EBA publishes final revised Guidelines on major incident reporting under PSD2

On 10 June 2021, the European Banking Authority (EBA) published the final revised Guidelines on major incident reporting under PSD2 (EBA/GL/2021/03).
 

How do you currently manage your payment incident reporting? Are you ready to adapt your procedures and processes?

At Deloitte, we have deep knowledge of payment incident reporting, working with numerous clients in Luxembourg and abroad.

We have also launched an online incident reporting solution that helps payment service providers classify their incidents with a severity calculator, and manage their reports to ensure they submit the relevant information to the CSSF within the expected timeframe.
 

What will change in the revised Guidelines?

According to Article 96 of Directive (EU) 2015/2366 on payment services in the internal market, payment services providers must identify and assess the impact of all payment incidents. If any incident is considered major, they must report this incident to the competent authority in their home Member State within four hours. They must also submit additional reports at a later stage to inform the regulator of the incident’s status and root cause.

Acknowledging the complexity of this reporting requirement, the EBA recently introduced a list of changes to optimize and simplify the PSD2 major incident reporting process and the underlying reporting template. These include:

• Changes to the incident classification criterion thresholds;
• Inclusion of a new criterion on the security breach of network or information systems;
• Extension of the report submission deadlines; and
• Use of a common standardized file for reporting major incidents to competent authorities.

Following these changes, it is estimated that reportable incidents will reduce by more than 10%, easing the reporting burden of payment service providers. These new guidelines will become effective as of 1 January 2022.

If you require further information, please contact us.