CSSF endorses final revised Guidelines on major incident reporting under PSD2

On 20 December 2021, the CSSF published Circular 21/787, which applies the European Banking Authority’s (EBA) final revised Guidelines on major incident reporting under PSD2 of June 2021 (the “Guidelines").

The new Guidelines will be effective as from 1 January 2022 in Luxembourg.
 

What changes do the revised Guidelines introduce?

Due to the complexity of the major incident reporting requirement, the new Guidelines aim to simplify the reporting process and the underlying reporting template. These include:

• Changes to the incident classification criterion thresholds;
• Inclusion of a new criterion regarding the security breach of network or information systems;
• Extension of the report submission deadlines; and
• Use of a common standardized file for reporting major incidents to competent authorities.

It is estimated these changes will reduce reportable incidents by more than 10%, easing the reporting burden of payment service providers.

If you require further information, please contact us.