On Wednesday 18 June, the European Banking Authority (EBA) published its final guidelines on the declaration of fraudulent operations by payment service providers.
Under the revised payment services directive (PSD2), which entered into force on 13 January of this year (see EUROPE 11938), the guidelines require the payment service providers of the 28 member states of the EU to collect and communicate data on fraudulent payment operations using a common methodology.
Following its public consultation of August 2017, the EBA decided to make a few changes to its text.
In particular, the number of categories of reportable fraudulent operations has fallen from three to two, specifically unauthorised transactions and manipulation of the payer. Fraudulent operations in which the payer is the fraudster had been removed from the scope of application of the guidelines.
For the last of these categories, the EBA acted on the arguments raised during the public consultation, establishing that fraud of this kind was not within the control of the payment service providers and should therefore not be reported by them, it explained.
It is worth noting that the final guidelines no longer require the quarterly communication of high-level data and a set of more detailed data on an annual basis, but the notification of a uniform set of data on a semi-annual basis instead.
Several stakeholders had referred to the disproportionate burden that this imposed on service providers in terms both of the frequency and level of detail required.
The guidelines also set out an exemption to this rule for small payment institutions and electronic money institutions, which will be required only to present an annual report.
The other requirements proposed in the text submitted for consultation remain unchanged. The guidelines will apply from 1 January 2019. (Original version in French by Marion Fontana)