Guidelines on fraud reporting under PSD2

EBA/GL/2020/01 22 January 2020

Guidelines amending Guidelines EBA/GL/2018/05

on fraud reporting under the Payment Services Directive (PSD2)

Contents

1. Executive Summary 3

2. Background and rationale 4

3. Guidelines 6

4. Accompanying documents 13 4.1 View of the Banking Stakeholder Group (BSG) 13

1. Executive Summary

Article 96(6) of Directive (EU) 2015/2366 on payment services in the internal market (PSD2) requires all payment service providers (PSPs) to report ‘statistical data on fraud relating to different means of payment to their competent authorities’ and that competent authorities (CAs) provide, in turn, ‘EBA and the ECB with such data in an aggregated form’.

In order to ensure that these requirements are implemented consistently across Member States and that the aggregated data provided to the EBA and the ECB are comparable and reliable, the EBA, in close cooperation with the ECB, developed guidelines addressed to PSPs and CAs setting out requirements on how fraud data should be reported under Article 96(6) PSD2. These Guidelines were developed and publicly consulted on in 2017, finalised and published in July 2018, apply since 1 January 2019, and the first reporting of aggregated data from CAs to the EBA and the EBA is due by the end of 2019.

However, after the publication of the Guidelines, the European Commission issued clarifications through the EBA’s Q&A tool on the interpretation of the Directive, regarding the application of requirements on strong customer authentication (SCA) under PSD2 to card-based payments initiated by the payee and to card-based payments where the payer’s PSP or the payee’s PSP is located outside the European Union.

In order to ensure that these transactions can be reported in a manner that is consistent and in line with the clarifications provided by the Commission, minor consequential amendments to the Guidelines are necessary. More specifically, the Guidelines need to be amended because they do currently not foresee a specific data field for reporting transactions where SCA is not applied for reasons other than an exemption in Articles 11 to 18 of the Commission Delegated Regulation (EU) 2018/389. These Amending Guidelines therefore introduce two additional reporting fields in the Data Breakdowns C, D, and F in Annex 2 of the Guidelines.

These amendments will apply to the reporting of payment transactions initiated and executed from 01.07.2020.

The EBA, together with the ECB, have aimed at introducing these changes such that they are aligned with the draft revised ECB Regulation on payment statistics.

The EBA has not conducted an open public consultation or a cost-benefit analysis considering that such a consultation or analysis would be disproportionate in relation to the scope, scale and impact of the amendments and considering the consequential nature and urgency of these amendments.

In addition to the above, some editorial changes to the Guidelines were introduced for clarity.

Next steps

The Guidelines will be translated into the official EU languages and published on the EBA website. The deadline for competent authorities to report whether they comply with the amended Guidelines will be two months after the publication of the translations. The Guidelines will apply from 01.07.2020.

2. Background and rationale

1. Article 96(6) of PSD2 requires all payment service providers (PSPs) to report ‘statistical data on fraud relating to different means of payment to their competent authorities’ and that competent authorities (CAs) provide, in turn, ‘EBA and the ECB with such data in an aggregated form’.

2. In order to ensure that these requirements are implemented consistently by Member States and that the aggregated data provided to the EBA and the ECB are comparable and reliable, the EBA, in close cooperation with the ECB, developed guidelines addressed to PSPs and CAs setting out requirements on how fraud data should be reported under Article 96(6) PSD2. These Guidelines were developed and publicly consulted on in 2017, finalised and published in July 2018, apply since 1 January 2019, and the first reporting of aggregated data from CAs to the EBA and the EBA is due by the end of 2019

3. The Guidelines require PSPs to report half-yearly data to CAs based on the Data Breakdown(s) specified in Annex 2 of the guidelines, within the timelines set by the relevant CA. In turn, CAs should send the aggregated data to the ECB and the EBA within six months from the end of the reporting period.

4. However, after the publication of the Guidelines, the European Commission issued clarifications through the EBA’s Q&A tool on the interpretation of the Directive, regarding the application of requirements on strong customer authentication (SCA) under PSD2 to: - card-based payments that meet the conditions specified by the EC in Q&A 2018_4031 and Q&A 2018_4131 (the so-called “Merchant initiated transactions” or “MITs”); and - card-based payments where either the payer’s PSP (the issuer) or the payee’s PSP (the acquirer) is located outside the Union (the so-called ‘one-leg’ transactions) .

5. As a result of said clarifications of the Directive, and in order to ensure that fraud data regarding these transactions are reported in a consistent and correct manner across Member States, it is necessary to introduce consequential amendments to the Data Breakdowns in Annex 2 of the Guidelines. This consists of introducing two new additional fields in the Data Breakdowns C, D and F of Annex 2 for reporting of MITs and of ‘one-leg’ card-based payment transactions where SCA is not applied for reasons other than an exemption in Articles 11 to 18 of the Commission Delegated Regulation (EU) 2018/389.

6. Some validation rules, explanatory footnotes, and breakdown headings in relation to these new fields/categories had to be changed accordingly, too. In addition, some editorial changes to the guidelines were introduced for clarity.

7. These Guidelines are issued on the basis of Article 16 of the EBA Regulation.

Guidelines amending Guidelines EBA/GL/2018/05 on fraud reporting under the Payment Services Directive (PSD2) 1. Compliance and reporting obligations

Status of these guidelines

1. This document contains guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/2010 . In accordance with Article 16(3) of Regulation (EU) No 1093/2010, competent authorities and financial institutions must make every effort to comply with the guidelines.

2. Guidelines set the EBA view of appropriate supervisory practices within the European System of Financial Supervision or of how Union law should be applied in a particular area. Competent authorities as defined in Article 4(2) of Regulation (EU) No 1093/2010 to whom guidelines apply should comply by incorporating them into their practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where guidelines are directed primarily at institutions.

Reporting requirements

3. According to Article 16(3) of Regulation (EU) No 1093/2010, competent authorities must notify the EBA as to whether they comply or intend to comply with these guidelines, or otherwise with reasons for non-compliance, by (dd.mm.yyyy). In the absence of any notification by this deadline, competent authorities will be considered by the EBA to be non-compliant. Notifications should be sent by submitting the form available on the EBA website to compliance@eba.europa.eu with the reference ‘EBA/GL/2020/01’. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities. Any change in the status of compliance must also be reported to EBA.

2. Addressees

5. These guidelines are addressed to:  payment service providers as defined in Article 4(11) of Directive (EU) 2015/2366 (PSD2) and as referred to in the definition of ‘financial institutions’ in Article 4(1) of Regulation (EU) No 1093/2010, except account information service providers, and to  competent authorities as defined in point (vi) of Article 4(2) of Regulation (EU) No 1093/2010.

3. Implementation

Date of application

6. These guidelines apply to the reporting of payment transactions initiated and executed from 01.07.2020.

4. Amendments

7. Guidelines EBA/GL/2018/05 on fraud reporting under the PSD2 are amended as follows: (1) The last sentence in paragraph 14 of Section 2 (Subject matter, scope and definitions) of the guidelines is amended as follows: ‘The data relating to these exemptions are detailed in Annex 2 in Data Breakdowns A (1.3.1.2.4 to 1.3.1.2.9 and 1.3.2.2.4 to 1.3.2.2.8), C (3.2.1.3.4 to 3.2.1.3.810 and 3.2.2.3.4 to 3.2.2.3.78), D (4.2.1.3.4 to 4.2.1.3.6 8 and 4.2.2.3.4 to 4.2.2.3.67) and F (6.1.2.4 to 6.1.2.911 and 6.2.2.4 to 6.2.2.78)’. (2) Section 3.1 (Guidelines on fraud reporting applicable to Payment Service Providers) of the guidelines is amended as follows: (a) Paragraph (d) of Guideline 7.3 is amended as follows: ‘d. reason for not applying strong customer authentication (referring to the exemptions to strong customer authentication detailed in chapter 3 of the Regulatory technical standards on strong customer authentication and common and secure communication, Commission Delegated Regulation (EU) 2018/389, or to either of the categories “Merchant initiated transactions” and “Other”, where applicable), and’ (b) Paragraph (d) of Guideline 7.8 is amended as follows: ‘d. reason for not applying strong customer authentication (referring to exemptions to strong customer authentication detailed in chapter 3 of the RTS on SCA and CSC, or to either of the categories “Merchant initiated transactions” and “Other”, where applicable), (c) Guideline 7.15 is amended as follows: ‘7.15 The payment service provider (issuer) should provide data in accordance with Data Breakdown E in Annex 2 for all cash withdrawals and fraudulent cash withdrawals through apps, at ATMs (including via apps), at bank counters and through retailers (‘cash back’) using a card’. (3) The Data Breakdown C in Annex 2 of the guidelines is amended as follows: (a) The title of Data Breakdown C is amended as follows: ‘C- Data breakdown for card-based payment transactions to be reported by the issuer’s issuing payment service provider’ (b) Two additional data fields 3.2.1.3.9 and 3.2.1.3.10 are added to Data Breakdown C as follows: 3.2.1.3.9 Merchant initiated transactions (*) X X 3.2.1.3.10 Other X X __________ (*) i.e, card-based payment transactions that meet the conditions specified by the European Commission in Q&A 2018_4131 and Q&A 2018_4031 and which are, as a result, considered as payee initiated and not subject to the requirement in Article 97 PSD2 to apply SCA (c) An additional data field 3.2.2.3.8 is added to Data Breakdown C as follows: 3.2.2.3.8 Other X X (d) The last row of the validation rules under Data Breakdown C is amended as follows: 3.2.1.3.4 + 3.2.1.3.5 + 3.2.1.3.6 + 3.2.1.3.7 + 3.2.1.3.8 + 3.2.1.3.9 + 3.2.1.3.10 = 3.2.1.3; 3.2.2.3.4 + 3.2.2.3.5 + 3.2.2.3.6 + 3.2.2.3.7 + 3.2.2.3.8 = 3.2.2.3 (4) The Data Breakdown D in Annex 2 of the guidelines is amended as follows: (a) The title of Data Breakdown D is amended as follows: ‘D- Data breakdown for card-based payments transactions to be reported by the acquirer’s acquiring payment service provider (with a contractual relationship with the payment service user)’ (b) Two additional data fields 4.2.1.3.7 and 4.2.1.3.8 are added to Data Breakdown D as follows: 4.2.1.3.7 Merchant initiated transactions (*) X X 4.2.1.3.8 Other X X __________ (*) See footnote 4 (c) An additional data field 4.2.2.3.7 is added to Data Breakdown D as follows: 4.2.2.3.7 Other X X (d) The last row of the validation rules under Data Breakdown D is amended as follows: 4.2.1.3.4 + 4.2.1.3.5 + 4.2.1.3.6 + 4.2.1.3.7 + 4.2.1.3.8 = 4.2.1.3; 4.2.2.3.4 + 4.2.2.3.5+ 4.2.2.3.6 + 4.2.2.3.7 = 4.2.2.3 (5) The Data Breakdown E in Annex 2 of the Guidelines is amended as follows: (a) Data Breakdown E is amended as follows: Fraudulent Payment Item payment transactions transactions 5 Cash withdrawals X X Of which broken down by card function 5.1 Of which payments cash withdrawals with X X cards with a debit function 5.2 Of which payments cash withdrawals with X X cards with a credit or delayed debit function of which fraudulent card payments cash withdrawals by fraud types: 5.23.1 Issuance of a payment order (cash X withdrawal) by the fraudster 5. 23.1.1 Lost or stolen card X 5. 23.1.2 Card not received X 5. 23.1.3 Counterfeit card X 5. 23.1.4 Other X 5. 23.2 Manipulation of the payer to make a cash X withdrawal (b) The validation rules under Data Breakdown E are amended as follows: 5.1 + 5.2 = 5 5.23.1 + 5.23.2 = 5 5.23.1.1 + 5.23.1.2 + 5.23.1.3 + 5.23.1.4 = 5.23.1 (6) The Data Breakdown F in Annex 2 of the guidelines is amended as follows: (a) Two additional data fields 6.1.2.10 and 6.1.2.11 are added to Data Breakdown F as follows: 6.1.2.10 Merchant initiated transactions (*) X X 6.1.2.11 Other X X __________ (*) See footnote 4 (b) An additional data field 6.2.2.8 is added to Data Breakdown F as follows: 6.2.2.8 Other X X (c) The last row of the validation rules under Data Breakdown F is amended as follows: 6.1.2.4 + 6.1.2.5 + 6.1.2.6 + 6.1.2.7 + 6.1.2.8 + 6.1.2.9 + 6.1.2.10 + 6.1.2.11 = 6.1.2; 6.2.2.4 + 6.2.2.5 + 6.2.2.6 + 6.2.2.7 + 6.2.2.8 = 6.2.2

4. Accompanying documents

4.1 View of the Banking Stakeholder Group (BSG)

The BSG was consulted on the draft Recommendation and did not provide any comments.