banks.

2.2 How are these banks typically structured?

Banks and other credit institutions are structured as public limited companies (sociedades anónimas), except for mutual agricultural credit banks and corresponding savings banks.

As regards the services provided by banks, the universal banking model is currently the most common in Portugal, with banks providing both commercial banking services and investment banking services.

2.3 Are there any restrictions on foreign ownership of banks?

Banks that legally operate in an EU member state may:

carry out their activities in a stable and continuous way in Portugal (ie, freedom of establishment); and/or
offer and provide their services in Portugal on a temporary basis while remaining in their country of origin (freedom to provide services).

It is relatively simple for a bank which is legally operating in an EU member state to establish a branch in Portugal.

The establishment of a branch by a bank authorised in a third country is subject to an authorisation process which is similar to that applicable to the constitution of a Portuguese bank.

From a qualitative perspective, the establishment of a subsidiary by a bank authorised in a foreign country is equivalent to the constitution of a bank with Portuguese shareholders.

Anyone, whether Portuguese or foreign, that wants to acquire a qualified holding in a Portuguese bank or increase an existing qualified holding above certain levels must communicate that intention to the Bank of Portugal under the terms set forth in Articles 102 and following of the Legal Framework of Credit Institutions and Financial Companies.

The Bank of Portugal may object to the acquisition if it does not consider it evidenced that the proposed acquirer meets conditions that would guarantee the healthy and prudent management of the bank or if the information provided by the proposed acquirer is incomplete.

2.4 Can banks with a foreign headquarters operate in your jurisdiction on the basis of their foreign licence?

Banks that are legally operating in one EU member state can operate in Portugal based on their foreign licence, under the freedom of establishment and the freedom to provide services rules mentioned above.

To ensure a level playing field, in order to be able to operate in Portugal, banks authorised in a third country are subject to an authorisation process similar to that which applies to the constitution of a Portuguese bank.

Banks with foreign headquarters may establish representative offices in Portugal upon prior registration with the Bank of Portugal. The activities of a representative office are conducted in strict dependence on the represented bank. The representative office is allowed only to monitor the interests of the represented bank in Portugal and to inform it of the realisation of operations in which it proposes to participate.

3 Authorisation

3.1 What licences are required to provide banking services in your jurisdiction? What activities do they cover?

Banks must obtain authorisation from the Bank of Portugal under the terms set forth in Articles 14 and following of the Legal Framework of Credit Institutions and Financial Companies, and must also follow the process for incorporating and registering a commercial company.

Banks can carry out a wide range of activities, set out in Article 4, paragraph 1 of the Legal Framework of Credit Institutions and Financial Companies.

Banks that are legally operating in one EU member state and that intend to provide services in Portugal must follow the applicable procedure within the scope of freedom of establishment and/or freedom to provide services, as appropriate.

Banks must additionally be registered in a special register with the Bank of Portugal. The same applies to branches or representative offices in Portugal of banks authorised in a foreign country.

Once authorisation has been obtained from the Bank of Portugal, banks must seek a specific registration for the provision of investment services and ancillary services with the Portuguese Securities Commission, where appropriate. The registration process with the Portuguese Securities Commission is accompanied by a thorough evaluation of the human, technical and material resources of the bank.

3.2 What requirements must be satisfied to obtain a licence?

In general, banks and other credit institutions based in Portugal must satisfy the following requirements:

They must correspond to one of the types provided for in Portuguese law.
They must adopt the form of a public limited company, with the exception of mutual agricultural credit banks and corresponding savings banks.
Their stated purpose must be to carry out activities legally permitted under the terms of Article 4 of the Legal Framework of Credit Institutions and Financial Companies.
Their share capital must not be lower than the legal minimum, mandatorily represented by registered shares, with the exception of mutual agricultural credit banks and attached savings banks.
Their main and effective administrative headquarters must be located in Portugal.
They must implement solid internal rules on corporate governance, including a clear organisational structure with well-defined, transparent and coherent lines of responsibility.
They must have in place effective processes for the identification, management, control and communication of the risks to which they are or may be exposed.
They must have in place adequate internal control mechanisms, including sound administrative and accounting procedures.
Their remuneration policies and practices must promote and be consistent with sound and prudent risk management.
The suitability, professional qualifications, independence and availability of the members of the management and supervisory bodies must guarantee the sound and prudent management of the credit institution.

3.3 What is the procedure for obtaining a licence? How long does this typically take?

Banks must submit a request for authorisation to the Bank of Portugal, accompanied by the documentation set forth in Article 17 of the Legal Framework of Credit Institutions and Financial Companies.

The request for authorisation will be evaluated by the Bank of Portugal in collaboration with the European Central Bank.

Once authorisation has been granted for the constitution of the bank, interested parties must implement the means and conditions for undertaking the authorised activities.

Upon receiving authorisation from the Bank of Portugal, interested parties must register the bank in a special register with the Bank of Portugal. The special register covers the elements set forth in Article 66 of the Legal Framework of Credit Institutions and Financial Companies.

The decision of the Bank of Portugal must be notified to the interested parties within six months of receipt of the application or, if applicable, receipt of any additional information requested from the applicants; but in any case within 12 months of the date of initial delivery of the application. If the Bank of Portugal fails to respond within these timeframes, this gives rise to a presumption of tacit rejection of the request.

Upon receiving authorisation from the Bank of Portugal, the banks must seek registration for the provision of investment and ancillary services with the Portuguese Securities Commission, if it intends to pursue such activities.

According to Article 299 of the Portuguese Securities Code, registration with the Portuguese Securities Commission is deemed to have been refused if it is not granted within 30 days of:

the communication of authorisation; or
the date of receipt of either the request or any supplementary information requested.

In practical terms, it can take between 18 months and two years to prepare the application file and obtain the necessary authorisations and registrations with the Bank of Portugal and the Portuguese Securities Commission.

4 Regulatory capital and liquidity

4.1 How are banks typically funded in your jurisdiction?

Like commercial companies in general, banks can be financed through:

equity capital, originating from the holders of share capital;
debt; or
hybrid financing instruments, which have mixed characteristics of both own capital and debt.

In any event, however, banks must always comply with the capital and liquidity requirements set forth in EU Regulation 575/2013 of the European Parliament and of the Council of 26 June on prudential requirements for credit institutions.

Once they have begun operating, banks finance themselves through the provision of services – that is, through:

the difference between the interest rate charged to borrowers and the interest rate paid to depositors by banks;
the collection of commissions due in exchange for services provided; and
investment in financial assets.

4.2 What minimum capital requirements apply to banks in your jurisdiction?

The minimum share capital of banks is €17.5 million.

Banks must always comply with the capital and liquidity requirements set forth in Regulation (EU) 575/2013 of the European Parliament and of the Council of 26 June on prudential requirements for credit institutions.

4.3 What legal reserve requirements apply to banks in your jurisdiction?

Under the terms set forth in Article 97 of the Legal Framework of Credit Institutions and Financial Companies, at least 10% of a bank's annual net profits must be allocated to the formation of a legal reserve, up to a limit equal to the value of the share capital or the sum of the free reserves constituted and the retained earnings, if higher.

Banks must also set up special reserves to reinforce the net situation or to cover losses that the profit and loss account cannot support.

The minimum reserve requirement for euro area banks is variable and is set for six-week periods, called ‘maintenance periods'. The level is calculated based on the bank's balance sheet prior to the start of the maintenance period.

Banks must ensure that they meet the minimum reserve requirement on average over the maintenance period.

The reserve base is determined using statistical information from balance-sheet data, which the institutions subject to the minimum reserve system are obliged to provide (as a rule monthly), and applies to the maintenance period that usually begins two months later.

Banks must always comply with the requirements set forth in Regulation (EU) 575/2013 of the European Parliament and of the Council of 26 June on prudential requirements for credit institutions.

5 Supervision of banking groups

5.1 What requirements apply with regard to the supervision of banking groups in your jurisdiction?

In addition to supervision on an individual basis, credit institutions based in Portugal that have one or more credit institutions or financial institutions as subsidiaries, or that hold participations in such entities, are subject to supervision based on their consolidated financial situation.

Credit institutions based in Portugal whose parent company is a financial company or a mixed financial company with its head office in an EU member state are subject to supervision based on the consolidated financial situation of the parent company.

The Bank of Portugal may determine the inclusion of a credit institution within the perimeter of supervision on a consolidated basis, in the cases set out in Article 131, paragraph 3 of the Legal Framework of Credit Institutions and Financial Companies.

Supervision on a consolidated basis may be undertaken by the Bank of Portugal or by a supervisory authority of another EU member state, depending on group's configuration.

In general, the Bank of Portugal exercises supervision on a consolidated basis where a financial company or a mixed financial company is headquartered in Portugal and is the parent company of credit institutions with their head offices in Portugal and in other EU member states.

5.2 How are systemically important banks supervised in your jurisdiction?

Systemically important banks must meet specific requirements regarding capital reserves under the terms set forth in Articles 138.º-N and following of the Legal Framework of Credit Institutions and Financial Companies and in Regulation (EU) 575/2013 of the European Parliament and of the Council of 26 June on prudential requirements for credit institutions.

This notwithstanding, the supervision of systemically important banks is carried out in general terms.

Under the Single Supervisory Mechanism supervisory model, there is a distinction between:

significant credit institutions, which are under the direct supervision of the European Central Bank (ECB); and
less significant institutions, which are under the indirect supervision of the ECB and the direct supervision of the Bank of Portugal, with notification and reporting to the ECB based on quantitative and qualitative criteria.

5.3 What is the role of the central bank?

The Bank of Portugal is the central bank of Portugal and is an integral part of the European System of Central Banks.

In the capacity of central bank, the Bank of Portugal issues euro banknotes and puts metal coins into circulation; although the European Central Bank has the exclusive right to authorise the respective issuance.

The Bank of Portugal:

produces, stores and puts into circulation euro banknotes;
verifies the authenticity and fitness of banknotes and coins delivered to it; and
destroys banknotes that are not fit to be put back into circulation.

Under the terms set forth in its Organic Law, without prejudice to the requirements derived from its participation in the European System of Central Banks, the Bank of Portugal is responsible for:

managing the foreign assets of the country or any other assets entrusted to it;
acting as intermediary in the international monetary relations of the state;
ensuring the stability of the national financial system – and to this end, in particular, performing the functions of lender of last resort and national macro-prudential authority;
participating in the European system for the prevention and mitigation of risks to financial stability, and in other organisations that pursue the same goal; and
advising the government on economics and finance, within the scope of its functions.

6 Activities

6.1 What specific regulations apply to the following banking activities in your jurisdiction: (a) Mortgage lending? (b) Consumer credit? (c) Investment services? and (d) Payment services and e-money?

(a) Mortgage lending?

The Legal Framework of Credit Institutions and Financial Companies, approved by Decree-Law 298/92 of 31 December 1992, as amended, which is complemented and developed by several regulations of the Bank of Portugal;
Decree-Law 59/2006 of 20 March 2006; and
Decree-Law 74-A/2017 of 23 June 2017.

(b) Consumer credit?

The Legal Framework of Credit Institutions and Financial Companies, approved by Decree-Law 298/92 of 31 December 1992, as amended, which is complemented and developed by several regulations of the Bank of Portugal;
Decree-Law 133/2009 of 2 June 2009; and
Decree-Law 74-A/2017 of 23 June 2017.

(c) Investment services?

The Portuguese Securities Code, approved by Decree-Law 486/99 of 13 November 1999, as amended, which is complemented and developed by several regulations of the Portuguese Securities Commission;
Regulations and delegated acts of Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments; and
Regulation (EU) 600/2014 of the European Parliament and of the Council of 15 May 1014 on markets in financial instruments and amending Regulation (EU) 648/2012, as well as its delegated acts.

(d) Payment services and e-money?

The Legal Framework of Credit Institutions and Financial Companies, approved by Decree-Law 298/92 of 31 December 1992, as amended, which is complemented and developed by several regulations of the Bank of Portugal;
The Legal Framework Regarding Access to the Activity of Payment Institutions and the Provision of Payment Services, approved by Decree-Law 317/2009 of 30 October 2009, as amended;
The Legal Regime of Payment Services and Electronic Currency, approved by Decree-Law 91/2018 of 12 November 2018; and
Commission Delegated Regulation (EU) 2018/389 of 27 November 2017, supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council regarding regulatory technical standards for strong customer authentication and common and secure open standards of communication.

7 Reporting, organisational requirements, governance and risk management

7.1 What key reporting and disclosure requirements apply to banks in your jurisdiction?

As banks are subject to an increasing number of reporting and disclosure duties, it is not possible within the scope of this Q&A to identify all of them in detail.

Banks are subject to duties to report information about the following, among other things:

post-authorisation circumstances that may affect the requirements for which they were initially assessed;
internal policies and procedures;
members of the governing bodies;
the holders of qualified holdings;
bank accounts;
operations carried out;
own funds and constitution of reserves;
exposure to risks;
encumbered and unencumbered assets; and
leverage ratio.

Banks also have a duty to implement an autonomous internal process to assess the relevance, confidentiality and adequacy of the frequency of disclosure of information.

The fundamental statutes on this topic are the Legal Framework of Credit Institutions and Financial Companies, which is complemented and developed by several regulations of the Bank of Portugal, as well as Regulation (EU) 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and its regulations and delegated acts.

Banks are also subject to:

other specific reporting and disclosure requirements when providing investment and ancillary services or insurance-related services; and
a general set of reporting and disclosure requirements applicable to all entities (not only banks), on matters such as personal data processing.

7.2 What key organisational and governance requirements apply to banks in your jurisdiction?

Generally, banks must satisfy the following requirements:

They must correspond to one of the types provided for in Portuguese law.
They must adopt the form of a public limited company, with the exception of mutual agricultural credit banks and corresponding savings banks.
Their stated purpose must be to carry out activities legally permitted under the terms of Article 4 of the Legal Framework of Credit Institutions and Financial Companies.
Their share capital must not be lower than the legal minimum, mandatorily represented by registered shares, with the exception of mutual agricultural credit banks and attached savings banks.
Their main and effective administrative headquarters must be located in Portugal.
They must implement solid internal rules on corporate governance, including a clear organisational structure with well-defined, transparent and coherent lines of responsibility.
They must have in place effective processes for the identification, management, control and communication of the risks to which they are or may be exposed.
They must have in place adequate internal control mechanisms, including sound administrative and accounting procedures.
Their remuneration policies and practices must promote and be consistent with sound and prudent risk management.
The suitability, professional qualifications, independence and availability of the members of the management and supervisory bodies must guarantee the sound and prudent management of the credit institution.

Organisational and governance requirements are detailed in the Legal Framework of Credit Institutions and Financial Companies, which is complemented by several regulations of the Bank of Portugal.

7.3 What key risk management requirements apply to banks in your jurisdiction?

Banks must establish a risk management system in the form of an integrated set of permanent processes that facilitate an appropriate understanding of the nature and magnitude of the risks underlying the activity carried out, thus enabling proper implementation of strategy and fulfilment of the bank's objectives.

Banks must establish a risk management function independent of operational functions and ensure that they have adequate resources. The independent risk management function is responsible for:

ensuring that all material risks for the bank are properly identified, assessed and reported;
participating in the definition of the bank's risk strategy; and
participating in decisions regarding the management of material risks.

The person responsible for the risk management function must exercise his or her functions independently and exclusively, and must ordinarily be a member of top management. However, if the nature, level and complexity of the credit institution's activities do not justify this, the function may be performed by a senior manager of the credit institution, as long as there is no risk of a conflict of interest.

The person responsible for the risk management function must report directly to the supervisory body and cannot be removed without prior approval.

7.4 What are the requirements for internal and external audit in your jurisdiction?

Where appropriate and proportionate, considering the nature, size and complexity of the activities carried out by the bank, the internal audit function must be permanent, act independently and be responsible for:

developing and keeping up to date an audit plan for examining and evaluating the adequacy and effectiveness of the various components of the bank's internal control system, as well as the internal control system as a whole;
issuing recommendations based on the results of the evaluations carried out and verifying their observance; and
preparing and submitting to the management board and the supervisory board a report, at least annually, on audit issues and the main deficiencies detected which, although immaterial in isolation, may cumulatively harm the internal control system, as well as indicating and identifying the recommendations that have been followed.

Banks must appoint a person responsible for this function and for the provision of information relating thereto, and give him or her the necessary powers to perform his or her functions independently, in particular as regards access to relevant information.

Banks are also subject to external auditing by an entity that is duly registered for this purpose, under the terms set forth in Law 148/2015 of 9 September 2015.

8 Senior management

8.1 What requirements apply with regard to the management structure of banks in your jurisdiction?

The management and supervisory bodies of public limited companies – the structure in which most banks are incorporated – may follow one of three models:

a board of directors and a fiscal council;
a board of directors, including an audit committee, and a certified public accountant; or
an executive board of directors, a general and supervisory board and a certified public accountant.

As banks are considered public interest entities, if they adopt the first model above, they must also have a supervisory board and a certified public accountant or a company of certified public accountants, which is not a member of that body.

The management body must consist of a minimum of three members, with powers to effectively guide the institution's activity.

The day-to-day management shall be entrusted to at least two members of the management body.

If a bank is also a listed company, additional governance requirements may apply.

8.2 How are directors and senior executives appointed and removed? What selection criteria apply in this regard?

Generally, the members of the management and supervisory bodies are appointed and removed by the general meeting. Their suitability, professional qualifications, independence and availability must be sufficient to guarantee, either individually or at the level of the bodies as a whole, the sound and prudent management of the credit institution.

The general meeting of a bank must approve an internal policy for the selection and assessment of suitability of members of the management and supervisory bodies, which involves at least the following:

identification of those responsible for assessing suitability;
the assessment procedures adopted;
the required suitability requirements;
the rules on prevention, communication and resolution of conflicts of interest; and
the availability of opportunities for professional training.

Banks must verify that all members of the management and supervisory bodies have the necessary training and qualifications, and are suitable to exercise their respective functions. Banks must reassess this suitability whenever, during the respective term of office, supervening circumstances occur that may result in non-fulfilment of these requirements.

The suitability of the members of the management and supervisory bodies of banks is assessed by the Bank of Portugal as part of the authorisation process of banks, as well as whenever there is a change in membership of the management and supervisory bodies.

The Bank of Portugal may refuse or revoke the authorisation of members of the management and supervisory bodies to exercise their functions.

8.3 What are the legal duties of bank directors and senior executives?

The board of directors is responsible for managing the bank's activities and must ensure the sound and prudent management of the bank, bearing in mind the need to safeguard the financial system and the interests of stakeholders such as customers, depositors, investors and other creditors.

8.4 How is executive compensation in the banking sector regulated in your jurisdiction?

Executive compensation in the banking sector is regulated through the legal and regulatory definition of certain boundary requirements, which must be implemented by banks.

Banks must approve and implement remuneration policies and practices that are appropriate to their size and internal organisation, and to the nature, scope and complexity of their activities. In particular, banks must comply with the following requirements:

Remuneration policies and practices must promote and be consistent with sound and prudent risk management that does not encourage the taking of risks above the level of risk tolerated by the bank.
Remuneration policies and practices must be compatible with the bank's business strategy, long-term objectives, values and interests, including measures to avoid conflicts of interest.
The independence of employees who exercise control and risk management functions must be ensured in relation to the structure units they control, assigning them the appropriate powers and remuneration according to the achievement of the objectives associated with their functions, and independently of the performance of the respective units.
The remuneration of employees who perform risk management and control functions must be directly supervised by the remuneration committee or, in its absence, by the supervisory body.
The criteria for setting the fixed component of remuneration must be clearly identified, based mainly on the relevant professional experience and the organisational responsibility of the employee. The criteria for the variable component of remuneration must likewise be clearly determined, based on sustainable performance and adapted to the risk of the credit institution, as well as on the employee's performance above and beyond what is required.

Additional rules apply.

9 Change of control and transfers of banking business

9.1 How are the assets and liabilities of banks typically transferred in your jurisdiction?

The assets and liabilities of banks may be transferred in several ways, including contractually on an asset basis (eg, securitisations, assignment of credits, mortgage bonds) or through merger or division, as for other commercial companies.

Mergers and divisions of banks are subject to the authorisation of the Bank of Portugal and, if applicable, to the rules on the authorisation of banks based in Portugal set forth in Article 35 of the Legal Framework of Credit Institutions and Financial Companies.

It may be the case that, given the bank's liquidity needs, it becomes necessary to transform credits held by the bank into cash, which changes the composition of the assets; all regulatory requirements in this regard must be observed. The sale or assignment of claims allows banks to achieve this result and such activity became quite frequent during the 2007/2008 global financial crisis.

Within the scope of bank resolution measures, in exceptional cases the Bank of Portugal may opt for measures that involve the transfer of assets and/or liabilities – that is:

the partial or total sale of operations;
the partial or total transfer of operations to transition institutions;
segregation and partial or total transfer of operations to asset management vehicles; or
bail-in.

9.2 What requirements must be met in the event of a change of control?

In the event of a change of control due to a merger or division, banks must obtain authorisation from the Bank of Portugal and, where applicable, comply with the rules on the acquisition of qualifying holdings and on the authorisation of credit institutions based in Portugal under Article 35 of the Legal Framework of Credit Institutions and Financial Companies.

Anyone, whether Portuguese or foreign, that wants to acquire a Portuguese bank or a qualified holding in a Portuguese bank, or to increase an existing qualified holding above certain levels, must communicate that intention to the Bank of Portugal under the terms set forth in Articles 102 and following of the Legal Framework of Credit Institutions and Financial Companies.

For this purpose, a ‘qualified holding' is any direct or indirect participation that represents at least 10% of the share capital or voting rights of bank, or which for any reason makes it possible to exercise a significant influence on the management of the bank.

10 Consumer protection

10.1 What requirements must banks comply with to protect consumers in your jurisdiction?

At the beginning of the 2007/2008 financial crisis, the standards for consumer protection were strengthened.

Banks must always act in the interests of their customers and comply with consumer protection requirements in relation to matters such as the following:

information and transparency;
adequate and clear advertising;
maintenance of costumer complaint channels;
fair and equitable treatment;
privacy;
data protection;
prevention of conflicts of interest; and
protection in case of non-compliance.

Banks must also comply with the general consumer protection rules set out in the Consumer Protection Law, approved by Law 24/96 of 31 July 1996, as amended, as well as in the Legal Framework of General Contractual Clauses, approved by Decree-Law 446/85 of 25 October 1985, as amended.

10.2 How are deposits protected in your jurisdiction?

Deposits are protected by the Deposit Guarantee Fund, which is a legal person governed by public law, endowed with administrative and financial autonomy and its own assets, headquartered in Lisbon under the aegis of the Bank of Portugal, pursuant to Articles 154 and following of the Legal Framework of Credit Institutions and Financial Companies and Ordinance 285-B/95 of 15 September 1995 and the regulations of the Bank of Portugal.

Deposits are protected by the Deposit Guarantee Fund up to a limit of €100,000 per credit institution, per deposit holder.

11 Data security and cybersecurity

11.1 What is the applicable data protection regime in your jurisdiction and what specific implications does this have for banks?

The data protection regime applicable in Portugal is set out in:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation (GDPR); and
Law 58/2019 of 8 August 2019, which ensures the implementation in the national legal order of the GDPR.

Within the scope of compliance with the applicable data protection regime, banks must implement internal procedures to ensure adequate data protection, as well as to provide information and to report failures, among other things.

Banks are also subject to the banking secrecy regime, which states that members of the management or supervisory bodies of credit institutions, their employees, agents, commissioners and other persons who provide services on a permanent or occasional basis may not reveal or use information about facts or elements relating to the activities of the institution or its relations with its clients which arises exclusively from the exercise of their functions or the provision of their services.

11.2 What is the applicable cybersecurity regime in your jurisdiction and what specific implications does this have for banks?

The cybersecurity regime applicable in Portugal is set out in:

Law 46/2018 of 13 August 2018, which transposed Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 on measures to guarantee a high common level of network and information security across the Union into national law; and
Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on the European Union Agency for Cybersecurity and information and communications technology cybersecurity certification, and repealing Regulation (EU) 526/2013.

Banks are subject to specific rules regarding the reporting of cybersecurity incidents under Rule 21/2019 of the Bank of Portugal.

12 Financial crime and banking secrecy

12.1 What provisions govern money laundering and other forms of financial crime in your jurisdiction and what specific implications do these have for banks?

Money laundering, terrorist financing and other forms of financial crime are governed by:

the Penal Code, approved by Decree-Law 48/95 of 15 March 1995, as amended;
Law 83/2017 of 18 August 2017; and
Regulation 2/2018 of the Bank of Portugal.

It is also important to consider:

Articles 200 and following of the Legal Framework of Credit Institutions and Financial Companies, approved by Decree-Law 298/92 of 31 December 1992;
Articles 378 and following of the Portuguese Securities Code, approved by Decree-Law 486/99 of 13 November 1999;
the Legal Framework of Tax Infringements, approved by Law 15/2001 of 5 June 2001;
Law 52/2003 of 22 August 2003 on combating terrorism; and
Law 36/94 of 29 September 1994, laying down measures to combat corruption and economic and financial crime, all as amended.

Under the abovementioned legislation and regulations, banks must implement several internal control procedures to prevent and report money laundering and other forms of financial crime to the competent authorities, as well as verification and control procedures applicable in the context of establishing business relationships and/or carrying out occasional transactions.

12.2 Does banking secrecy apply in your jurisdiction?

Yes, banks are subject to the banking secrecy regime, under Articles 78 and following of the Legal Framework of Credit Institutions and Financial Companies. This states that members of the management or supervisory bodies of credit institutions, their employees, agents, commissioners and other persons who provide services on a permanent or occasional basis may not reveal or use information about facts or elements relating to the activities of the institution or its relations with clients which arises exclusively from the exercise of their functions or the provision of their services.

Certain exceptions to this banking secrecy rule are duly set forth in the law.

13 Competition

13.1 What specific challenges or concerns does the banking sector present from a competition perspective? Are there any pro-competition measures that are targeted specifically at banks?

Banks are subject to the general competition legislation, set out in Law 19/2012 of 8 May 2012.

Legitimate agreements between credit institutions and concerted practices are not considered to be restrictive of competition if they have as their object the following:

participation in issues and placements of securities or equivalent instruments; or
the granting of credit or other major financial support to a company or group of companies.

When applying the competition legislation to banks, banking best practices are duly considered, in particular as regards risk and solvency.

14 Recovery, resolution and liquidation

14.1 What options are available where banks are failing in your jurisdiction?

Where a bank does not comply or is at risk of non-compliance with legal or regulatory rules that govern its activities, including on a prudential level, the Bank of Portugal may impose corrective intervention and/or provisional administration measures, for a timeframe it deems appropriate, under Articles 139 and following of the Legal Framework of Credit Institutions and Financial Companies.

Within the scope of bank resolution measures, under Articles 145-C and following of the Legal Framework of Credit Institutions and Financial Companies, in exceptional cases the Bank of Portugal may opt for measures that involve the transfer of assets and/or liabilities, such as:

the partial or total sale of operations;
the partial or total transfer of operations to transition institutions;
segregation and partial or total transfer of operations to asset management vehicles; or
bail-in.

If the Bank of Portugal determines that the corrective intervention measures do not result in recovery or would be insufficient to result in recovery, or if after the application of resolution measures the Bank of Portugal verifies that the bank no longer fulfils the requirements for maintaining its authorisation to operate, the Bank of Portugal may revoke the authorisation, pursuant to the settlement regime provided for in the applicable legislation.

14.2 What insolvency and liquidation regime applies to banks in your jurisdiction?

The liquidation of credit institutions and financial companies headquartered in Portugal and their branches established in another EU member state is governed by Decree-Law 199/2006 of 25 October 2006, which transposed Directive 2001/24/EC of the European Parliament and of the Council of 4 April 2001 on the reorganisation and liquidation of credit institutions, as amended, into national law.

The Insolvency and Corporate Recovery Code, approved by Decree-Law 53/2004 of 18 March 2004, as amended, also applies to any matters which are not incompatible with the special regimes set forth for banking institutions.

15 Trends and predictions

15.1 How would you describe the current banking landscape and prevailing trends in your jurisdiction? Are any new developments anticipated in the next 12 months, including any proposed legislative reforms?

After a few years of recovery in the post-global financial crisis period, the COVID-19 pandemic has raised fresh concerns and it is expected that banks will suffer consequences resulting from the economic downturn that has affected most Portuguese companies and service providers.

The banking sector has become increasingly highly regulated in recent years, at both national and European level, and this trend is anticipated to continue.

Over the next 12 months, it is expected that banks' internal control duties and reporting and transparency duties will be increased.

It is also very likely that new legislation and regulation relating to technological innovations will emerge.

15.2 Does your jurisdiction regulate cryptocurrencies? Are there any legislative developments with respect to cryptocurrencies or fintech in general?

Cryptocurrencies are not regulated or supervised by the Bank of Portugal or any other authority in the financial system, whether national or European. In the near future cryptocurrencies and cryptocurrency intermediaries will be subject to regulation and supervision by the Bank of Portugal in terms similar to the ones currently applicable to financial institutions.

The absence of any regulations on cryptocurrencies does not automatically imply that related activities are illegal or prohibited. However, entities that issue and sell virtual currencies are not subject to authorisation by or registration with the Bank of Portugal, so their activities are subject to no prudential or behavioural supervision.

The Portuguese legislature's approach to fintech has been rather neutral so far. The existing fintech statutes are:

the Legal Regime of Payment Services and Electronic Currency, approved by Decree-Law 91/2018 of 12 November 2018; and
the crowdfunding regime, approved by Law 102/2015 of 24 August 2015 and by Law 3/2018 of 9 February 2018, and complemented by Regulation 1/2016 of the Portuguese Securities Commission.

Other than these, fintech has been the subject only of a few alerts and references scattered through some instruments.

16 Tips and traps

16.1 What are your top tips for banking entities operating in your jurisdiction and what potential issues would you highlight?

Banking entities operating in Portugal should have a solid grasp of the rules and regulations governing the banking sector in Portugal, since non-compliance is sanctioned with heavy fines and may impair future fit and proper assessments of the qualifying holders and corporate bodies of such entities.

Banking entities must also be prepared for a lengthy and demanding process when filing for authorisation to provide banking activities, to set up a branch or to set up a representative office in Portugal.

Even when resorting to more flexible solutions – for example, availing of the free movement of services regime to render services in Portugal – banking entities must be aware of the need to ensure full compliance with national rules to the extent applicable.

Internal control, risk management and anti-money laundering measures are of the utmost importance, to avoid regulatory and reputational risks; and specialist advice should be sought on a regular basis.

The use of virtual platforms to render banking services is also proving to be a profitable and cost-effective path; but again, this requires a thorough assessment to ensure full compliance with national rules and regulations.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Portugal: Banking Regulation Comparative Guide