CESOP: update on local implementation of new EU VAT reporting obligations

We are pleased to provide an update on initiatives being taken in Malta to implement the EU-level framework for the reporting and sharing of merchant payment data through the EU-wide CESOP (Central Electronic System Of Payment Information) database. 

This new reporting obligation, which comes into effect from 1 January 2024, applies to all banks and payment service providers that execute cross-border payments falling within scope of the revised EU Payment Services Directive (PSD2).

In recent weeks, the Maltese Parliament approved the Budget Measures Implementation Act 2023 that paves the way for the introduction of new rules implementing CESOP in Malta, whilst new administrative penalties have been introduced in cases of non-compliance.

CESOP implementation status in Malta

CESOP implementation has gathered pace with the publication of the Budget Measures Implementation Act 2023 (‘Budget Act’) on 4 April 2023. The Budget Act enacts a new article to the VAT Act which formally introduces an obligation to provide information for VAT purposes upon a request by the Office of the Commissioner for Revenue (CfR).

Pursuant to this new provision, the Minister for Finance may prescribe requirements for any person to retain and furnish the CfR with such information as may be required to combat VAT fraud. We understand that this is an enabling provision for the introduction of rules implementing CESOP in Malta.

At present, the local rules implementing CESOP in Maltese law are yet to be published. We understand that these rules are expected to be published during the second half of 2023. Currently, we do not anticipate substantial deviations from the agreed EU-level framework as regards Malta’s implementation of CESOP.

CESOP information collection and reporting

The information required to be reported through CESOP shall be collected and reported electronically to the CfR via a dedicated online portal every calendar quarter within one month. Accordingly, the first CESOP filing period will cover reportable payments made during Q1 2024, with qualifying banks and PSPs required to make the requisite CESOP filings by no later than 30 April 2024.

We understand the Malta CESOP portal is expected to be launched during the last quarter of 2023. No extensions to filing deadlines are currently foreseen, with the European Commission invariably indicating that qualifying banks and PSPs are expected to be fully CESOP-compliant within the set timeframes.

Sanctions for non-compliance

The Budget Act has introduced a new administrative penalty whereby, in cases where the information required is not furnished within the prescribed time limit, the person in default shall be liable to an administrative penalty of €50 for every month or part thereof that elapses from the date by which the information should have been furnished and the date when it is actually furnished to the CfR. The total administrative penalty is currently capped at €600 for every time the information is not duly provided.

It is also pertinent to note that CESOP reporting failures may also be prosecuted under the criminal law provisions of the VAT Act, with joint and several personal liability imposed on the directors, managers and other key officers of the defaulting bank or PSP.

Considering the fast-approaching implementation date and the potential sanctions for non-compliance, it is critical to ensure that by now you have at the very least carried out a high-level impact assessment with a view to ascertaining whether you fall within the scope of CESOP reporting obligations, and if so to develop a CESOP compliance and reporting roadmap accordingly.