8543/1/26 REV 1

EN

Council of the European Union

Brussels, 4 November 2026 (OR. en)

8543/1/26 REV 1

EF 129 ECOFIN 524 CODEC 759

ECB PARLNAT

Interinstitutional File: 2023/0210(COD)

LEGISLATIVE ACTS AND OTHER INSTRUMENTS

Subject: Position of the Council at first reading with a view to the adoption of a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on payment services in the internal market and amending Regulations (EU) No 1093/2010, (EU) No 260/2012, (EU) 2017/2394 and (EU) 2021/1230 – Adopted by the Council on 29 October 2026

8543/1/26 REV 1 1

EN

REGULATION (EU) 2026/…

OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of …

on payment services in the internal market

and amending Regulations (EU) No 1093/2010, (EU) No 260/2012,

(EU) 2017/2394 and (EU) 2021/1230

(Text with EEA relevance)

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114

thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Having regard to the opinion of the European Central Bank1,

Having regard to the opinion of the European Economic and Social Committee2,

Acting in accordance with the ordinary legislative procedure3,

1 OJ C, C/2024/3869, 19.6.2024, ELI: http://data.europa.eu/eli/C/2024/3869/oj. 2 OJ C, C/2024/1594, 5.3.2024, ELI: http://data.europa.eu/eli/C/2024/1594/oj. 3 Position of the European Parliament of 23 April 2024 (OJ C, C/2025/3725, 17.9.2025,

ELI: http://data.europa.eu/eli/C/2025/3725/oj) and position of the Council at first reading

of 29 October 2026 (not yet published in the Official Journal). Position of the European

Parliament of … (not yet published in the Official Journal).

8543/1/26 REV 1 2

EN

Whereas:

(1) Since the adoption of Directive (EU) 2015/2366 of the European Parliament and of the

Council4, the retail payment services market has undergone significant changes largely

related to the increasing use of cards and digital means of payment, the decreasing use of

cash and the growing presence of new players and services, including digital wallets and

contactless payments. The COVID-19 pandemic and the transformations it brought to

consumption and payment practices have increased the importance of having secure and

efficient payments.

(2) The communication of the Commission of 24 September 2020 on a Retail Payments

Strategy for the EU announced the launch of a comprehensive review of the application

and impact of Directive (EU) 2015/2366 which was to include an overall assessment of

whether it was still fit for purpose, taking into account market developments.

4 Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November

2015 on payment services in the internal market, amending Directives 2002/65/EC,

2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive

2007/64/EC (OJ L 337, 23.12.2015, p. 35, ELI: http://data.europa.eu/eli/dir/2015/2366/oj).

8543/1/26 REV 1 3

EN

(3) Directive (EU) 2015/2366 aimed to remove barriers to new types of payment services and

to improve the level of consumer protection and security. The evaluation by the

Commission of the impact and application of Directive (EU) 2015/2366 found that

Directive (EU) 2015/2366 has been largely successful with regard to many of its

objectives, but also identified certain areas where the objectives of that Directive have not

been met. For example, the evaluation identified the rise in new types of fraud as an issue

of concern with regard to consumer protection objectives. Shortcomings were also

identified with regard to the objective of improving competition in the market through

open banking services, namely account information services and payment initiation

services, by lowering market barriers faced by third-party providers. Progress towards the

objective of improving the provision of cross-border payment services has also been

limited, largely due to inconsistencies in supervisory practices and enforcement across the

Union. That evaluation also identified factors stifling progress concerning the objective of

levelling the playing field between all payment service providers.

8543/1/26 REV 1 4

EN

(4) The evaluation of the impact and application of Directive (EU) 2015/2366 also identified

problems regarding divergent implementation and enforcement of that Directive which

have directly impacted competition between payment service providers by leading to

effectively different regulatory conditions in Member States, encouraging regulatory

arbitrage. There should be no room for forum shopping whereby a payment service

provider would choose as its home country a Member State in which the application of

Union rules on payment services is more advantageous for it while providing cross-border

services in Member States which apply a stricter interpretation of the rules or more active

enforcement policies with regard to payment service providers established there. That

practice distorts competition. Union rules on payment services should therefore be further

harmonised, by incorporating rules governing the conduct of payment service activities,

including the rights and obligations of the parties involved, in a Regulation. Such rules,

excluding those relating to the authorisation and supervision of payment institutions, which

should remain in a Directive, should be clearer and more detailed, thus minimising the

margin for interpretation.

8543/1/26 REV 1 5

EN

(5) While the issuance of electronic money is regulated under Directive 2009/110/EC of the

European Parliament and of the Council5 the use of electronic money to fund payment

transactions is to a very large extent regulated by Directive (EU) 2015/2366. Consequently,

the legal framework applicable to electronic money institutions and payment institutions,

in particular with regard to the conduct of business rules, is already substantially aligned.

To address external coherence issues and given the fact that electronic money services and

payment services are increasingly hard to distinguish, the legislative frameworks

concerning electronic money institutions and payment institutions should be brought closer

together. However, the authorisation requirements, in particular initial capital and own

funds, and some key basic concepts governing the electronic money business such as the

issuance, distribution and redemption of electronic money, are distinct from the services

provided by payment institutions. It is therefore appropriate to preserve those specificities

when merging the provisions of Directives 2009/110/EC and (EU) 2015/2366. Since

Directive 2009/110/EC is repealed by Directive (EU) 2026/… of the European Parliament

and of the Council6+, its rules, with the exception of the rules on authorisation and

supervision, which have been incorporated in Directive (EU) 2026/…++, should be brought

into a unified framework under this Regulation, with appropriate adjustments.

5 Directive 2009/110/EC of the European Parliament and of the Council of 16 September

2009 on the taking up, pursuit and prudential supervision of the business of electronic

money institutions amending Directives 2005/60/EC and 2006/48/EC and repealing

Directive 2000/46/EC (OJ L 267, 10.10.2009, p. 7,

ELI: http://data.europa.eu/eli/dir/2009/110/oj). 6 Directive (EU) 2026/… of the European Parliament and of the Council of … on payment

services in the internal market amending Directive 98/26/EC and Regulation

(EU) 2023/1114 and repealing Directives (EU) 2009/110/EC and 2015/2366

(OJ L …, ELI: …). + OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)) and fill in corresponding details in the footnote. ++ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 6

EN

(6) To ensure legal certainty and a clear scope of application of the rules applicable to the

provision of payment services and electronic money services, it is necessary to specify the

categories of payment service providers which are subject to the obligations concerning the

provision of payment services and electronic money services throughout the Union.

(7) There are several categories of payment service providers. Credit institutions take deposits

from users that can be used to execute payment transactions. They are authorised pursuant

to Directive 2013/36/EU of the European Parliament and of the Council7. Payment

institutions are not allowed to take deposits. They can hold users funds and issue electronic

money that can be used to execute payment transactions. They are authorised pursuant to

Directive (EU) 2026/…+. Post office giro institutions which are entitled to do so under

national law can also provide electronic money and payment services. Other categories of

payment service providers include the European Central Bank (ECB) and national central

banks when not acting in their capacity as monetary authority or other public authorities,

and Member States or their regional or local authorities when not acting in their capacity as

public authorities.

7 Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on

access to the activity of credit institutions and the prudential supervision of credit

institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and

2006/49/EC (OJ L 176, 27.6.2013, p. 338, ELI: http://data.europa.eu/eli/dir/2013/36/oj). + OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 7

EN

(8) The exclusion from the scope of Directive (EU) 2015/2366 of certain categories of

operators of automated teller machines (ATM) has proven difficult to apply in practice.

Therefore, the category of ATM deployers, which was excluded from the requirement to

be authorised as a payment service provider under Directive (EU) 2015/2366, should be

replaced by a new category of ATM deployers which do not service payment accounts.

Those deployers, which are subject to registration under Directive (EU) 2026/…+, should

be subject to requirements on fees transparency in situations where such ATM deployers

levy charges for cash withdrawals.

(9) To further improve access to cash, retailers should be allowed to offer, in physical shops,

cash withdrawal services even when no purchase is made by a customer, without having to

obtain a payment service provider authorisation, registration or being an agent of a

payment institution. Those cash withdrawal services should, however, be subject to the

obligation to disclose any fees charged to the customer. Those services should be provided

by retailers on a voluntary basis and should depend on the availability of cash at the

retailer.

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 8

EN

(10) The exclusion from the scope of Directive (EU) 2015/2366 of payment transactions from

the payer to the payee through a commercial agent acting on behalf of the payer or the

payee has been applied very differently across Member States. The concept of commercial

agents is typically defined in national civil law, which might diverge from Member State to

Member State, leading to inconsistent treatment of the same services in different

jurisdictions. The concept of commercial agents under that exclusion should therefore be

harmonised. In addition, further clarity should be provided on the conditions under which

payment transactions from the payer to the payee through commercial agents may be

excluded from the scope of this Regulation. To that end, commercial agents should be

authorised via an agreement with either the payer or the payee to negotiate or conclude the

sale or purchase of goods or services on behalf of only the payer or only the payee, but not

both of them, regardless of whether or not the commercial agent is in the possession of

client’s funds. Electronic commerce platforms that act as commercial agents on behalf of

both individual buyers and sellers without either party having any actual scope or

autonomy to negotiate or to conclude the sale or purchase of goods or services should not

be excluded from the scope of this Regulation. The European Supervisory Authority

(European Banking Authority) (EBA), established by Regulation (EU) No 1093/2010 of

the European Parliament and of the Council8, should develop guidelines on the exclusion

for payment transactions from the payer to the payee through a commercial agent to

provide further clarity and convergence among competent authorities. Those guidelines

could include a repository of use cases typically covered by the commercial agent

exclusion.

8 Regulation (EU) No 1093/2010 of the European Parliament and of the Council

of 24 November 2010 establishing a European Supervisory Authority (European Banking

Authority), amending Decision No 716/2009/EC and repealing Commission Decision

2009/78/EC (OJ L 331, 15.12.2010, p. 12, ELI: http://data.europa.eu/eli/reg/2010/1093/oj).

8543/1/26 REV 1 9

EN

(11) The exclusion from the scope of Directive (EU) 2015/2366 of specific-purpose instruments

has been applied differently across Member States, although service providers whose

instruments were covered by that exclusion were required to notify their activity to the

competent authorities. EBA provided further guidance in its guidelines

of 24 February 2022. Despite those attempts to clarify the application of the exclusion

related to specific-purpose instruments, there are still service providers that seek to make

use of that exclusion while providing services which involve substantial payment volumes

and a variety of products offered to a large number of customers. In such cases, consumers

do not benefit from the necessary safeguards and the services concerned should not benefit

from the exclusion for specific-purpose instruments. Therefore, it is necessary to clarify

that it should not be possible to use the same specific-purpose instrument to make payment

transactions to acquire goods and services within more than one limited network or to

acquire an unlimited range of goods and services.

8543/1/26 REV 1 10

EN

(12) To assess whether a limited network is excluded from the scope of this Regulation, the

geographical location and number of the points of acceptance of that network should be

considered. Specific-purpose instruments should allow the holder to acquire goods or

services only in the physical premises or online stores of the issuer. Specific-purpose

instruments should include, depending on the respective contractual regime, cards that can

only be used in a particular chain of stores or a particular shopping centre, fuel cards,

membership cards, public transport cards, parking ticketing, meal vouchers or vouchers for

specific services, which might be subject to a specific tax or labour legal framework

designed to promote the use of such instruments to meet the objectives laid down in social

legislation, such as childcare vouchers or ecological vouchers. At the same time, Member

States’ regulatory environment for vouchers should ensure the acceptability of such

vouchers. Specific-purpose instruments should also include electronic money-based

instruments once they meet the requirements of the exclusion. Payment instruments which

can be used for purchases in stores of listed merchants should not be excluded, as such

instruments are typically designed for a continuously growing network of service

providers.

8543/1/26 REV 1 11

EN

(13) The exclusion relating to certain payment transactions by means of telecom or information

technology devices should focus specifically on micro-payments for digital content and

voice-based services. A clear reference to payment transactions for the purchase of

electronic tickets should be kept so that customers can still easily order, pay for, obtain and

validate electronic tickets from any location and at any time using mobile phones or other

devices. Electronic tickets allow and facilitate the delivery of services that consumers

could otherwise purchase in paper ticket form and include transport, entertainment, car

parking and entry to venues, but exclude physical goods. Payment transactions executed by

a specified provider of electronic communications networks from or via an electronic

device and charged to the corresponding invoice to collect charitable donations should also

be excluded. That exclusion should apply only where the value of payment transactions is

below a specified threshold. For the exclusion to apply, the telecommunications operator

should provide the payment services in addition to the electronic communications services

it provides to its subscribers. That implies that there is a direct contractual arrangement

between the telecommunications operator and the subscriber for the provision of the

electronic communications services and that the payment service is an additional service to

those services. There are situations in which a digital content provider or the provider of

services, for which the subscriber has paid through its own telecommunication operator,

makes use of further service providers (‘intermediaries’) for the collection and transfer of

the funds. Although those intermediaries, including beneficiary operators, collection

operators, and transit operators, may also provide electronic communications services, they

cannot benefit from the exclusion, as they do not have a direct contractual relationship with

the subscriber regarding the provision of electronic communications services.

8543/1/26 REV 1 12

EN

(14) The Single Euro Payments Area (SEPA) has facilitated the creation of Union-wide

payment factories and collection factories, allowing for the centralisation of payment

transactions of the same group. In that respect, payment transactions and related services

between a parent undertaking and its subsidiary or between subsidiaries of the same parent

undertaking which are provided by a payment service provider belonging to the same

group should be excluded from the scope of this Regulation, including the redistribution

through intragroup payment transactions of funds received from external third parties on

behalf of group entities as well as the collection of payment orders and payment funds on

behalf of a group by a parent undertaking or its subsidiary for onward transmission and

processing to a payment service provider providing payment services to the group. Insofar

as public service operators within the meaning of Regulation (EC) No 1370/2007 of the

European Parliament and of the Council9 handle equalisation payments and revenue

sharing within a closed payment processing system of transport operators or via their

clearing centres, tariff organisations or associations, those payment transactions should

also be excluded from the scope of this Regulation. Those exclusions should not be used to

circumvent or evade Union or national law in the field of anti-money laundering and

countering the financing of terrorism or the rules on authorisation and supervision of

payment institutions.

9 Regulation (EC) No 1370/2007 of the European Parliament and of the Council of 23

October 2007 on public passenger transport services by rail and by road and repealing

Council Regulations (EEC) Nos 1191/69 and 1107/70 (OJ L 315, 3.12.2007, p. 1,

ELI: http://data.europa.eu/eli/reg/2007/1370/oj).

8543/1/26 REV 1 13

EN

(15) The provision of payment services requires the support of technical services. Those

technical services include the processing and storage of data, payment gateway services,

trust services, privacy protection services, data and entity authentication, the provision of

information and communication technology (ICT) and communication networks, and the

provision and maintenance of consumer-facing interfaces used to collect payment

information, including terminals and devices used for payment services. Payment initiation

services and account information services are not technical services.

(16) Technical services do not constitute payment services insofar as technical service providers

do not enter at any time into possession of the funds to be transferred. They should

therefore be excluded from the definition of payment services. Those services should

however be subject to certain requirements, such as those on liability for failure to support

the application of strong customer authentication, which should be limited to direct

financial damage and should not exceed the amount of the transaction concerned, or the

requirement to enter into outsourcing agreements with payment service providers where

technical service providers are to provide and verify the elements of strong customer

authentication. There should also be requirements governing the termination fees of

framework contracts where payment services are offered jointly with technical services.

8543/1/26 REV 1 14

EN

(17) Taking into account the rapid evolution of the retail payments market and the emergence of

new payment services and payment solutions, it is appropriate to adapt some of the

definitions in Directive (EU) 2015/2366 to the realities of the market in order to ensure that

Union legislation remains fit for purpose and technology neutral.

(18) The clarification of the process and the various steps to be followed for the execution of a

payment transaction is of significant importance for the rights and obligations of the parties

involved in a payment transaction and for the application of strong customer

authentication. The process leading to the execution of a payment transaction is either

initiated by the payer or on that payer’s behalf, or by the payee. The payer initiates the

payment transaction by placing a payment order. Once the payment order is placed, the

payment service provider checks whether the transaction has been authorised and

authenticated including, where applicable, by applying strong customer authentication, and

the payment service provider then validates the payment order. The payment service

provider then takes the relevant steps to execute the payment transaction, including the

transfer of funds.

8543/1/26 REV 1 15

EN

(19) Given the diverging views identified by the Commission in its review of the

implementation of Directive (EU) 2015/2366 and highlighted by EBA in its opinion

of 23 June 2022 on the review of Directive (EU) 2015/2366, it is necessary to clarify the

definition of a payment account. The determining criterion for the categorisation of an

account as a payment account lies in the ability to perform daily payment transactions from

such an account. The possibility of making payment transactions to a third party from an

account or of benefiting from such transactions carried out by a third party is a defining

feature of the concept of a payment account. A payment account should therefore be

defined as an account that can be used for sending and receiving funds to and from third

parties. Any account that possesses those characteristics should be considered a payment

account and should be accessible for the provision of payment initiation services and

account information services. In certain cases, such as that of a credit card account or

where an account is used only for the execution of one transaction, a case-by-case analysis

should be carried out to determine whether that account possesses those characteristics.

Situations where another intermediary account is needed to execute payment transactions

from or to third parties should not fall under the definition of a payment account. Savings

accounts that cannot be used for sending and receiving funds to or from a third party are

therefore excluded from the definition of a payment account.

8543/1/26 REV 1 16

EN

(20) Money remittance is a payment service that is usually based on cash provided by a payer to

a payment service provider, without any payment account being created in the name of the

payer or the payee, which remits the corresponding amount to a payee or to another

payment service provider acting on behalf of the payee. In some Member States,

supermarkets, merchants and other retailers offer a service to the public enabling them to

pay utilities and other regular household bills. Those bill-paying services should therefore

be treated as money remittance.

(21) Given the emergence of new types of payment instruments, the evolving technological

solutions providing such instruments and the uncertainties prevailing in the market as to

the legal qualification of such instruments, the definition of a ‘payment instrument’ should

be further specified by providing examples to illustrate what does or does not constitute a

payment instrument, bearing in mind the principle of technology neutrality.

(22) Despite the fact that NearField Communication (NFC) enables the initiation of a payment

transaction, considering it as a fully-fledged ‘payment instrument’ would pose certain

challenges, for example in relation to the application of strong customer authentication for

contactless payments at the point of sale and for the payment service provider’s liability

regime. NFC should therefore be considered as a feature of a payment instrument and not

as a payment instrument as such.

8543/1/26 REV 1 17

EN

(23) The definition of ‘payment instrument’ in Directive (EU) 2015/2366 referred to a

‘personalised device’. Since there are pre-paid cards where the name of the holder of the

instrument is not printed on the card, applying that reference could leave cards of that type

outside the scope of the definition of ‘payment instrument’. The definition of ‘payment

instrument’ should therefore be amended to refer to individualised devices instead of

personalised ones in order to clarify that pre-paid cards where the name of the holder of the

instrument is not printed on the card fall within the scope of this Regulation.

8543/1/26 REV 1 18

EN

(24) Digital pass-through wallets, involving either the tokenisation of an existing payment

instrument, for example a payment card, or a credit transfer from a payment account, are to

be considered as technical services and should thus be excluded from the definitions of

payment instrument and of payment initiation service set out in this Regulation, provided

that no funds are stored in the digital wallet, that the digital wallet provider never enters

into possession of such funds and that the wallet provider operates under contractual

arrangements within a closed system with the payment service providers servicing the

payer’s payment account or issuing the payer’s payment instrument. A token cannot be

regarded, as such, as a payment instrument but is, rather, a payment application as defined

in Article 2, point (21), of Regulation (EU) 2015/751 of the European Parliament and of

the Council10. However, some other categories of digital wallets, namely pre-funded

electronic wallets such as staged-wallets, characterised by a funding-stage and a

payment-stage should be considered as payment instruments and their issuance as a

payment service. This includes both wallets where users store funds in advance for future

transactions and wallets where the funding stage and the payment stage occur

simultaneously at the time of the transaction, including where the wallet is automatically

funded, in whole or in part, from a linked payment instrument or account.

10 Regulation (EU) 2015/751 of the European Parliament and of the Council of 29 April 2015

on interchange fees for card-based payment transactions (OJ L 123, 19.5.2015, p. 1,

ELI: http://data.europa.eu/eli/reg/2015/751/oj).

8543/1/26 REV 1 19

EN

(25) Technological developments since the adoption of Directive (EU) 2015/2366 have

transformed the way account information services are provided. The companies offering

those services provide payment service users with aggregated online information on one or

more of their payment accounts held with one or more payment service providers and

accessed via online interfaces of the account servicing payment service provider. Payment

service users are thus able to have a comprehensive and structured overview of their

payment accounts immediately and at any given moment.

8543/1/26 REV 1 20

EN

(26) The Commission’s review highlighted the fact that authorised account information service

providers sometimes aggregate and provide payment account data not to the consumer

from which they received consent to access and aggregate the data, but to another party, to

enable that party to provide other services to the consumer using the data. There are

however diverging views as to whether that activity falls within the scope of regulated

account information services. That licence-as-a-service evolution of the open-banking

business model can be a source of innovative, data-based services, to the ultimate benefit

of end-users. Indeed, that business model enables end-users to give access to their payment

account data in order to receive services other than payment services including lending,

accounting, and creditworthiness assessment services. It is however essential that payment

service users know precisely who accesses their payment account data, on what legal

grounds and for what purpose. Payment service users should be made fully aware of and

authorise the transmission of their data to another company. That evolved open-banking

business model requires a modification of the definition of account information services to

clarify that the information aggregated by the authorised account information service

provider may be transmitted to a third party to enable that third party to provide another

service to the end-user, with the end-user’s consent. To provide consumers with adequate

protection for their payment account data and legal certainty about the status of entities

accessing their data, the service of data aggregation from payment accounts should always

be provided by a regulated entity on the basis of an authorisation, even where the data is

ultimately transmitted to another service provider.

8543/1/26 REV 1 21

EN

(27) The definition of funds should cover central bank money issued for retail use, including

banknotes and coins, and any possible future central bank digital currency, e-money,

including electronic money tokens, and commercial bank money. Central bank money

issued for use between the central bank and commercial banks, that is to say for wholesale

use, should not be covered.

(28) Regulation (EU) 2023/1114 of the European Parliament and of the Council11 establishes

that electronic money tokens, as defined in that Regulation, are deemed to be electronic

money. That is regardless of whether the electronic money tokens meet the definition of

electronic money in this Regulation. Accordingly, references to electronic money in this

Regulation should be understood to include electronic money tokens, unless otherwise

stated in this Regulation, and electronic money tokens should be included, as electronic

money, in the definition of funds. Likewise, providing transfer services for crypto-assets

on behalf of clients as defined in Regulation (EU) 2023/1114 with regard to electronic

money tokens could qualify as the payment service of execution of payment transactions,

including when such transfers are provided as part of other crypto-asset services, unless

such transfers are covered by a specific exclusion from the scope of this Regulation and

Directive (EU) 2026/…+.

11 Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023

on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU)

No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (OJ L 150, 9.6.2023, p. 40,

ELI: http://data.europa.eu/eli/reg/2023/1114/oj). + OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 22

EN

(29) Given the evolution of the market since the adoption of Directive (EU) 2015/2366, and in

order to avoid disproportionate requirements for crypto-asset service providers that provide

services with electronic money tokens in accordance with Regulation (EU) 2023/1114, and

also to ensure legal clarity as regards the scope of application of this Regulation and

Directive (EU) 2026/…+ to services with electronic money tokens, it is appropriate to

exclude from the scope of application of this Regulation and Directive (EU) 2026/…+

certain types of payment transactions with electronic money tokens where electronic

money tokens are used for investment or trading activities. That concerns in particular the

exchange by crypto-asset service providers of electronic money tokens for funds or

crypto-assets, where the crypto-asset service providers is acting in its own name as buyer

or seller of those electronic money tokens, as well as the exchange of electronic money

tokens for electronic money tokens or crypto-assets carried out by a crypto-asset service

provider intermediating between buyers and sellers. That exclusion should cover in

particular exchanges of electronic money tokens as part of the provision of the service of

exchanging crypto-assets for funds, exchanging crypto-assets for other crypto-assets,

operating a trading platform for crypto-assets, receiving and transmitting orders for

crypto-assets on behalf of clients or executing orders for crypto-assets on behalf of clients,

as defined in Regulation (EU) 2023/1114. However, the exclusion should not include

transfer services provided by a crypto-asset service provider where electronic money

tokens are used to pay for goods or services.

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 23

EN

(30) Taking into account the specific exclusion set out in Directive (EU) 2015/2366 regarding

payment transactions made exclusively in cash directly from the payer to the payee without

any intermediary intervention, it is appropriate to include a similar exclusion in this

Regulation as regards transactions with electronic money tokens carried out without any

intermediary involved. That exclusion should cover, among others, transfers of electronic

money tokens between two self-hosted addresses where there is no intermediary involved,

either on the side of the payer or on the side of the payee, and should not cover payment

transactions between a custodial wallet and a self-hosted address.

(31) To preserve the confidence of the holder of electronic money, electronic money needs to

be redeemable. Redeemability does not imply that the funds received in exchange for

electronic money should be regarded as deposits or other repayable funds for the purposes

of Directive 2013/36/EU. Redemption should be possible at any time, at par value, without

any possibility of agreeing on a minimum threshold for redemption. Redemption should, in

general, be granted free of charge. However, it should be possible to request a

proportionate and cost-based fee, without prejudice to national legislation on tax or social

matters or any obligations on the issuer of electronic money under other relevant Union or

national legislation, including anti-money laundering and countering the financing of

terrorism rules, to any action targeting the freezing of funds or any specific measure linked

to the prevention and investigation of crimes.

8543/1/26 REV 1 24

EN

(32) Payment service providers need access to payment systems and to payment schemes in

order to provide payment services to users. Those payment systems typically include major

systems processing credit transfers and direct debits, whereas payment schemes typically

include four-party card schemes. To ensure equality of treatment throughout the Union

between the different categories of authorised payment service providers, it is necessary to

clarify the rules concerning access to payment systems and schemes. Such access may be

direct or indirect via another participant in that payment system or scheme. Such access

should be subject to requirements that ensure the integrity and stability of those payment

systems and schemes. To that end, the payment system operator or the payment scheme

operator, as applicable, should carry out a risk assessment of a payment service provider

which applies for direct participation. That risk assessment should examine all relevant

risks, including where applicable settlement risk, operational risk, credit risk, liquidity risk

and business risk. Each payment service provider applying for participation in a payment

system or scheme should bear the risk of its own choice of system or scheme and provide

proof to the payment system or scheme that its internal arrangements are sufficiently

robust to manage those types of risk. Payment system operators and operators of payment

schemes should reject an application for direct participation by a payment service provider

only if the payment service provider is unable to respect the rules of the system or scheme

or poses an unacceptably high level of risk.

8543/1/26 REV 1 25

EN

(33) Payment service providers and technical service providers that provide services to payment

service providers should be able to secure interoperability with, and to have access for the

purposes of interoperability to hardware and software features provided or controlled by

original equipment manufacturers of mobile devices or providers of electronic

communications services, that are necessary to process and execute payment transactions

online or offline in a competitive way. Those technical features include hardware and

software that is necessary to manage the transaction flow between the payment method and

the acceptance device, such as NFC on mobile devices and the payment terminal kernel, or

to ensure that mobile payment applications run in a secure environment that protects

cryptographic keys and algorithms, the customer PIN code or biometric data, such as the

so-called secure elements of mobile devices, including the Universal Integrated Circuit

Card (UICC), embedded SE (eSE), and microSD. Original equipment manufacturers of

mobile devices and providers of electronic communications services should be obliged to

enable interoperability with, and provide access to all hardware and software features that

are necessary to process and execute online and offline transactions on fair, reasonable and

non-discriminatory terms. That obligation should be without prejudice to Article 6(7) of

Regulation (EU) 2022/1925 of the European Parliament and of the Council12, which

obliges gatekeepers to provide, free of charge, effective interoperability with, and access

for the purposes of interoperability to, the operating system, hardware or software features

of mobile devices and which is applicable to existing and new digital means of payments.

12 Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September

2022 on contestable and fair markets in the digital sector and amending Directives (EU)

2019/1937 and (EU) 2020/1828 (Digital Markets Act) (OJ L 265, 12.10.2022, p. 1,

ELI: http://data.europa.eu/eli/reg/2022/1925/oj).

8543/1/26 REV 1 26

EN

(34) Payment system operators and operators of payment schemes should have in place rules

and procedures on access which are proportionate, objective, non-discriminatory and

transparent. Payment system operators and operators of payment schemes should not

discriminate against payment institutions as regards participation provided that the system

or scheme rules can be respected and there is no unacceptable risk to the system or scheme.

Such systems include, amongst others, those designated under Directive 98/26/EC of the

European Parliament and of the Council13. In cases where the payment system in question

is already subject to oversight by the European System of Central Banks under Regulation

(EU) 2025/1355 of the European Central Bank14, the central bank or banks exercising that

oversight should monitor compliance with those rules in the framework of their oversight.

For other payment systems or schemes, Member States should designate national

competent authorities to ensure that payment system operators and operators of payment

schemes comply with such requirements, if those requirements are not enforced under the

oversight of the operations of those other payment systems or schemes by the Eurosystem

or central banks of Member States whose currency is not the euro.

13 Directive 98/26/EC of the European Parliament and of the Council of 19 May 1998 on

settlement finality in payment and securities settlement systems (OJ L 166, 11.6.1998, p. 45,

ELI: http://data.europa.eu/eli/dir/1998/26/oj). 14 Regulation (EU) 2025/1355 of the European Central Bank of 2 July 2025 on oversight

requirements for systemically important payment systems (ECB/2025/22) (OJ L, 2025/1355,

14.7.2025, ELI: http://data.europa.eu/eli/reg/2025/1355/oj).

8543/1/26 REV 1 27

EN

(35) Higher costs for payment service providers providing services of acquiring card-based

payment transactions and merchants result from the lack of transparency of pricing applied

by operators of payment card schemes and processing entities. That could, for example, be

because providers of services of acquiring payment transactions and merchants are not

aware of the actions to take to avoid behavioural fees, or of which service is optional, or of

how to opt out of an optional service. That ultimately harms consumers due to the pass-

through by merchants of their increased card-acceptance costs, resulting in higher retail

prices. Since consumers are likely to decrease their consumption as a result, merchants’

turnover is negatively impacted, unless merchants absorb these costs, thereby decreasing

their profit margins. Scheme fees and processing fees should therefore be transparent, but

also able to be compared, to allow providers of services of acquiring payment transactions

to maximise the efficiency of scheme and processing services they source and supply,

creating the conditions for efficiency gains to trickle down to merchants, via lower

merchant service charges for the acceptance of card-based payments, and to consumers, via

lower retail prices. At the same time, providers of services of acquiring payment

transactions and merchants can only make truly informed choices of scheme and

processing service if they are promptly informed about any new scheme and processing

fees or any change to fees. Regulation (EU) 2015/751 on interchange fees for card-based

payment transactions lays down transparency requirements that providers of services of

acquiring payment transactions are subject to vis-à-vis payees they contract with.

8543/1/26 REV 1 28

EN

Providers of services of acquiring payment transactions should ensure that the information

they provide to merchants when fulfilling their obligations under Regulation

(EU) 2015/751 has the same level of transparency as the information they have been

provided with regarding scheme and processing services and the corresponding fees. Due

to the complex nature of payment card schemes’ and processing entities’ billing systems,

and for the transparency requirements to be effective and proportionate, the power to adopt

acts in accordance with Article 290 of the Treaty on the Functioning of the European

Union (TFEU) should be delegated to the Commission to further specify the information to

be disclosed to payment service providers providing services of acquiring payment

transactions regarding scheme and processing services and the corresponding fees.

(36) To ensure fair competition between payment service providers, a participant in a payment

system which provides services in relation to such a system to an authorised or registered

payment service provider should also, when requested to do so, grant access to such

services in an objective, proportionate and non-discriminatory manner to any other

authorised or registered payment service provider.

8543/1/26 REV 1 29

EN

(37) The provisions relating to access to payment systems and schemes should not apply to

systems and schemes set up and operated by a single payment service provider. Such

payment systems and schemes can operate either in direct competition with other payment

systems or schemes or, more typically, in a market niche not covered by other payment

systems or schemes. Such schemes include three-party schemes, including three-party card

schemes, to the extent that those schemes never operate as de facto four-party card

schemes, including by relying upon licensees, agents or co-branding partners. Such

systems also typically include payment services offered by telecommunication providers

where the system operator is the payment service provider both to the payer and to the

payee, and internal systems of banking groups. To stimulate the competition that can be

provided by such closed payment systems and schemes to established mainstream payment

systems and schemes, access to those closed proprietary payment systems and schemes

should not be required to be granted to third parties. However, such closed systems and

schemes should continue to be subject to any Union and national competition rules which

require that access be granted to the systems or schemes in order to maintain effective

competition in payments markets.

8543/1/26 REV 1 30

EN

(38) Payment institutions need to be able to open and maintain an account with a credit

institution to meet their authorisation requirements as regards safeguarding of payment

service users’ funds. Payment institutions should also endeavour not to safeguard all

payment service users’ funds with one credit institution in order to avoid, where

appropriate, concentration risk. However, as evidenced in particular by EBA in its opinion

of 5 January 2022, despite the provisions on payment institution accounts with a

commercial bank laid down in Directive (EU) 2015/2366, some payment institutions or

companies applying for a payment institution authorisation still face practices from some

credit institutions which either refuse to open an account for them or close an account

where one exists, based on a perceived higher risk of money laundering or financing of

terrorism. Those so-called ‘de-risking’ practices create significant competitive challenges

for payment institutions.

8543/1/26 REV 1 31

EN

(39) Credit institutions should therefore provide, on an objective, non-discriminatory and

proportionate basis, access to a payment account to payment institutions, and to applicant

payment institutions, as well as to their agents. It is necessary to include applicant payment

institutions in that provision, given that an account with a credit institution where clients’

funds can be safeguarded is a prerequisite to obtain an authorisation as a payment

institution. Credit institutions should be able to refuse access to payment accounts only in

exceptional cases where there are serious grounds to do so. Credit institutions should be

able to refuse to open or be able to close a payment account for a payment institution, its

agents or an applicant payment institution where opening or maintaining such an account

would result in an infringement of Regulation (EU) 2024/1624 of the European Parliament

and of the Council15. Credit institutions should also be able to refuse such access in cases

where relevant information or documents have not been received from the applicant to

open an account as this may impede, among others, their ability to perform customer due

diligence obligations. A payment institution or its agents or an applicant payment

institution should have the right of appeal against a refusal by a credit institution to a

competent authority designated by a Member State. In order to facilitate the exercise of

that appeal right, credit institutions should give reasons in writing and in detail for any

refusal to provide an account, or a subsequent closure of an account.

15 Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024

on the prevention of the use of the financial system for the purposes of money laundering or

terrorist financing (OJ L, 2024/1624, 19.6.2024,

ELI: http://data.europa.eu/eli/reg/2024/1624/oj).

8543/1/26 REV 1 32

EN

Those reasons should refer to specific elements relating to the payment institution in

question, not to general or generic considerations. Where the payment account is refused

on the grounds that opening or maintaining such an account would result in an

infringement of Regulation (EU) 2024/1624, the justification provided to the client or the

applicant should not lead to the disclosure of information protected under Article 73 of that

Regulation. To facilitate treatment by competent authorities of appeals against account

refusal or withdrawal and reasons thereof, EBA should develop draft regulatory technical

standards harmonising the presentation of such reasons.

(40) To make well-informed choices and to be able to choose their payment service provider

easily within the Union, payment service users should receive comparable information

about payment services in a clear, neutral and comprehensible manner. To ensure that such

information is given to payment service users with regard to the payment service contract

and payment transactions, it is necessary to specify and to harmonise the obligations on

payment service providers as regards the provision of information to payment service

users.

8543/1/26 REV 1 33

EN

(41) When providing the required information to payment service users, payment service

providers should take into account the needs of those users and practical aspects and

cost-efficiency in light of the specific payment service contract. Payment service providers

should either actively communicate the information at the appropriate time without any

prompting by the payment service user, or they should make the information available to

payment service users at those users’ request. In the second situation, payment service

users need to take active steps to obtain the information, including requesting that

information explicitly from payment service providers, logging into a bank account

mailbox or inserting a bank card into a printer for account statements. For those purposes,

the payment service providers should ensure that access to the information is possible, and

that the information is available to payment service users.

(42) As consumers and undertakings are not in the same position of vulnerability, they do not

need the same level of protection. While it is important to guarantee consumer rights by

provisions from which it is not possible to derogate by contract, it is reasonable to let

undertakings and organisations agree otherwise when they are not dealing with consumers.

Subject to regulatory technical standards adopted by the Commission, such agreements

with undertakings and organisations who are not consumers could govern whether or not

strong customer authentication is applied. Micro-enterprises, as defined in Commission

Recommendation 2003/361/EC16, could be treated in the same way as consumers. Certain

rules should always apply, regardless of the status of the user.

16 Commission Recommendation 2003/361/EC of 6 May 2003 concerning the definition of

micro, small and medium-sized enterprises (OJ L 124, 20.5.2003, p. 36,

ELI: http://data.europa.eu/eli/reco/2003/361/oj).

8543/1/26 REV 1 34

EN

(43) Payment service providers, including ATM deployers, should display to their customers in

a clear, neutral, and comprehensible manner, information on any charges both before the

customer initiates the withdrawal and while carrying out the withdrawal for example by

displaying their charges digitally on the terminal. When the transaction is completed, the

information on charges should be documented, at the simple request of the customer, on

paper or another durable medium.

(44) To maintain a high level of consumer protection, consumers should have the right to

receive information on services’ conditions and prices free of charge before being bound

by any payment service contract. To enable consumers to compare the services and

conditions offered by payment service providers and, in the case of a dispute, to verify

their contractual rights and obligations, consumers should be able to request that

information and the framework contract on paper or on another durable medium, free of

charge and at any time during the contractual relationship.

(45) To increase the level of transparency, payment service providers should provide basic

information on executed payment transactions at no additional charge to the consumer. In

the case of a single payment transaction, the payment service provider should not charge

separately for that information. Similarly, payment service providers should provide free of

charge and on a monthly basis subsequent information on payment transactions under a

framework contract. However, considering the importance of transparency in pricing and

differing customer needs, the parties to the contract should be able to agree on charges for

more frequent or additional information.

8543/1/26 REV 1 35

EN

(46) Payment instruments for low-value transactions should be a cheap and easy-to-use

alternative for purchasing low-priced goods and services and should not be overburdened

by excessive requirements. The relevant information requirements and rules on their

execution should therefore be limited to essential information, which takes into

consideration the technical capabilities that can justifiably be expected from instruments

dedicated to low-value payments. Despite the lighter regulatory burden, payment service

users should have adequate protection, having regard to the limited risks posed by those

payment instruments, in particular as concerns prepaid payment instruments.

(47) In single payment transactions, the essential information should always be given at the

payment service providers’ own initiative. As payers are usually present when placing a

payment order, it should not always be necessary to provide information on paper or on

another durable medium. Payment service providers should be able to give information

orally or make it otherwise easily accessible, including by displaying the conditions on a

notice board on the premises. It should also be indicated, including on the website, where

other, more detailed, information can be found. However, where the consumer so requests,

the essential information should also be provided by payment service providers on paper or

on another durable medium.

(48) The information required should be proportionate to the needs of users. The information

requirements for a single payment transaction should be different from the information

requirements for a framework contract which provides for a series of payment transactions.

8543/1/26 REV 1 36

EN

(49) To be able to make an informed choice payment service users should be able to compare

ATM charges with those of other providers. To increase the transparency of ATM charges

for the payment service user, payment service providers should provide payment service

users with information, on paper or on another durable medium, on all applicable charges

for domestic ATM withdrawals in different situations, depending on the ATM from which

the payment service users withdraw cash. For ATM withdrawals denominated in euro, any

charges payable by payment service users to their payment service provider, including

where withdrawals are made at ATMs operated by independent ATM deployers, should be

subject to the principle of equality of charges, as set out in Article 3 of Regulation

(EU) 2021/1230 of the European Parliament and of the Council17. That Regulation should

be amended accordingly.

(50) Framework contracts and the payment transactions covered by those contracts are more

common and economically significant than single payment transactions. If there is a

payment account or a specific payment instrument, a framework contract is required.

Therefore, the requirements for prior information on framework contracts should be

comprehensive and information should always be provided on paper or on another durable

medium. However, payment service providers and payment service users should be able to

agree in the framework contract on the manner in which subsequent information on

executed payment transactions is to be given.

17 Regulation (EU) 2021/1230 of the European Parliament and of the Council of 14 July 2021

on cross-border payments in the Union (OJ L 274, 30.7.2021, p. 20,

ELI: http://data.europa.eu/eli/reg/2021/1230/oj).

8543/1/26 REV 1 37

EN

(51) Contractual provisions should not discriminate against consumers who are legally resident

in the Union on the grounds of their nationality or place of residence. Where a framework

contract provides for the right to block a payment instrument for objectively justified

reasons, the payment service provider should not be able to invoke that right merely

because the payment service user has changed his or her place of residence within the

Union.

(52) To facilitate payment service users’ mobility, users should be able to terminate a

framework contract without incurring charges. However, for contracts terminated by the

payment service users less than three months after their entry into force, payment service

providers should be allowed to apply charges in line with the costs incurred due to the

termination of the framework contract by the user. Where, under a framework contract,

payment services are offered jointly with technical services supporting the provision of

payment services, such as the rental of terminals used for payment services, payment

service users should not be locked in with their payment service provider via more onerous

terms set in the contractual clauses governing the technical services. To preserve

competition, such contractual terms should be subject to the framework contract

requirements on termination fees. For consumers, the period of notice agreed should be no

longer than one month, and for payment service providers, no shorter than three months.

Those rules should be without prejudice to the payment service provider’s obligation to

terminate the payment service contract in exceptional circumstances under other relevant

Union or national law, such as that on anti-money laundering or countering the financing

of terrorism, any action targeting the freezing of funds, or any specific measure linked to

the prevention and investigation of crimes.

8543/1/26 REV 1 38

EN

(53) To achieve comparability, the estimated currency conversion charges for credit transfers

and remittances carried out within the Union and from the Union to a third country should

be expressed in the same way, namely as a monetary amount in the currency of the payer’s

account and as a percentage mark-up over an aggregated mid-market exchange rate that

accurately reflects the market. To ensure that the exchange rate used is reliable and

accurately reflects the market, it should be provided by a trusted administrator who meets

applicable governance and control requirements, such as the Principles for Financial

Benchmarks issued by the International Organization of Securities Commissions (IOSCO).

A payment service provider should use the same reference benchmark consistently and for

exchanges made in both directions. When a reference is made to ‘charges’ in this

Regulation, it should also cover, where applicable, currency conversion charges.

(54) The payer’s payment service provider should provide an estimate of the time for the funds

of credit transfers and money remittance transactions to be received by the payee’s

payment service provider located outside the Union. The payer’s payment service provider

should make the payer aware that this is not an exact timing, since the time of receipt could

depend on different factors, sometimes out of control of the payer’s payment service

provider.

8543/1/26 REV 1 39

EN

(55) Since a payment service provider can provide or make available the name of the payee to

the payer only where such information is available to it, this requirement cannot be applied

in circumstances where it is not feasible to do so. That is generally the case for money

remittances executed as a single payment transaction, where the payer’s payment service

provider does not have access to the name of the payee unless it is provided by the payer. It

is therefore appropriate that, in such cases, the payer’s payment service provider is not

required to provide or make available the payee’s name to the payer.

(56) Experience has shown that the sharing of charges between a payer and a payee is the most

efficient system since it facilitates the straight-through processing of payments. Provision

should therefore be made for charges to be levied directly on the payer and the payee by

their respective payment service providers. The amount of any charges levied might also

be zero as the rules should not affect the practice whereby a payment service provider does

not levy any charges on the payer or the payee. Similarly, without prejudice to Union

competition rules and to Regulation (EU) 2015/751 and depending on the contract terms,

the payee’s payment service provider might charge only the payee for the use of the

payment service where such charge includes a compensation to the payer’s payment

service provider and the payer’s payment service provider is not imposing charges on the

payer. It is possible that payment systems impose charges by way of a subscription fee.

The provisions on the amount transferred or any charges levied have no direct impact on

pricing or compensation between payment service providers or any intermediaries.

8543/1/26 REV 1 40

EN

(57) A surcharge is a charge by merchants to consumers that is added to the requested price for

goods and services when a certain payment method is used by the consumer. One of the

reasons for surcharging is to direct consumers to cheaper or more efficient payment

instruments, hence fostering competition between alternative payment methods. Under the

regime introduced by Directive (EU) 2015/2366, payees were prevented from requesting

charges for the use of payment instruments for which interchange fees are regulated under

Chapter II of Regulation (EU) 2015/751, i.e. for consumer debit and credit cards issued

under four-party card schemes, and for those payment services to which Regulation

(EU) No 260/2012 of the European Parliament and of the Council18 applies, i.e. credit

transfer and direct debit transactions denominated in euro within the Union. Member States

were allowed under Directive (EU) 2015/2366 to further prohibit or limit the right of the

payee to request charges, taking into account the need to encourage competition and

promote the use of efficient payment instruments.

18 Regulation (EU) No 260/2012 of the European Parliament and of the Council of 14 March

2012 establishing technical and business requirements for credit transfers and direct debits

in euro and amending Regulation (EC) No 924/2009 (OJ L 94, 30.3.2012, p. 22,

ELI: http://data.europa.eu/eli/reg/2012/260/oj).

8543/1/26 REV 1 41

EN

(58) Evidence gathered during the review of Directive (EU) 2015/2366 shows that the current

rules on charges are appropriate and had a positive impact. There is no compelling need for

further alignment of charging practices between Member States, as the existing

surcharging ban already applies to a very large share of payments in the Union. It is

estimated that 95 % of card payments are subject to the existing surcharging ban. In

addition, when a surcharge is applied, it is capped at the actual cost incurred by the

merchant. However, in its review of Directive (EU) 2015/2366, the Commission identified

different interpretations concerning the payment instruments covered by the surcharging

ban. It is therefore necessary to explicitly extend the surcharging ban to all credit transfers

and direct debits and not just to those covered by Regulation (EU) No 260/2012, as was the

case under Directive (EU) 2015/2366.

8543/1/26 REV 1 42

EN

(59) Open banking services are payment services involving access to the payment account data

of a payment service user by payment service providers which do not hold the account

holder’s funds nor service a payment account. Account information service providers

provide a service that aims to allow the aggregation of a user’s data, at the request of the

payment service user, with different account servicing payment service providers in one

single place. The account information service provider could also transmit the payment

account data obtained to a third party who in turn would provide a service to the payment

service user leveraging on that data, possibly with additional value-added services.

Payment initiation services allow the initiation of a payment from the user’s account, such

as a credit transfer, in a convenient way for the user and the payee without the use of an

instrument such as a payment card. A payment initiation service necessitates obtaining the

consent of the payer to access the payment account. As acknowledged in Regulation

(EU) 2024/1624, some payment initiation services establish a business relationship with

the payee. Therefore, the definition of payment initiation service reflects the fact that the

providers of such services may offer payment initiation services to the payer and to the

payee. The provision of a pass-through digital wallet enabling the user to initiate a

payment from the user’s payment account, provided that no funds are stored in the digital

wallet, that the digital wallet provider never enters into possession of such funds and that

the wallet provider operates under contractual arrangements with the payment service

providers servicing the payer’s account, should not be considered a payment initiation

service.

8543/1/26 REV 1 43

EN

(60) Account servicing payment service providers should allow access by account information

service providers and payment initiation service providers to payment account data if the

payment account can be accessed by the payment service user online and if the payment

service user has granted consent for such access. Directive (EU) 2015/2366 was based on

the principle of access to payment account data without the need for a contractual

relationship between the account servicing payment service provider and the account

information service providers and payment initiation service providers, which had the

effect that charging for access to data was in practice not possible. Access to data under

open banking has been taking place on such a non-contractual basis, and free of charge,

since the date of application of Directive (EU) 2015/2366. If regulated data access services

were to be subject to a charge, where previously there was none, the impact on the

continued provision of those services, and therefore on competition and innovation in

payments markets, could be very significant. That principle should therefore be

maintained. Maintaining that approach is in line with Chapters III and IV of Regulation

(EU) 2023/2854 of the European Parliament and of the Council19, in particular Article 9(3)

of that Regulation, to which this Regulation is without prejudice.

19 Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December

2023 on harmonised rules on fair access to and use of data and amending Regulation

(EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (OJ L, 2023/2854, 22.12.2023,

ELI: http://data.europa.eu/eli/reg/2023/2854/oj).

8543/1/26 REV 1 44

EN

(61) Account servicing payment service providers and account information service providers

and payment initiation service providers may establish a contractual relationship, including

in the context of a multilateral contractual arrangement such as a scheme, with possible

compensation, for access to payment account data and provision of open banking services

other than those required by this Regulation. An example of such value-added services

offered via so-called ‘premium’ application programming interfaces is the possibility to

schedule future variable recurring payments. Any compensation for such services would

have to be in line with Chapters III and IV of Regulation (EU) 2023/2854, in particular

with regard to Article 9(1) and (2) of that Regulation on compensation. Access by account

information service providers and payment initiation service providers to payment account

data regulated under this Regulation without a requirement to have a contractual

relationship, and thus without charging, should always be possible even in cases where a

multilateral contractual arrangement such as a scheme is in place and where the same data

is also available as part of the said multilateral contractual arrangement.

8543/1/26 REV 1 45

EN

(62) To guarantee a high level of security in data access and exchange, access to payment

accounts and the data therein should be provided to account information service providers

and payment initiation service providers via an interface designed and dedicated for open

banking purposes, such as an application programming interface. To that end, the account

servicing payment service provider should set up a secure communication with account

information service providers and payment initiation service providers. To avoid any

uncertainty as to who is accessing the payment service user’s data, the dedicated interface

should enable account information service providers and payment initiation service

providers to identify themselves to the account servicing payment service provider, and to

rely on all authentication procedures provided by the account servicing payment service

provider to the payment service user. Account information service providers and payment

initiation service providers should be able to choose which authentication method they

offer to the payment service user, in order to offer the least burdensome option. Account

information service providers and payment initiation service providers should use the

dedicated interface for data access purposes. In cases of failure or unplanned unavailability

of the dedicated interface, those service providers’ business continuity would be

endangered by the inability to access the data for which they have been granted consent. It

is essential that account information service providers and payment initiation service

providers be able at all times to access the data which are indispensable for the provision of

services to clients. Therefore, planned unavailability of the dedicated interface, to allow the

account servicing payment service providers to update or make changes to the dedicated

interface, should normally occur between 00:00 and 06:00. While systems maintenance

usually involves upgrading the system during the night, between 00:00 and 06:00 in the

local time of the account servicing payment service provider, an extensive maintenance

procedure can take longer than several hours. The account servicing payment service

provider should as a rule, except for emergency changes, also duly inform payment service

providers making use of the dedicated interface at least one month in advance of any

planned unavailability and its duration.

8543/1/26 REV 1 46

EN

(63) To facilitate the use of the dedicated interface, its technical specifications should be

documented, specifying the required routines, protocols and tools, and a summary be made

publicly available by the account servicing payment service provider. To enable open

banking service providers to properly prepare their future access and to solve any possible

technical problems, the account servicing payment service provider should enable account

information service providers and payment initiation service providers to test an interface

prior to the date on which the interface will be activated. Only authorised account

information service providers and payment initiation service providers should have access

to payment account data via that interface, although applicants for authorisation as account

information service providers and payment initiation service providers should be able to

consult the technical specifications. To ensure the interoperability of different

technological communication solutions, the interface should use standards of

communication which are developed by international or European standardisation

organisations including the European Committee for Standardization (CEN) or the

International Organization for Standardization (ISO) or other widely recognised standards

offering an equivalent level of security, which would allow account servicing payment

service providers to benefit from a wide range of technological solutions without

compromising security or relying on niche standards that would be difficult for third-party

providers to implement.

8543/1/26 REV 1 47

EN

(64) In order for account information service providers and payment initiation service providers

to ensure at all times their business continuity and to be able to provide high quality

services to their clients, the dedicated interface that they are required to use should enable a

straightforward and seamless user experience by meeting high level requirements in terms

of performance and functionalities. It should at a minimum ensure data parity with the

customer interface that the account servicing payment service provider provides to its

users, therefore including the payment account data which is also available to payment

service users in the interface provided to them by the account servicing payment service

provider. With regard to payment initiation services, the dedicated interface should allow

not only the initiation of single payment transactions but of standing orders. More detailed

requirements for dedicated interfaces should be laid down in regulatory technical standards

developed by EBA.

(65) For the purposes of effective verification prior to payment initiation, account servicing

payment service providers should ensure that payment initiation service providers can

verify the full name of the account holder via the dedicated interface, and should therefore

not provide partial or abbreviated names.

8543/1/26 REV 1 48

EN

(66) Given the dramatic impact that the prolonged unplanned unavailability of a dedicated

interface would have on the business continuity of account information service providers

and payment initiation service providers, account servicing payment service providers

should use their best efforts to prevent any unplanned unavailability or underperformance

of that interface. Underperformance should be understood as performance falling below

that of the interface used by the account servicing payment service provider for

authentication and communication with its payment service users. Account servicing

payment service providers should remedy any such unavailability or underperformance

without undue delay and ensure an optimal recovery time for the dedicated interface.

Account servicing payment service providers should inform account information service

providers and payment initiation service providers of any such unavailability of their

dedicated interface and of the measures taken to remedy them without delay. Given the

paramount importance of full availability and functionality of the dedicated interface for

the business models of account information service providers and payment initiation

service providers, the dedicated interface should ensure availability and performance that

equals at least that of the interface that the account servicing payment service provider uses

for authentication and communication with its users. EBA should be mandated to clarify,

in draft regulatory technical standards, the requirements related to the quarterly statistics

on the availability and performance of dedicated interfaces and, for comparison purposes,

of the interfaces that the account servicing payment service provider makes available to its

payment service users for directly accessing their payment account online and the

publication thereof on the website of the account servicing payment service provider and

the standards establishing an optimal recovery time in cases of dedicated interface

unplanned unavailability, based on the severity of the incident. That severity should take

into account, among others, the number of customers impacted and types of functionality

of account information service providers and payment initiation service providers affected.

8543/1/26 REV 1 49

EN

(67) Account information service providers and payment initiation service providers should

always duly identify themselves and respect their obligations, such as the limits of the

consent which was granted to them, and should in particular access only the data that they

need to meet their contractual obligations and provide the regulated service.

Screen-scraping data, namely accessing payment account data without proper

identification, should never be performed under any circumstances.

8543/1/26 REV 1 50

EN

(68) Given the fact that setting up or maintaining a dedicated interface could, for certain

account servicing payment service providers, be deemed disproportionately burdensome, a

national competent authority should be able to exempt an account servicing payment

service provider, on its request, from the obligation to have in place a dedicated data access

interface, and to allow the account servicing payment service provider to either offer

payment data access only via its ‘customer interface’, provided this interface is already an

application programming interface endpoint, meaning a specific, secure digital connection

point that allows automated, machine-to-machine communication and data exchange, or

not to offer any open banking data access interface at all. Where appropriate, according to

the specificities of the Member State, for national central banks not acting in their capacity

as monetary authority or other public authorities, the exemption from the obligation to

have in place a dedicated interface may be granted by the Member State. Data access via

the customer interface, where there is no dedicated interface, may be appropriate where

that interface is already an application programming interface, such as in business-to-

business cases where no mobile applications or website interfaces are used between the

account servicing payment service provider and its customer, or where a dedicated

interface would be a significant financial and resource burden for the account servicing

payment service provider, such as for very small payment service providers. Being

exempted from the obligation to maintain an open banking data access interface may be

justified where the account servicing payment service provider has a specific business

model, for example, where open banking services would be of no relevance to its

customers. Detailed criteria for granting such exemption decisions should be laid down in

regulatory technical standards developed by EBA, taking into account, among others, the

size, annual turnover and payments volume of the account servicing payment service

provider. Such exemptions, once granted, should not be perpetuated if the circumstances

which led to the exemption change significantly.

8543/1/26 REV 1 51

EN

(69) To fully reap the potential of open banking in the Union, it is essential to prevent any

discriminatory treatment of account information service providers and payment initiation

service providers by account servicing payment service providers. Where a payment

service user has decided to make use of the services of an account information service

provider or a payment initiation service provider, the account servicing payment service

provider should treat that order in the same way as it would treat such a request if made by

the payment service user directly in that provider’s customer interface, unless the account

servicing payment service provider has objective reasons to treat the request to access the

account differently, including serious suspicions of fraud.

(70) For the provision of payment initiation services, the account servicing payment service

provider should provide the payment initiation service provider with all information

available to it regarding the execution of the payment transaction immediately after the

payment order has been received, and on an ongoing basis, at the request of a payment

initiation service provider. Sometimes more information becomes available to the account

servicing payment service provider after it has received the payment order, but before it

has executed the payment transaction. Where that information is relevant for the payment

order and the execution of the payment transaction, the account servicing payment service

provider should provide that information to the payment initiation service provider. The

payment initiation service provider should have access to the information necessary to

assess the risks of non-execution of the initiated transaction. That information is

indispensable to enable the payment initiation service provider to offer to a payee, on

behalf of whom it initiates the transaction, a service of comparable quality to other means

of electronic payments available to the payee, including payment cards.

8543/1/26 REV 1 52

EN

(71) To increase trust in open banking, it is essential that payment service users who use

account information services and payment initiation services have full control of their data

and access to clear information on the data access consents that those payment service

users have granted to payment service providers, including the purpose of the consent and

the categories of payment account data concerned, such as identity data of the account, the

transaction, and the account balance. Account servicing payment service providers should

therefore make available to payment service users who use such services a dashboard, for

monitoring and withdrawing or re-establishing data access granted to open banking service

providers. The dashboards should not contain any deterring or discouraging language that

might dissuade a payment service user from making use of the services of a payment

initiation service provider or account information service provider. Consent for initiation of

one-off payments should not feature on that dashboard. A dashboard should not allow a

payment service user to establish new data access consents with an account information or

payment initiation service provider to which no previous data access has been given.

Account servicing payment service providers should promptly make information available

to account information service providers and payment initiation service providers of any

withdrawal of data access. Account information service providers and payment initiation

service providers should promptly inform account servicing payment service providers of

new and re-established data access consents granted by payment service users, including

the duration of validity of the consent and its purpose, in particular whether the

consolidation of data is for the benefit of the user or for transmission to a third party.

8543/1/26 REV 1 53

EN

An account servicing payment service provider should not encourage, in any manner, a

payment service user to withdraw the consents given to account information service

providers and payment initiation service providers. The dashboard should warn the

payment service user in a standard way of the risk of possible contractual consequences of

withdrawal of data access to an open banking service provider, since the dashboard does

not manage the contractual relationship between the user and an open banking service

provider, but it is for the payment service user to verify that risk. A consent dashboard

should empower customers to manage their consents in an informed and impartial manner

and give customers a strong measure of control over how their personal and non-personal

data is used. A consent dashboard should take into account, where appropriate, the

accessibility requirements under Directive (EU) 2019/882 of the European Parliament and

of the Council20.

(72) Account information service providers should be able to access information on designated

payment accounts and associated payment transactions held by account servicing payment

service providers for the purpose of providing the account information service, whether or

not the payment service user actively requests such information. Where an account

information service provider intends to access information and the payment service user is

not actively requesting that information, the account information service provider should

inform the payment service user of its intention. In that case, the information obligation

does not have to be fulfilled on an access-by-access basis, but may be fulfilled by including

that information in the framework contract between the account information service

provider and the payment service user.

20 Directive (EU) 2019/882 of the European Parliament and of the Council of 17 April 2019 on

the accessibility requirements for products and services (OJ L 151, 7.6.2019, p. 70,

ELI: http://data.europa.eu/eli/dir/2019/882/oj).

8543/1/26 REV 1 54

EN

(73) The review of Directive (EU) 2015/2366 revealed that account information service

providers and payment initiation service providers still face many unjustified obstacles,

despite the level of harmonisation achieved and the prohibition on such obstacles imposed

by Article 32(3) of Commission Delegated Regulation (EU) 2018/38921. Those obstacles

continue to hamper significantly the full potential of open banking in the Union. Those

obstacles are regularly reported by account information service providers and payment

initiation service providers to supervisors, regulators and the Commission. On 4 June 2020

EBA published its opinion analysing those obstacles. Despite clarification efforts, there is

still a lot of uncertainty, in the market and among supervisors, as to what constitutes a

‘prohibited obstacle’ to regulated open banking services. It is therefore indispensable to

provide a clear and non-exhaustive list of such prohibited open banking obstacles, relying

in particular on the work carried out by EBA.

21 Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing

Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to

regulatory technical standards for strong customer authentication and common and secure

open standards of communication (OJ L 69, 13.3.2018, p. 23,

ELI: http://data.europa.eu/eli/reg_del/2018/389/oj).

8543/1/26 REV 1 55

EN

(74) Grounds of fraud prevention or compliance with Regulation (EU) 2016/679 of the

European Parliament and of the Council22 should not serve as a general basis to deny,

restrict or delay data access by third party providers. Measures taken on those grounds

could exceptionally restrict access to open banking services but should be allowed on a

case-by-case basis only where duly justified, based on objective and verifiable elements of

suspected fraud or on a specific obligation under Regulation (EU) 2016/679, and should

remain strictly necessary, proportionate and limited in scope and duration. They should not

lead to systematic or blanket restrictions to open banking, nor legitimise obstacles to data

access which are prohibited under this Regulation. While account servicing payment

service providers might legitimately take measures to mitigate fraud, such measures should

not discriminate against the services provided by payment initiation service providers and

account information service providers. As such, they should be equally applied to such

services as they are to payment services provided directly or indirectly by the account

servicing payment service provider itself, including card- or credit transfer-based payment

services which are commercially available for payees to use. That principle should apply to

both the payer authentication experience and to the level of certainty that an initiated

payment will be executed by the account servicing payment service provider.

22 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

on the protection of natural persons with regard to the processing of personal data and on the

free movement of such data, and repealing Directive 95/46/EC (General Data Protection

Regulation) (OJ L 119, 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj).

8543/1/26 REV 1 56

EN

(75) The obligation to keep personalised security credentials safe is of the utmost importance to

protect the funds of the payment service user and to limit the risks relating to fraud and

unauthorised access to payment accounts. However, terms and conditions or other

obligations imposed by payment service providers on payment service users in relation to

keeping personalised security credentials safe should not be worded in such a way that

payment service users are prevented from taking advantage of services offered by other

payment service providers, including payment initiation services and account information

services. Such terms and conditions should not contain any provision that would make it

more difficult, in any way, to use the payment services of other payment service providers

authorised or registered pursuant to Directive (EU) 2026/…+. Furthermore, it is appropriate

to specify that, for the activities of payment initiation service providers and account

information service providers, the name of the account owner and the unique identifier do

not constitute sensitive payment data.

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 57

EN

(76) To be fully successful, open banking requires robust and effective enforcement of the rules

that regulate that activity. As there exists no single authority at Union level to enforce open

banking rights and duties, national competent authorities are the first level enforcers of

open banking. It is therefore essential that national competent authorities deploy their best

efforts to ensure the respect of the Union open banking regulated framework. National

competent authorities should have the appropriate resources to perform their enforcement

tasks effectively and efficiently. National competent authorities should facilitate a smooth

and regular dialogue between the various actors in the open banking ecosystem. In

particular, it must be ensured that account servicing payment service providers comply at

all times with their obligations in relation to the dedicated interface. Account servicing

payment service providers and account information service providers and payment

initiation service providers which do not comply with their obligations should be subject to

appropriate sanctions. Regular monitoring of the open banking market in the Union by

national competent authorities, coordinated by EBA, should facilitate enforcement, and

collection of data on the open banking market should remedy a data gap which currently

exists and which hampers any effective measurement of the actual take-up of open banking

in the Union. Account servicing payment service providers and account information

service providers and payment initiation service providers should have access to dispute

settlement bodies, pursuant to Article 10 of Regulation (EU) 2023/2854.

8543/1/26 REV 1 58

EN

(77) The dedicated interface should be the primary access point for account information

services and payment initiation services. However, some account servicing payment

service providers might have additional interfaces for other application contexts which are

technically able to provide the same services for account information service providers and

payment initiation service providers as the dedicated interface. Account information

service providers and payment initiation service providers should be able to use those

additional interfaces with the consent of the account servicing payment service provider.

However, that possibility must not be interpreted as an obligation for the account servicing

payment service provider to grant access through anything else than the dedicated

interface, nor does it stipulate any right for account information service providers and

payment initiation service providers, or other unregulated entities, to demand such access.

The additional interfaces can only be used if the participants want to do so on their own

accord, with agreement by account servicing payment service providers and under the

same security conditions relating to identification and secure communication that also

apply for the dedicated interface and if the additional interfaces use widely accepted and

interoperable standards.

8543/1/26 REV 1 59

EN

(78) The notion of consent under this Regulation is without prejudice to the rules on lawful

processing of personal data, including provisions on consent and explicit consent, laid

down in Regulation (EU) 2016/679. Where processing of personal data is involved, it is the

responsibility of the data controller to assess the appropriate legal basis under Regulation

(EU) 2016/679 and ensure that all conditions for that legal basis laid down in that

Regulation are met.

(79) A payment transaction or a series of payment transactions should be considered to be

authorised only if the payer has given its consent for the execution of the payment

transaction in a manner agreed on between the payer and the account servicing payment

service provider. It should not be considered to be authorised where the transaction was

initiated or modified by a third party who is acting without the consent of the payment

service user. Instances of payment transactions initiated or modified by a third party acting

without the consent of the payment service user include situations where that third party is

using the payment service user’s personalised security credentials fraudulently obtained.

8543/1/26 REV 1 60

EN

(80) Security of credit transfers is fundamental for maintaining the confidence of payment

service users in such services and ensuring their use. Payers intending to send a credit

transfer to a given payee might, as a result of fraud or error, provide a unique identifier

which does not correspond to an account held by that payee. To contribute to the reduction

of fraud and errors, payment service users should benefit from a service which verifies

whether the unique identifier of the payee and the name of the payee, as provided by the

payer, match and, in the event that a mismatch is detected, notifies the payer thereof.

Where the payee is a legal person, that service could be carried out by verifying a match

between the unique identifier of the payee and another data element, such as a fiscal

number, a European unique identifier as referred to in Article 16(1), second subparagraph,

of Directive (EU) 2017/1132 of the European Parliament and of the Council23, or a Legal

Entity Identifier (LEI), that unambiguously identifies the payee, if the payer is allowed to

submit such data element via a payment initiation channel of the payer’s payment service

provider and such data element is available in the internal systems of the payee’s payment

service provider. Where the payment account of the payee is not identified by an

International Bank Account Number (IBAN), other type of unique identifier should be

used to unambiguously identify the payment account of the payee. Such services, in the

countries where they exist, have had a substantial positive impact on reducing the level of

fraud and errors. Given the importance of that service for the prevention of fraud and

errors, such service should be available free of charge to payment service users.

23 Directive (EU) 2017/1132 of the European Parliament and of the Council of 14 June 2017

relating to certain aspects of company law (OJ L 169, 30.6.2017, p. 46,

ELI: http://data.europa.eu/eli/dir/2017/1132/oj).

8543/1/26 REV 1 61

EN

To avoid undue frictions or delays in the processing of the transaction, the payer’s payment

service provider should provide such notification within no more than a few seconds from

the moment the payer has entered the payee information. To enable the payer to decide

whether to proceed with the intended transaction, the payer’s payment service provider

should provide such notification before the payer authorises the transaction. Certain credit

transfer initiation solutions might be available to payers allowing them to place a payment

order without inserting themselves both the unique identifier and the name of the payee. In

such cases, the payment service provider should ensure that the payee to whom the payer

intends to send a credit transfer is identified correctly.

(81) Regulation (EU) No 260/2012 provides for a service verifying the match between the

unique identifier and the name of the payee or another data element to be offered to users

of credit transfers in euro, including instant credit transfers in euro. To achieve a coherent

framework for all credit transfers whilst avoiding any undue overlap, the verification

service referred to in this Regulation should only apply to credit transfers which are not

covered by Regulation (EU) No 260/2012 and should be aligned with the verification

service provided for in Regulation (EU) No 260/2012.

8543/1/26 REV 1 62

EN

(82) Some attributes of the name of the payee to whose account the payer wishes to make a

credit transfer might increase the likelihood of a discrepancy being detected by the

payment service provider. Such discrepancies include the presence of diacritics or different

possible transliterations of names in different alphabets, differences between habitually

used names and names indicated on formal identification documents in the case of natural

persons, or differences between commercial and legal names in the case of legal persons.

To avoid undue friction in situations where the name of the payee provided by the payer

and the name associated with the IBAN or, where the IBAN is not used to identify the

payment account, another type of unique identifier, which was provided by the payer, do

not match exactly but nevertheless almost match and to facilitate the payer’s decision on

whether to proceed with the intended transaction, payment service providers should

indicate to the payer the name of the payee associated with the IBAN or another type of

unique identifier provided by the payer in a manner which ensures compliance with

Regulation (EU) 2016/679.

8543/1/26 REV 1 63

EN

(83) Authorising a payment transaction even though the matching verification service has

detected a mismatch and notified that mismatch to the payment service user can result in

the funds being transferred to an unintended payee. Payment service providers should

inform payment service users of the possible consequences of choosing to ignore the

notified mismatch and proceed with the execution of the transaction. Payment service users

that are not consumers should be able to opt out from receiving the service ensuring

verification of the payee when submitting payment orders via payment initiation channels

that are based on automated dedicated processes or protocols and that are only made

available to payment service users that are not consumers. After opting out, such payment

service users should be able to avail again of the service. Moreover, in order to allow for a

more smooth integration of the service ensuring verification in payment management

processes of such payment service users, payment service providers should offer them the

possibility of agreeing in the framework contract that the service ensuring verification with

respect to payment orders placed via such payment initiation channels is provided after

authorisation of those orders and that, in the case of certain specific outcomes of the

service ensuring verification, the payer’s payment service provider executes those orders

without any further input from the payment service user. Regulation (EU) No 260/2012

should be amended accordingly.

8543/1/26 REV 1 64

EN

(84) In order to allow the payment service user to protect itself, the payment service provider

should offer the payment service user the possibility to set, in the framework contract, a

limit of a maximum amount that can be transferred via a payment method or a payment

instrument. Furthermore, it should be possible for the payment service user to set limits

which differ for each means of payment and each payment instrument and which are

expressed, at the sole discretion of the payment service user, on a transaction basis or

within a set timeframe, such as a day or a week. Where the payment service provider

proposes a limit for credit transfers to be set by the payment service user, the proposed

limit should be the same for different types of credit transfers, so that the payment service

user is not unknowingly prevented from having the same access to instant credit transfers

as to other types of credit transfers. Payment service users should also be able to modify

limits that have been previously set in the framework contract.

8543/1/26 REV 1 65

EN

(85) To ensure the effectiveness of the spending limits, it is important that any increase in the

limits that is requested by the payment service user through a remote channel take effect

only after a delay period. If such a delay period is not in place, a fraudster could convince a

victim to adjust the victim’s spending limits and then immediately be able to defraud a

victim of a much higher amount. A delay period would give the payment service user time

to realise that they have been contacted and manipulated by a fraudster. The delay period

should by default be set at four hours by the payment service provider. The payment

service user should be able to adjust the delay period upwards or downwards or opt out of

the application of such a delay period with such actions being subject to the delay period in

place. The application of strong customer authentication should be required when the

payment service user requests an increase in spending limits through a remote channel.

(86) The payment service provider’s decision to block a payment instrument should be based on

objectively justified reasons based on the data acquired through the transaction monitoring

mechanism, and should take into account the risks of fraud that could jeopardise the safety

of the payment instrument and the interest of the payment service user. Examples of

objectively justified reasons might include suspicion of unauthorised use, suspicion of

fraudulent transactions, security of payment instrument, risk of deception regarding

financial activity and transactions carried out at long distances from each other in an

unjustifiably short timeframe.

8543/1/26 REV 1 66

EN

(87) As payment services become increasingly digital, many payment service providers are

offering payment service users the possibility of using mobile applications to initiate

payment services. While those mobile applications are useful and beneficial to payment

service users, they also pose a fraud risk. To prevent that risk, the process of activating a

mobile application on a device should require the use of different communication channels,

where there is an existing customer relationship between the payment service user and the

payment service provider, and the application of strong customer authentication. When

establishing the customer relationship, the payment service provider and the payment

service user should agree on a delay for the activation of a subsequent mobile application

to take effect in order to allow the payment service user to intervene if they are not the one

activating the mobile application. To allow for a convenient process of establishing a

customer relationship, also known as onboarding, the delay period should specifically not

apply when the mobile application is used to establish the customer relationship between

the payment service user and the payment service provider. The payment service provider

should set a delay period of four hours. Afterwards, the payment service user should have

the right to adjust or opt out of the application of such a delay period, in which case the

application of strong customer authentication should be required. Any adjustment of the

timeframe of the delay period requested by the payment service user should itself be

subject to the delay period proposed by the payment service provider, and could be

upwards or downwards from the period of four hours.

8543/1/26 REV 1 67

EN

The payment service provider should also notify the payment service user in a secure

manner, and through different communication channels, of the activation of a mobile

application linked to their payment account on a device if there is an existing customer

relationship between the payment service provider and the payment service user. The

purpose of the notification is to increase the vigilance of the payment service user and it

should therefore enable the payment service user to alert the payment service provider if

that user has not installed the mobile application. In that case, the payment service provider

should ensure that the mobile application does not allow access to the payment account of

the payment service user or the initiation of payment transactions. That obligation to notify

should not apply to the activation of a mobile application on a device of the payment

service user, if done by the payment service provider at its physical premises, and it should

not apply to the initial establishment of the customer relationship between the payment

service provider and the payment service user because no funds or payment account of the

payment service user are available through the payment service provider at the point of

establishing the customer relationship and because it would not be possible for the

payment service provider to contact the specific payment service user, given that, at the

point of onboarding, the payment service provider has not yet verified contact information

for the payment service user.

8543/1/26 REV 1 68

EN

(88) Payment service providers should ensure, in their communications with their customers,

that any information which, if unduly intercepted, might result in the compromise of the

security of the payment instrument or security payment credentials is transmitted to the

customer through safe and efficient communication channels.

(89) Provision should be made for the allocation of losses in the case of unauthorised payment

transactions or of specific authorised credit transfers. Different provisions may apply to

payment service users who are not consumers, since such users are normally in a better

position to assess the risk of fraud and take countervailing measures. To ensure a high level

of consumer protection, payers should always be entitled to address their claim for a refund

to their account servicing payment service provider, even where a payment initiation

service provider is involved in the payment transaction. That should be without prejudice

to the allocation of liability between the payment service providers.

(90) In the case of payment initiation services, the allocation of liability between the payment

service provider servicing the account and the payment initiation service provider involved

in the transaction should compel them to take responsibility for the respective parts of the

transaction that are under their control.

8543/1/26 REV 1 69

EN

(91) Where a payment service user denies having authorised an executed payment transaction

or claims that the payment transaction was not correctly executed, the use of a payment

instrument in the form agreed by the payment service provider and the payment service

user should not in itself necessarily be considered sufficient to prove that the payment

transaction was authorised by the payer. The authentication or the use of the strong

customer authentication recorded by the payment service provider, including the payment

initiation service provider, as appropriate, should not alone necessarily constitute sufficient

evidence either that the payment transaction was authorised by the payer or that the payer

acted fraudulently or failed with intent or gross negligence to fulfil one or more of the

obligations of the payment service user in relation to payment instruments and personalised

security credentials.

(92) In order for the payment service user to have an easier access to the payment service

provider, the latter should create and serve a communication channel to enable the payment

service user to make a notification or to request unblocking of the payment instrument as

provided for in this Regulation. That channel should also make it possible for the payment

service user to make a notification about a fraudulent transaction. Payment service

providers could use the channel to provide advice to a customer that suspects they are a

victim of a fraud attack and for payment service users to notify problematic issues

concerning executed payment transactions, such as errors of relevant devices during

execution of payment transactions.

8543/1/26 REV 1 70

EN

(93) Given the increasing complexity and rapidly changing patterns of fraud, it is appropriate to

ensure that, before a payment service provider concludes that a payment service user acted

fraudulently or with intent or gross negligence and therefore refuses a refund to that

payment service user in accordance with this Regulation, that payment service user should

be given the possibility to provide to their payment service provider, in support of their

claim, any relevant information or evidence concerning the circumstances of the disputed

payment transaction or series of payment transactions. In that context, where a payment

service user denies having authorised one or a series of payment transactions, or where a

payment service user who is a consumer claims that one or a series of payment transactions

were the result of fraud involving the impersonation of the payment service provider

within the meaning of this Regulation, the payment service provider should not conclude

that that payment service user, or consumer, as applicable, acted fraudulently or with intent

or gross negligence, without previously having invited proactively and unambiguously that

payment service user to provide any such information or evidence, and without having

duly considered it in its assessment. The obligation of the payment service provider to

enable the payment service user to supply relevant evidence or information in support of

their claims should be construed as a right of the payment service user to have all relevant

information concerning the circumstances of the disputed payment transaction or series of

payment transactions duly assessed by the payment service provider. Such right of the

payment service user should not be construed as a ground for the payment service provider

to conclude that the payment service user acted fraudulently or with intent or gross

negligence where the payment service user does not provide evidence that they cannot

reasonably be expected to have, such as voice call recordings, or where the payment

service user does not provide any evidence or information.

8543/1/26 REV 1 71

EN

(94) In the case of an unauthorised payment transaction, the payment service provider should

immediately refund the amount of that transaction to the payer. However, where the

payment service provider suspects that such unauthorised transaction resulted from the

payer failing with intent or gross negligence to fulfil one or more of the payer’s obligations

with regard to the security of payment instruments and personalised security credentials, or

from fraudulent behaviour by the payer, and where that suspicion is based on objectively

justified reasons, the payment service provider should be able to conduct an investigation

before refunding the payer. The payment service provider should, within 15 business days

after noting or being notified of the transaction, either refund to the payer the amount of

the unauthorised payment transaction or provide the payer with the reasons and supporting

evidence for refusing the refund and indicate the bodies to which the payer may refer the

matter if the payer does not accept the reasons provided. Where the payment service

provider refuses the refund after concluding from its investigation that the payer acted

fraudulently, the payment service provider should communicate the reasons for that

conclusion to the relevant national authority. Member States should provide a clear public

indication as to the relevant national authority to which such communication by the

payment service provider is to be addressed. To protect the payer from any disadvantages,

the credit value date of the refund should not be later than the date when the amount was

debited. To provide an incentive for the payment service user to notify, without undue

delay, the payment service provider of any theft, loss or misappropriation of a payment

instrument or personalised security credentials, and thus to reduce the risk of unauthorised

payment transactions, the user should be liable only for a very limited amount unless the

payment service user has acted fraudulently or with gross negligence.

8543/1/26 REV 1 72

EN

In that context, at the date of adoption of this Regulation an amount of EUR 50 is adequate

in order to ensure a harmonised and high-level user protection within the Union. There

should be no liability where the payer is not able to become aware of the loss, theft or

misappropriation of the payment instrument or personalised security credentials.

Moreover, once a payment service user has notified a payment service provider that his or

her payment instrument or personalised security credentials might have been

compromised, the payment service user should not be required to cover any further losses

stemming from unauthorised use of that payment instrument or personalised security

credentials. Payment service providers should be responsible for the technical security of

their own products.

(95) Liability provisions in the case of authorised credit transfers where there was an incorrect

provision or malfunctioning of the service verifying the match between the name and

unique identifier of a payee would create the right incentives for payment service providers

to provide a fully functioning service, with the aim of reducing the risk of payment

authorisations based on incorrect information. The payer’s payment service provider

should be held liable for, and without delay should refund to the payer, the full amount of a

defective credit transfer which resulted from a failure of that payment service provider to

provide, or to provide correctly, the payer with the service ensuring the verification of the

payee. Where the liability of the payer’s payment service provider is attributable to the

payee’s payment service provider or to the payment initiation service provider, the payee’s

payment service provider or, where relevant, the payment initiation service provider,

should compensate the payer’s payment service provider for the financial damage incurred.

8543/1/26 REV 1 73

EN

(96) Payment service providers should cooperate with payment service users and with

competent authorities in cases where the correct provision of the service ensuring the

verification of the payee is questioned.

(97) Payment service users should be adequately protected against so-called social engineering

fraud, where a fraudster manipulates a payment service user into performing a certain

action, such as initiating a payment transaction, or handing over the payment service user’s

security credentials to the fraudsters. The number of such type of social engineering cases

has significantly increased in recent years. Those new types of fraud blur the distinction in

Directive (EU) 2015/2366 between authorised and unauthorised transactions. Means

through which consent can be presumed to be granted are also becoming more complex to

identify, as fraudsters can take control of the whole consent and authentication process,

including the strong customer authentication completion. The conditions under which the

customer authorised a transaction by giving consent to it should be taken into due

consideration, including by courts, when determining whether to qualify the transaction

concerned as authorised or unauthorised. The transaction concerned might indeed have

been authorised in circumstances where such authorisation was granted on manipulated

premises affecting the integrity of the consent. It is therefore no longer possible, as was the

case in Directive (EU) 2015/2366, to limit refunds to unauthorised transactions only. It

would however be disproportionate and financially very costly to payment service

providers to open every fraudulent transaction, authorised or unauthorised, to a systematic

refund right. It might also cause moral hazard and reduced customer vigilance. It is

therefore necessary to define the conditions under which a payment service user has a right

to a refund.

8543/1/26 REV 1 74

EN

(98) Fraudsters often rely on tools and techniques such as caller ID, electronic mail address, or

IP address spoofing. Such fraud cases are complex, often involving different actors along

the fraud scheme chain. Payment service providers have more means than payment service

users to put an end to those fraud cases. Both payment service providers and providers of

electronic communications services can play a critical role in preventing fraud through

adequate prevention and robust technical measures. Payment service providers are subject

to specific obligations under Regulation (EU) 2022/2554 of the European Parliament and

of the Council24, which aims at mitigating ICT risks. Regulation (EU) 2022/2554 subjects

payment service providers to a comprehensive set of rules on ICT risk management

framework, including tools, policies and procedures to protect the confidentiality, integrity

and availability of data whether at rest, in use or in transit. For the purpose of complying

with those obligations, payment service providers should have in place adequate technical

measures and tools to prevent the fraudulent replication and misuse of the payment service

provider’s domain name and of the communication channels used for communication

between the payment service provider and the payment service user, including the payment

service provider’s electronic mail address and calling line identification.

24 Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December

2022 on digital operational resilience for the financial sector and amending Regulations

(EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU)

2016/1011 (OJ L 333, 27.12.2022, p. 1, ELI: http://data.europa.eu/eli/reg/2022/2554/oj).

8543/1/26 REV 1 75

EN

(99) Payment service provider impersonation, or spoofing, involves fraudsters pretending to be

the consumer’s payment service provider and misusing the domain name or the

communication channels attributed to the consumer’s payment service provider, for

example, the payment service provider’s e-mail address, telephone number, website or

mobile application. Spoofing fraud affects the reputation of the payment service provider

and of the financial sector as a whole and may cause significant financial damages to

Union consumers, affecting their trust in electronic payments and in the financial system.

A consumer who has been the victim of such cases of spoofing fraud should therefore be

entitled to a refund of the full amount of the fraudulent payment transaction from the

payment service provider, unless the consumer has acted fraudulently or with gross

negligence. Where the fraud concerns the payment service provider’s website or mobile

application, the refund right should encompass cases involving the appropriation of those

channels by the fraudster and cases involving fraudulently created versions of the website

or mobile application that mirror the contents of the real ones. As soon as the consumer

becomes aware that he or she has been a victim of that type of spoofing fraud

manipulation, he or she should without undue delay report the incident to his or her

payment service provider, and to the police, preferably via online complaint procedures,

where made available by the police. Given that especially vulnerable consumers might

have difficulties in reporting the fraud to the police in a timely manner, payment service

providers are encouraged to assist the consumer in such reporting, where necessary.

8543/1/26 REV 1 76

EN

(100) Payment fraud including the initiation or modification of payment orders without the

payer’s consent, the theft of sensitive payment data, including personalised security

credentials, or the manipulation of the payer, including by means of impersonation,

frequently involves fraudulent activity of users of services such as interpersonal

communications services or hosting services, which allow the storage and, where

applicable, dissemination of online content to the public. Depending on the technical

characteristics of the service provided, providers of those services have access to different

data, and as such, to different types of indications of potentially fraudulent activity. As

such, those providers have the capacity to contribute to the collective fight against fraud,

including via spoofing, by exchanging relevant information with payment service

providers, with the aim of preventing and detecting fraudulent uses of interpersonal

communication or hosting services. By way of example, relevant information may include

the payment account details of traders obtained by providers of online platforms allowing

consumers to conclude distance contracts with traders in accordance with Article 30 of

Regulation (EU) 2022/2065 of the European Parliament and of the Council25 related to

items of information identified as illegal content by those providers, or information on

payment instruments reported as stolen by payment service users to payment service

providers.

25 Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October

2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital

Services Act) (OJ L 277, 27.10.2022, p. 1, ELI: http://data.europa.eu/eli/reg/2022/2065/oj).

8543/1/26 REV 1 77

EN

The processing of personal data strictly necessary for the purposes of fraud prevention

constitutes a legitimate interest of the providers of interpersonal communications services,

providers of hosting services, payment service providers and their customers. Providers of

interpersonal communications services and of hosting services should be able to exchange

personal data with payment service providers to identify fraudulent actors and fraudulent

behaviours, where all conditions of Article 6(1), point (f), of Regulation (EU) 2016/679 are

fulfilled. Furthermore, providers of interpersonal communications services and hosting

services should also assist the fight against fraud by exchanging with payment service

providers information regarding fraud scenarios, trends and threats identified in relation to

the use of their services. In doing so, they may help improve the effectiveness of

transaction monitoring mechanisms and the educational campaigns and training on fraud

prevention implemented in accordance with this Regulation.

8543/1/26 REV 1 78

EN

(101) Where the relevant conditions, including the requirements of Regulation (EU) 2016/679,

for the exchange, on a voluntary basis, of information necessary to prevent and detect fraud

are fulfilled, providers of interpersonal communications services and providers of very

large online platforms and of very large online search engines should have in place

dedicated communication channels, or enter into information sharing arrangements or

systems for effective communication with payment service providers, such as the

information sharing arrangements established under Article 29 of Directive

(EU) 2022/2555 of the European Parliament and of the Council26. Such mechanisms

should contain robust safeguards in relation to confidentiality, data protection and use of

information, in compliance with Regulation (EU) 2016/679.

26 Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December

2022 on measures for a high common level of cybersecurity across the Union, amending

Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive

(EU) 2016/1148 (NIS 2 Directive) (OJ L 333, 27.12.2022, p. 80,

ELI: http://data.europa.eu/eli/dir/2022/2555/oj).

8543/1/26 REV 1 79

EN

(102) Directive (EU) 2022/2555 requires providers of publicly available interpersonal

communications services to take appropriate and proportionate technical, operational and

organisational measures to ensure the availability, authenticity, integrity and

confidentiality of their services. In so far as the fraudulent manipulation of calling line

identification or electronic mail address can be considered to compromise the availability,

authenticity, integrity, or confidentiality of those services, such providers should already be

required, pursuant to Directive (EU) 2022/2555, to implement measures addressing that

risk. Without prejudice to those obligations, providers of publicly available interpersonal

communications services should take appropriate organisational and technical measures to

detect and prevent the use of their services as a means for impersonation fraud, including

by means of manipulation of calling line identification or electronic mail address, where

that use aims to induce payment service users to make a payment or to take an action that

would compromise the security of the payment account. Any measures taken for the

purpose of preventing or detecting the use of these services for impersonation fraud must

comply with the rules set out under Regulation (EU) 2016/679 and Directive 2002/58/EC

of the European Parliament and of the Council27. In particular, those measures should not

involve the generalised and indiscriminate monitoring of content of communications or of

all traffic data.

27 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002

concerning the processing of personal data and the protection of privacy in the electronic

communications sector (Directive on privacy and electronic communications) (OJ L 201,

31.7.2002, p. 37, ELI: http://data.europa.eu/eli/dir/2002/58/oj).

8543/1/26 REV 1 80

EN

(103) Regulation (EU) 2022/2065 lays down fully harmonised rules on the provision of

intermediary services in the internal market and on specific due diligence obligations

tailored to certain specific categories of providers of intermediary services, namely ‘mere

conduit’, ‘caching’ and ‘hosting’ services. In particular, it imposes specific due diligence

obligations on online platforms and online search engines, including those designated as

very large online platforms or very large online search engines. Such due diligence

obligations play an important role in preventing the proliferation of illegal content online,

such as financial scams. For instance, providers of hosting services are obliged to put in

place user-friendly notice and action mechanisms to allow the reporting of illegal content,

such as illegal offers of financial services or attempted fraud, to the hosting service.

Providers of online platforms are also obliged to address notices from trusted flaggers as a

priority. Where, based on the information provided by the payer to the payment service

provider, or on other information available to the payment service provider, it can be

considered that a fraudulent payment transaction originates in an item of information

online, payment service providers should make use of the notification mechanisms referred

to in Article 16 of Regulation (EU) 2022/2065 to notify providers of hosting services of the

presence on their service of that specific item of information. Where providers of very

large online platforms and of very large online search engines comply with Article 16 of

Regulation (EU) 2022/2065, in particular by putting in place notice and action mechanisms

that are easy to access and user-friendly, they should be deemed to be compliant with the

obligation set out in this Regulation to inform the recipients of their services of the

procedure for reporting fraudulent activity present in their services. Payment service

providers should also be able to apply for ‘trusted flagger’ status pursuant to Article 22 of

Regulation (EU) 2022/2065.

8543/1/26 REV 1 81

EN

(104) Regulation (EU) 2022/2065 encourages and facilitates the drawing up of voluntary codes

of conduct at Union level to contribute to the proper application of that Regulation, taking

into account in particular the specific challenges of tackling different types of illegal

content and systemic risks, while fostering prevention, enhancing security and combatting

payment fraud and financial scams. The drawing up of a voluntary code of conduct at

Union level in the areas covered by this Regulation should also be facilitated.

(105) The fraudulent promotion and offering of financial services, such as the advertising of

credit, insurance, and investment, including crypto-asset, products and services provided

by or on behalf of entities which are neither authorised nor registered in accordance with

Union law or national law transposing Union law to provide such products and services,

can be linked with fraud in payments as a result of the deception and manipulation of

payment service users’ consent into initiating one or a series of payment transactions, or of

the theft of sensitive payment data, including personalised security credentials. In order to

reduce such fraudulent promotion and offering of financial services, providers of very

large online platforms and of very large online search engines should request from

advertisers of regulated financial services information, such as authorisation or registration

numbers, attesting that the provider of the regulated financial service advertised has been

authorised or registered to provide such services in a Member State or at Union level.

Providers of very large online platforms and of very large online search engines should

ensure that their services are not offered for advertising purposes until the advertiser

provides the information concerning the registration or authorisation of the entity on behalf

of whom the advertisement is made as a regulated financial service provider.

8543/1/26 REV 1 82

EN

This requirement should not amount to an obligation for the providers of very large online

platforms and of very large online search engines concerned to generally monitor the

products or services offered by traders through their services, nor to a general fact-finding

obligation, in particular to assess the accuracy of the information provided by advertisers.

However, providers of very large online platforms and of very large online search engines

concerned should, upon receiving from advertisers the information concerning the

authorisation or registration of the provider of the advertised regulated financial services,

and prior to allowing the advertiser to use their service for the purpose of advertising those

regulated financial services, make their best efforts to assess whether the information, for

the accuracy of which advertisers are responsible for the purposes of this Regulation, is

reliable and complete, provided that the assessment can be carried out in a proportionate

manner by automated tools. The European Supervisory Authorities, namely, EBA, the

European Supervisory Authority (European Securities and Markets Authority) (ESMA)

established by Regulation (EU) No 1095/2010 of the European Parliament and of the

Council28, and the European Supervisory Authority (European Insurance and Occupational

Pensions Authority) (EIOPA) established by Regulation (EU) No 1094/2010 of the

European Parliament and of the Council29, already maintain public registers of financial

service providers under the applicable legislation. Providers of very large online platforms

and of very large online search engines could use those registers in their efforts to ensure

that the information provided by the potential advertiser is reliable and complete.

28 Regulation (EU) No 1095/2010 of the European Parliament and of the Council of

24 November 2010 establishing a European Supervisory Authority (European Securities and

Markets Authority), amending Decision No 716/2009/EC and repealing Commission

Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84,

ELI: http://data.europa.eu/eli/reg/2010/1095/oj). 29 Regulation (EU) No 1094/2010 of the European Parliament and of the Council of

24 November 2010 establishing a European Supervisory Authority (European Insurance and

Occupational Pensions Authority), amending Decision No 716/2009/EC and repealing

Commission Decision 2009/79/EC (OJ L 331, 15.12.2010, p. 48,

ELI: http://data.europa.eu/eli/reg/2010/1094/oj).

8543/1/26 REV 1 83

EN

(106) Whereas providers of very large online platforms and of very large online search engines

have transparency and due diligence obligations with regard to online advertising under

that Regulation (EU) 2022/2065, this Regulation further specifies how those obligations

should apply in the specific case of advertising of regulated financial services. In

particular, in order to comply with their obligation to make reasonable efforts to ensure

that the information contained in their repositories established pursuant to Article 39 of

Regulation (EU) 2022/2065 is accurate and complete, providers of very large online

platforms and of very large online search engines could use the registers of authorised or

registered providers of regulated financial services made available in accordance with

relevant Union law, including Directive (EU) 2026/…+, including the public registers

maintained by European Supervisory Authorities.

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 84

EN

(107) Providers of very large online platforms and of very large online search engines are

required, under Regulation (EU) 2022/2065, to diligently identify, analyse and assess any

systemic risks stemming from the design or functioning of their service, including the

dissemination of illegal content through their services, such as malicious or fraudulent

online content within the meaning of this Regulation. Where applicable, further to that

assessment, providers of very large online platforms and of very large online search

engines should put in place reasonable, proportionate and effective mitigation measures in

accordance with Article 35 of Regulation (EU) 2022/2065 to address those risks, under the

direct supervision of the Commission. Where, pursuant to Article 35 of Regulation

(EU) 2022/2065, providers of very large online platforms and of very large online search

engines are to put in place mitigation measures related to the risk of fraudulent advertising

of regulated financial services which they have identified pursuant to Article 34 of that

Regulation, measures put in place in compliance with the obligations set out in this

Regulation could be considered to be one possible means of ensuring compliance of such

providers with Article 35(1), point (e), of Regulation (EU) 2022/2065. However,

compliance with the obligations set out in this Regulation should not necessarily be

construed as sufficient in itself to ensure compliance of such providers with Article 35(1),

point (e), of Regulation (EU) 2022/2065, and should therefore be without prejudice to

further mitigation measures which such providers may be required to put in place.

8543/1/26 REV 1 85

EN

(108) To assess possible negligence or gross negligence on the part of the payment service user,

account should be taken of all individual circumstances of the case. The evidence and

degree of alleged negligence should generally be evaluated according to national law.

However, while the concept of negligence implies a breach of a duty of care, ‘gross

negligence’ should mean more than mere negligence, involving conduct exhibiting a

significant degree of carelessness; for example, keeping the credentials used to authorise a

payment transaction beside the payment instrument in a format that is open and easily

detectable by third parties. When assessing the possibility of gross negligence on the part

of the payment service user, all factual circumstances should be taken into account, for

example the innovativeness and complexity of the fraud; the means or strategies used by

third parties to illegally take over the payment service user’s personalised security

credentials; whether the payment service user has previously fallen victim to the same type

of fraud; in the case of a new type of fraud, whether the payment service providers have

complied with their obligations under this Regulation, including with regard to their most

vulnerable groups of customers; whether the payment service user has taken adequate steps

in order to properly ensure the confidentiality of their personalised security credentials; any

known characteristics of the payment service user that might make the user more likely to

fall victim to fraud; whether the payment service providers offered clear, specific and

bespoke warnings to the payer, and whether the payment service user failed to have regard

to specific, directed interventions made by their payment service provider. That list is not

exhaustive, cumulative or binding and does not prejudice the discretion of Union or

national courts or of dispute resolution bodies.

8543/1/26 REV 1 86

EN

(109) Taking into account the fact that the term ‘gross negligence’ is interpreted in very different

ways across the Union, EBA is encouraged to issue guidelines to further specify the factual

circumstances to be taken into account when assessing the possibility of gross negligence

on the part of the payment service user.

(110) Contractual terms and conditions relating to the provision and use of a payment instrument,

the effect of which would be to increase the burden of proof on the consumer or to reduce

the burden of proof on the issuer, should be considered null and void. Moreover, in specific

situations and in particular where the payment instrument is not present at the point of sale,

such as in the case of online payments, it is appropriate to require the payment service

provider to provide evidence of alleged negligence since the payer’s means to do so are

very limited in such cases.

8543/1/26 REV 1 87

EN

(111) Consumers are particularly vulnerable in cases of payment transactions where the exact

transaction amount is not known at the moment when the payer gives consent to execute

the payment transaction, for example at automatic fuelling stations, in car rental contracts

or when making hotel reservations. The payer’s payment service provider should be able to

block an amount of funds on the payer’s payment account in proportion with the amount of

the payment transaction which can reasonably be expected by the payer, and only if the

payer has given consent for that precise amount to be blocked. Those funds should be

released immediately after receipt of the information on the exact final amount of the

payment transaction and at the latest immediately after receipt of the payment order. To

ensure a prompt release of the difference between the blocked amount and the exact

amount of the payment transaction, the payee should inform the payment service provider

immediately after the delivery of the service or goods to the payer.

8543/1/26 REV 1 88

EN

(112) It should be possible for Member States to lay down rules concerning the right to a refund

that are more favourable to the payer than those laid down in this Regulation. It would be

proportionate to permit the payer and the payer’s payment service provider to agree in a

framework contract that the payer has no right to a refund in situations where the payer is

otherwise protected. That might be either because the payer has given consent to execute a

transaction directly to its payment service provider, including when the payment service

provider acts on behalf of the payee, or because information on the future payment

transaction was provided or made available in an agreed manner to the payer at least four

weeks before the due date by the payment service provider or by the payee. In any event,

the payer should be protected by the general refund rule in the case of unauthorised or

incorrectly executed payment transactions or authorised credit transfers subject to an

incorrect application of the matching verification service or in the case of payment service

provider impersonation fraud.

8543/1/26 REV 1 89

EN

(113) For financial planning and the fulfilment of payment obligations on time, consumers and

undertakings need to have certainty as to the length of time that the execution of a payment

order will take. It is therefore necessary to establish when rights and obligations take

effect, namely, when the payment service provider receives the payment order, including

when the payment service provider has had the opportunity to receive it through the means

of communication agreed in the payment service contract. This is notwithstanding any

prior involvement in the process leading up to the creation and transmission of the payment

order, including checks on the security and availability of funds, information on the use of

the personal identity number or issuance of a payment promise. Furthermore, receipt of a

payment order should occur when the payer’s payment service provider receives the

payment order to be debited from the payer’s account. The timing of a payee’s

transmission of payment orders to the payment service provider for the collection of, for

instance, card payments or of direct debits, or the timing of the payee being granted a

pre-financing on the related amounts by the payment service provider by way of a

contingent credit to the account, should have no relevance in that respect.

(114) Payment service users should also be able to rely on the proper execution of a complete

and valid payment order if the payment service provider has no contractual or statutory

ground for refusal or otherwise refraining from such execution, such as obligations under

this Regulation or Regulation (EU) 2024/1624.

8543/1/26 REV 1 90

EN

(115) Given that fraud is a criminal activity in accordance with Article 2, point (1), of Directive

(EU) 2018/1673 of the European Parliament and of the Council30, it is considered a

predicate offence for the purposes of Regulation (EU) 2024/1624. For that reason, the

obligations laid down in that Regulation regarding the reporting of suspicious transactions

in accordance with Article 69 of that Regulation, and regarding the obligation to refrain

from executing those suspicious transactions in accordance with Article 71 of that

Regulation, apply also in cases where a payment service provider knows or suspects that a

payment transaction is fraudulent. Those obligations also apply where the payment service

provider has reasonable grounds to suspect that a payment transaction is related to criminal

activity, such as where the payer’s payment service provider has reasonable grounds to

suspect that a payment transaction that the payer is initiating may be the result of fraud, or

where, before making the funds available to the payee, the payee’s payment service

provider has reasonable grounds to suspect that a payment transaction that has been or will

be credited to its account may be the result of fraud.

30 Directive (EU) 2018/1673 of the European Parliament and of the Council of 23 October

2018 on combating money laundering by criminal law (OJ L 284, 12.11.2018, p. 22,

ELI: http://data.europa.eu/eli/dir/2018/1673/oj).

8543/1/26 REV 1 91

EN

(116) It is necessary to ensure consistency across the objectives of preventing payment service

users from becoming victims of fraud, compliance with Regulation (EU) 2024/1624 with

regard to suspicious transactions, and mitigating the impact on payment service users

deriving from delays in the execution of legitimate payment transactions or the refusal of

such transactions. For that reason, where a payment service provider refuses to execute a

payment transaction in accordance with this Regulation, such refusal should be without

prejudice to other obligations arising for that payment service provider under Regulation

(EU) 2024/1624 with respect to that payment transaction, such as the obligation to report

suspicions to the Financial Intelligence Unit in accordance with Article 69 of that

Regulation. In the case of credit transfers, while the outcome of the service ensuring the

verification of the payee applied in accordance with Regulation (EU) No 260/2012 and this

Regulation might constitute a relevant element in the payment service provider’s

monitoring of payment transactions with a view to detecting fraud, that outcome should not

in itself be the sole ground for the payment service provider’s decision to refuse to execute

the payment transaction, with a view to ensuring the right of the payer to proceed with

authorising the payment transaction concerned in accordance with Article 5c of Regulation

(EU) No 260/2012 and this Regulation.

8543/1/26 REV 1 92

EN

(117) In order to enable the payment service provider to assess whether or not there are

objectively justified reasons to suspect that a payment transaction is fraudulent and

therefore to refuse to execute that payment transaction, and in order to limit the impact on

payment service users with regard to legitimate payment transactions, the payer’s payment

service provider should contact the payer to obtain information necessary for the purposes

of such assessment, while remaining in full compliance with the rules on the prohibition of

disclosure of suspicions in Regulation (EU) 2024/1624. The payer’s payment service

provider should notify the payer of any information or action necessary from the payer for

the purposes of its assessment, while providing sufficient information to enable the payer

to understand the risks identified by the payment service provider. The payer’s payment

service provider should ensure that the payer has at all times appropriate means to contact

the payment service provider with a view to providing the information or performing the

action requested in that notification, and should make all reasonable efforts to contact the

payer before crediting the funds to the account of the payee’s payment service provider. In

accordance with Article 73 of Regulation (EU) 2024/1624, such communication between

the payer’s payment service provider and the payer should not at any moment disclose to

the payer or, where applicable, the payment initiation service provider, the fact that

payment transactions or activities are being or have been assessed in accordance with

Article 69 of Regulation (EU) 2024/1624, that information is being, will be or has been

transmitted in accordance with Article 69 or 70 of Regulation (EU) 2024/1624 or that an

analysis to this effect is being, or may be, carried out.

8543/1/26 REV 1 93

EN

(118) Given that, in accordance with Regulation (EU) No 260/2012, the amount of an instant

credit transfer in euro should be available on the payee’s payment account within ten

seconds of the time of receipt of the payment order by the payer’s payment service

provider, the rules requiring the payer’s payment service provider to notify and contact the

payer where it suspends the execution of a payment transaction due to a suspicion of fraud

should not apply in the case of instant credit transfers. In those cases and in cases where

the payer’s payment service provider, after notifying and contacting the payer, could

nevertheless not obtain the information required before the statutory timeline for crediting

the funds to the account of the payee’s payment service provider, the payer’s payment

service provider should form its assessment as to whether or not there are objectively

justified reasons to suspect fraud as well as its decision as to whether or not to refuse to

execute the payment transaction, on the basis of the transaction monitoring mechanism and

on any other relevant information available to the payment service provider, but not solely

on the basis of the outcome of the service ensuring the verification of the payee.

8543/1/26 REV 1 94

EN

(119) For the purposes of this Regulation, the fact that a payment order or payment transaction is

unusual should not automatically constitute grounds for suspecting that the payment

transaction is fraudulent, nor should it by itself constitute objectively justified reasons to

suspect fraud. However, any unusual payment order or payment transaction could

constitute an early indication of fraud, which should alert the payment service provider and

might need to be further investigated. In assessing whether there are objectively justified

reasons to suspect fraud in relation to a payment order or payment transaction, the payment

service provider should take into account the specific circumstances of the individual order

or transaction, together with the payment service provider’s wider assessment of evolving

fraud risk based on the payment service provider’s transaction monitoring or on any

relevant information available to the payment service provider. Where a decision to refuse

or suspend the execution of a payment transaction is based solely on automated processing,

such decision would be permissible only where suitable measures have been applied in

order to safeguard the rights, freedoms and legitimate interests of the payment service user.

8543/1/26 REV 1 95

EN

(120) Where the payment service provider refuses to execute a payment transaction, the refusal

and the reason for the refusal should be communicated to the payer, to the payee’s payment

service provider and, where applicable, to the payment initiation service provider without

undue delay, or, in the case of instant credit transfers, within 10 seconds of the time of

receipt of the payment order by the payer’s payment service provider, subject to the

requirements of Union and national law. In addition, the payer’s payment service provider

should inform the payer of the procedure allowing the payer to correct the assessment

leading to the refusal, or to reverse that decision. Where the framework contract provides

that the payment service provider may charge a fee for refusal, such a fee should be

objectively justified and should be as low as possible. The payer’s payment service

provider should not charge fees where it refuses to execute the payment transaction due to

a suspected fraud.

(121) In view of the speed with which fully automated payment systems process payment

transactions, which means that after a certain point in time payment orders cannot be

revoked without high manual intervention costs, it is necessary to lay down a clear

deadline for payment revocations. However, depending on the type of the payment service

and the payment order, it should be possible to vary the deadline for payment revocations

by agreement between the parties. Revocation, in that context, should apply only between a

payment service user and a payment service provider, and should be without prejudice to

the irrevocability and finality of payment transactions in payment systems.

8543/1/26 REV 1 96

EN

(122) Irrevocability of a payment order should not affect a payment service provider’s rights or

obligations under the laws of Member States, based on the payer’s framework contract or

national laws, regulations, administrative provisions or guidelines, in relation to

reimbursement of the payer with the amount of the executed payment transaction in the

event of a dispute between the payer and the payee. Such reimbursement should be

considered to be a new payment order. With the exception of those cases, legal disputes

arising within the relationship underlying the payment order should be settled only

between the payer and the payee.

(123) It is essential, for the fully integrated straight-through processing of payments and for legal

certainty with respect to the fulfilment of any underlying obligation between payment

service users, that the full amount transferred by the payer should be credited to the

account of the payee. Accordingly, it should not be possible for any of the intermediaries

involved in the execution of payment transactions to make deductions from the amount

transferred. However, it should be possible for payees to enter into an agreement with their

payment service provider authorising that payment service provider to deduct its own

charges. Nevertheless, in order to enable the payee to verify that the amount due is

correctly paid, subsequent information provided on the payment transaction should

indicate not only the full amount of funds transferred, but also the amount of any charges

that have been deducted.

8543/1/26 REV 1 97

EN

(124) The obligations in this Regulation regarding open banking interfaces and verification of the

payee should not apply to payment transactions with electronic money tokens. Extending

the application of such requirements to payment transactions with electronic money tokens

may impose considerable investment requirements and undue burdens on the entities

providing those services, given the high costs associated with the operationalisation of

those requirements. Moreover, taking into account the fact that transactions with electronic

money tokens are not as yet as common as typical payment transactions, there is less

urgency and value to be added in imposing such requirements as regards payment

transactions with electronic money tokens.

(125) To improve the efficiency of payments throughout the Union, all payment orders initiated

by the payer and denominated in euro or the currency of a Member State whose currency is

not the euro, including non-instant credit transfers and money remittances, should be

subject to a maximum one-day execution time, unless relevant Union or national law in the

field of anti-money laundering and countering the financing of terrorism provides

otherwise. For all other payments, such as payments initiated by or through a payee,

including direct debits and card payments, and in the absence of an explicit agreement

between the payment service provider and the payer setting a longer execution time, the

same one-day execution time should apply. It should be possible to extend those periods by

one additional business day if a payment order is given on paper, to allow the continued

provision of payment services to consumers who are accustomed only to paper documents.

When a direct debit scheme is used, the payee’s payment service provider should transmit

the collection order within the time limits agreed between the payee and the payment

service provider, enabling settlement on the agreed due date. It should be possible to

maintain or establish rules specifying an execution time shorter than one business day.

8543/1/26 REV 1 98

EN

(126) In order to enable payers to rapidly recover their funds wherever there is high risk that one

or a series of payment transactions might be fraudulent, it is appropriate to clarify in this

Regulation that, where the payee’s payment service provider has objectively justified

reasons to suspect that a payment transaction or series of payment transactions credited or

to be credited to its account may be the result of fraud, and where that payment service

provider refrains from making those funds available on the payment account of the payee

in compliance with its obligation to refrain from executing a suspicious transaction under

Article 71 of Regulation (EU) 2024/1624, that payment service provider is able to return

the funds credited to its account to the payer’s payment service provider, or to reject the

payment transaction or series of payment transactions to be credited to its account by the

payer’s payment service provider, as applicable. In order to enhance the protection of

payers, it is appropriate to require that, in certain cases where evidence suggesting fraud is

stronger, the payee’s payment service provider return the funds to the payer’s payment

service provider, or reject the payment transaction or series of payment transactions to be

credited by the payer’s payment service provider to its account, as applicable. To avoid

excessive de-risking practices, it is appropriate to establish a higher evidentiary threshold

according to which that obligation and the corresponding liability should apply, where the

payee’s payment service provider has strong, consistent and undisputed evidence or

indications to conclude, without plausible alternative explanation, that the payment

transaction or series of payment transactions are the result of fraud.

8543/1/26 REV 1 99

EN

(127) To preserve the trust of payment service users in the reliability of payment services, it is

important to ensure that measures aimed at fraud prevention which interfere with the

execution of payment transactions are sufficiently communicated to the payer, their

payment service provider, and, where applicable, the payment initiation service provider,

within the timelines applicable to the execution of those payment transactions set out in

this Regulation and in Regulation (EU) No 260/2012, while remaining in full compliance

with rules on the prohibition of disclosure laid down in Regulation (EU) 2024/1624. To

prevent the uneven application of those protection and transparency measures in the case

of instant credit transfers denominated in euro and in the case of instant credit transfers

denominated in other currencies, it is appropriate to establish in this Regulation that, for

any instant credit transfer, where, in accordance with this Regulation, the payee’s payment

service provider refuses to make the funds available to the payee and, as applicable, returns

those funds to the payer’s payment service provider or rejects the payment transaction or

series of payment transactions to be credited to its account by the payer’s payment service

provider, the payee’s payment service provider should notify the payer’s payment service

provider of that refusal within ten seconds of the time of receipt of the payment order for

that instant credit transfer or series of instant credit transfers by the payer’s payment

service provider. Upon receiving such notification, the payer’s payment service provider

should immediately restore the payment account of the payer to the state in which it would

have been had the transaction not taken place, and, free of charge, inform the payer, and,

where applicable, the payment initiation service provider, of the return of the funds, and

that the funds have not been made available on the payee’s payment account due to fraud

prevention measures. In accordance with Article 73 of Regulation (EU) 2024/1624, such

communications should not at any moment disclose to the payer or, where applicable, the

payment initiation service provider, the fact that payment transactions or activities are

being or have been assessed in accordance with Article 69 of Regulation (EU) 2024/1624,

that information is being, will be or has been transmitted in accordance with Article 69

or 70 of Regulation (EU) 2024/1624 or that an analysis to that effect is being, or may be,

carried out.

8543/1/26 REV 1 100

EN

(128) The rules on the execution of the full amount and the execution time should constitute

good practice where one of the payment service providers is not located in the Union.

When making a credit transfer or money remittance to a payee located outside the Union,

the payer’s payment service provider should provide to the payer an estimate of the time

needed for the credit transfer or money remittance to be credited to the payee’s payment

service provider located outside the Union. A payment service provider in the Union

cannot be expected to estimate the time needed for a payment service provider outside the

Union to, after having received the funds, credit those funds to the account of the payee.

(129) To strengthen their trust in payments markets, it is essential for payment service users to

know the real charges of payment services. Accordingly, the use of non-transparent pricing

methods should be prohibited, since it is commonly accepted that those methods make it

extremely difficult for users to establish the real price of the payment service. Specifically,

the use of value dating to the disadvantage of the user should not be permitted.

(130) It should be possible for the payment service provider to specify unambiguously the

information required to execute a payment transaction correctly. Without prejudice to its

obligation to provide the service ensuring the verification of the payee, the payer’s

payment service provider should act with due diligence and verify the coherence of the

unique identifier, and, where the unique identifier is found to be incoherent and therefore

the related payment transaction is not possible to execute, to refuse that payment order and

inform the payer thereof.

8543/1/26 REV 1 101

EN

(131) The smooth and efficient functioning of payment systems depends on the user being able

to rely on the payment service provider executing the payment transaction correctly and

within the agreed time. Usually, the payment service provider is able to assess the risks

involved in a payment transaction. It is the payment service provider that executes the

payment transaction, makes arrangements to recall misplaced or wrongly allocated funds

and decides in most cases on the intermediaries involved in that execution. In view of all of

those considerations, it is appropriate, except under abnormal and unforeseeable

circumstances, and except where otherwise provided under this Regulation or other

relevant Union law, to impose liability on the payment service provider in respect of the

execution of a payment transaction accepted from the user, except in respect of acts and

omissions by the payee’s payment service provider, who was selected solely by the payee.

However, in order not to leave the payer unprotected in the unlikely circumstance that it is

not clear that the payment amount was duly received by the payee’s payment service

provider, the corresponding burden of proof should lie with the payer’s payment service

provider. As a rule, it can be expected that the intermediary institution, usually an impartial

body such as a central bank or a clearing house, that transfers the payment amount from

the sending to the receiving payment service provider, will store the account data and will

be able to provide the data where necessary. Where the payment amount has been credited

to the receiving payment service provider’s account, the payee should immediately have a

claim against that payment service provider for credit of the payee’s account.

8543/1/26 REV 1 102

EN

(132) The payer’s payment service provider, namely the account servicing payment service

provider or, where appropriate, the payment initiation service provider, should assume

liability for correct payment execution, including the full amount of the payment

transaction and execution time, and full responsibility for any failure by other parties in the

payment chain up to the account of the payee. As a result of that liability, the payer’s

payment service provider should, where the full amount is not credited or is only credited

late to the payee’s payment service provider, correct the payment transaction or without

undue delay refund the payer the relevant amount of that transaction, without prejudice to

any other claims which may be made in accordance with national law. Due to the payment

service provider’s liability, the payer or payee should not be burdened with any costs

relating to an incorrect payment. In the case of non-execution, defective or late execution

of payment transactions, the value date of corrective payments of payment service

providers should always be the same as the value date in the case of correct execution.

8543/1/26 REV 1 103

EN

(133) The proper functioning of credit transfers and other payment services requires that

payment service providers and their intermediaries, including processors, have contracts in

which their mutual rights and obligations are laid down. Questions relating to liability form

an essential part of those contracts. To ensure mutual confidence among payment service

providers and intermediaries taking part in a payment transaction, it is necessary to provide

legal certainty that a non-responsible payment service provider is compensated for losses

incurred or sums paid pursuant to the rules on liability. Further rights and details of content

of recourse and how to handle claims towards the payment service provider or

intermediary attributable to a defective payment transaction should be subject to

agreement.

(134) For the purposes of Regulation (EU) 2022/2065, the concept of illegal content should be

understood to refer to information, irrespective of its form, that under the applicable Union

or national law is either itself illegal, or that the applicable rules render illegal in view of

the fact that it relates to illegal activities. Examples include any offer of financial services,

including payment services, which is not in compliance with requirements applicable to the

offer of such services under this Regulation, Directive (EU) 2026/…+ or other Union or

national law, or content rendered illegal in view of national law on fraud, including

offences set out under national law adopted pursuant to Directive (EU) 2019/713 of the

European Parliament and of the Council31.

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)). 31 Directive (EU) 2019/713 of the European Parliament and of the Council of 17 April 2019 on

combating fraud and counterfeiting of non-cash means of payment and replacing Council

Framework Decision 2001/413/JHA (OJ L 123, 10.5.2019, p. 18,

ELI: http://data.europa.eu/eli/dir/2019/713/oj).

8543/1/26 REV 1 104

EN

(135) Any claim by a payment service provider against other providers, such as providers of

electronic communications services or providers of intermediary services, for financial

damage caused in the context of fraud should be made in accordance with national law.

(136) With regard to providers of intermediary services, Regulation (EU) 2022/2065 sets up a

fully harmonised framework for the conditional exemption from liability of those

providers, under certain conditions and as interpreted by the Court of Justice of the

European Union. In order to benefit from the exemption from liability for hosting services

under Regulation (EU) 2022/2065, providers of hosting services including online

platforms, should remove illegal content or disable access to it, expeditiously, upon

obtaining actual knowledge or, in the case of claims for damages, upon becoming aware of

the content, in particular in cases in which the provider of hosting services has been made

aware of facts or circumstances on the basis of which a diligent economic operator should

have identified the illegality in question. In particular with regard to providers of hosting

services as defined in Article 3, point (g)(iii) of Regulation (EU) 2022/2065, where those

conditions for exemption from liability under Article 6(1) of that Regulation are not met,

and providers of hosting services become liable for content stored in their services, and

where that content gave rise to one or a series of unauthorised payment transactions or

fraudulent authorised payment transactions within the meaning of this Regulation, payment

service providers should be able to obtain compensation from providers of hosting services

for the amount refunded to their customers for those transactions under this Regulation.

8543/1/26 REV 1 105

EN

(137) Nothing in this Regulation should be interpreted as a general obligation placed on

providers of hosting services to monitor the information which they transmit or store, or as

requiring those providers to actively seek facts or circumstances indicating illegal activity,

such as the impersonation of a payment service provider.

(138) Provision of payment services by payment service providers may entail the processing of

personal data. The provision of account information services may entail the processing of

personal data concerning a data subject who is not the user of a specific payment service

provider, but whose personal data processing by that specific payment service provider is

necessary for the performance of a contract between the provider and the payment service

user. Where personal data are processed, the processing should comply with Regulation

(EU) 2016/679 and with Regulation (EU) 2018/1725 of the European Parliament and of

the Council32, including the principles of purpose limitation, data minimisation and storage

limitation. Data protection by design and data protection by default should be embedded in

all data processing systems developed and used within the framework of this Regulation.

Therefore, the supervisory authorities under Regulation (EU) 2016/679 and Regulation

(EU) 2018/1725 should be responsible for the supervision of processing of personal data

carried out in the context of the application of this Regulation.

32 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October

2018 on the protection of natural persons with regard to the processing of personal data by

the Union institutions, bodies, offices and agencies and on the free movement of such data,

and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295,

21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj).

8543/1/26 REV 1 106

EN

(139) As acknowledged in the communication of the Commission on a Retail Payments Strategy

for the EU, the good functioning of Union payments markets, including the security of

payments and the protection of payment service users against fraud, is of substantial public

interest. For that reason, when it is necessary in the context of this Regulation for the

provision of payment services and for compliance with this Regulation, payment service

providers, payment system operators and operators of payment schemes should be able to

process special categories of personal data as defined in Article 9(1) of Regulation

(EU) 2016/679, and Article 10(1) of Regulation (EU) 2018/1725, in accordance with

Article 9(2), point (g), and Article 10(2), point (g), of those Regulations respectively.

Where special categories of personal data are processed, payment service providers and

payment system operators should implement appropriate technical and organisational

measures to safeguard the fundamental rights and freedoms of natural persons. Those

measures should include technical limitations on the re-use of data and the use of

state-of-the-art security and privacy-preserving measures, including pseudonymisation, or

encryption to ensure compliance with the principles of purpose limitation, data

minimisation and storage limitation, as laid down in Regulation (EU) 2016/679. The

payment service providers and payment system operators should also implement specific

organisational measures, including training on processing such data, limiting access to

special categories of data and recording such access.

8543/1/26 REV 1 107

EN

(140) The provision of information to individuals about the processing of personal data should be

carried out in accordance with Regulation (EU) 2016/679 and Regulation (EU) 2018/1725.

(141) Fraudsters often target the most vulnerable individuals in our society. The timely detection

of fraudulent payment transactions is essential and transaction monitoring plays an

important role in that detection. It is therefore appropriate to require both the payer’s

payment service provider and the payee’s payment service provider to have in place

transaction monitoring mechanisms, reflecting the crucial contribution of those

mechanisms to fraud prevention, going beyond the protection offered by strong customer

authentication, in respect of payment transactions, including transactions involving

payment initiation services. The payer’s payment service provider should carry out such

transaction monitoring prior to the execution of a payment transaction, which in the case of

instant credit transfers means in real-time. The payee’s payment service provider should

carry out such transaction monitoring before making the funds available to the payee.

Where a payment service provider fails to comply with its obligations with respect to the

application of transaction monitoring to one or a series of payment transactions, and where

that payment transaction or series of payment transactions was initiated through fraudulent

means, or otherwise as a result of fraud, the full amount of that payment transaction or

series of payment transactions should be refunded to the payer by their payment service

provider. Where the payment service provider that failed to apply transaction monitoring is

the payee’s payment service provider, it should refund the payer’s payment service

provider for the amount refunded by the latter to the payer.

8543/1/26 REV 1 108

EN

(142) EBA should develop draft regulatory technical standards on the specific technical

requirements related to transaction monitoring mechanisms. Such requirements should

build on the added value stemming from environmental and behavioural characteristics

related to the payment habits of the payment service user.

(143) Payment service providers should be able to process information about their customers’

transactions and their payment accounts to the extent necessary to ensure that transaction

monitoring mechanisms effectively enable them to detect and prevent fraud, in particular

by detecting atypical behaviour of the payment service user that might indicate a

potentially fraudulent transaction or use of the payment account. Transaction monitoring

carried out by payment service providers, might, to the extent necessary to achieve the

purpose of detecting fraud, include the processing of information exchanged by means of

the service ensuring the verification of the payee or in the context of information sharing

arrangements established in accordance with this Regulation or other relevant Union law.

8543/1/26 REV 1 109

EN

(144) Payment service providers should store data processed for the purpose of complying with

their obligations with respect to transaction monitoring and fraud information sharing only

for as long as necessary for those purposes, and in any event, only for a maximum of five

years after the termination of the customer relationship. The revised Financial Action Task

Force Recommendations demonstrate that, in order to be able to cooperate fully and

comply swiftly with information requests from competent authorities for the purposes of

the prevention, detection or investigation of money laundering or financing of terrorism,

obliged entities should maintain, for at least five years, the necessary information obtained

through customer due diligence measures and the records on transactions. Accordingly,

Regulation (EU) 2024/1624 establishes that the retention period applicable to personal data

processed in accordance with that Regulation, including as regards information processed

in the context of information sharing partnerships established under Article 75 of that

Regulation, should be fixed at five years after the end of a business relationship or an

occasional transaction. Given that fraud is considered a predicate offence for the purposes

of Regulation (EU) 2024/1624, it is appropriate to establish a maximum retention period

applicable to personal data processed in accordance with this Regulation, which should

also be fixed at five years after the end of a business relationship or an occasional

transaction, in order to ensure legal certainty and consistency across financial crime

preventive and detection measures.

8543/1/26 REV 1 110

EN

(145) Fraud is inherently adaptive and comprises an open-ended diversity of practices and

techniques, including the stealing of authentication credentials, invoice tampering, and

social manipulation. Therefore, to be able to prevent ever new types of fraud, transaction

monitoring should be constantly improved, making full use of technology such as artificial

intelligence, as well as of fraud intelligence that is as complete and up to date as possible.

Often, one payment service provider does not have full overview of all elements and

indicators that could lead to timely detection of potentially fraudulent activity in a given

payment transaction. The exchange of information among payment service providers can

increase the possibilities for better detecting potential fraud and protecting payment service

users. For that reason, payment service providers should, for the purpose of transaction

monitoring, make use of payment fraud data shared by other payment service providers,

and share payment fraud data with other payment service providers on a multilateral basis

in the framework of information sharing arrangements. Where the sharing of information

involves the processing of personal data, such sharing should be limited to the types of

personal data which payment service providers can process for the purpose of monitoring

transactions in accordance with this Regulation. However, environmental and behavioural

characteristics which are typical of the payment service user in the circumstances of a

normal use of the personalised security credentials should not be shared. Data shared

should relate to the specific payment transactions for which the payment service provider

has a suspicion of fraud, and not to connected previous or subsequent transactions.

Payment service providers should also share the objectively justified reasons which have

led to the suspicion of fraudulent activity with respect to that particular payment

transaction, and, where that payment transaction is associated with a potentially fraudulent

item of information stored by a provider of hosting services, information concerning the

notification made to that provider of hosting services.

8543/1/26 REV 1 111

EN

(146) Information sharing should be subject to robust state-of-the-art safeguards relating to

confidentiality, data protection and use of information, such as pseudonymisation and

encryption, access and user control, and should be in accordance with Regulation

(EU) 2016/679. Before concluding an information sharing arrangement, payment service

providers should carry out a data protection impact assessment, in accordance with

Article 35 of that Regulation. Where the data protection impact assessment indicates that,

in the absence of safeguards, security measures and mechanisms to mitigate the risk, the

processing would result in a high risk to the rights and freedoms of natural persons,

payment service providers should consult the relevant data protection authority in

accordance with Article 36 of that Regulation. A new impact assessment should not be

required when a payment service provider joins an existing information sharing

arrangement for which a data protection impact assessment has already been carried out.

The information sharing arrangement should lay down technical and organisational

measures to protect personal data. It should also lay down the roles and responsibilities of

all involved payment service providers in accordance with data protection rules, including

in the case of joint controllership.

8543/1/26 REV 1 112

EN

(147) Payment service providers are able to exchange data related to payment transactions where

there is a suspicion of fraud with other participants of information sharing partnerships

established in accordance with Article 75 of Regulation (EU) 2024/1624, including

competent authorities such as Financial Intelligence Units, supervisory authorities and any

public authority that has the function of investigating or prosecuting money laundering, its

predicate offences or financing of terrorism, or that has the function of tracing, seizing or

freezing and confiscating criminal assets, in accordance with fundamental rights and

judicial procedural safeguards. Payment service providers are also able to share with other

payment service providers and other participants, including public authorities, data related

to threats to the security of their ICT systems, including where spoofing, phishing and

malware are used to commit fraud against payment service users, in the context of

information sharing arrangements on cyber threat information and intelligence established

under Article 45 of Regulation (EU) 2022/2554. As such partnerships or arrangements

already provide adequate frameworks for the involvement of public authorities, including

law enforcement authorities, in the voluntary sharing of data related to fraud, subject to

adequate safeguards, it is not considered necessary to create an additional regime for such

exchange under this Regulation.

8543/1/26 REV 1 113

EN

(148) Where a payment service provider participates in information sharing partnerships or

arrangements established in accordance with Article 75 of Regulation (EU) 2024/1624 and

Article 45 of Regulation (EU) 2022/2554, and where those information sharing

partnerships or arrangements enable the payment service provider to exchange the data

necessary for the purpose of detecting and preventing fraud in accordance with this

Regulation, the sharing of data within the framework of those information sharing

partnerships should be considered sufficient to ensure compliance by the payment service

provider with its obligations under this Regulation to share payment fraud data in the

framework of information sharing arrangements. Where payment service providers

participate in those information sharing partnerships or arrangements for the purpose of

complying with obligations under this Regulation, they should be allowed to process

personal data exchanged in the context of such partnerships or arrangements for the

purpose of complying with the transaction monitoring obligations set out in this

Regulation.

8543/1/26 REV 1 114

EN

(149) To prevent legitimate exchanges of information on potentially fraudulent activity leading

to unjustified de-risking or withdrawal of payment account services to payment service

users without explanation or recourse, it is appropriate to have safeguards in place.

Payment fraud data shared under a multilateral information sharing arrangement that might

entail the disclosure of personal data, including unique identifiers of payees potentially

involved in fraudulent credit transfers, should only be used by payment service providers

for the purpose of enhancing transaction monitoring. Additional safeguards should be put

in place by payment service providers, such as contacting the customer if he or she is the

payer of a credit transfer which can be assumed to be fraudulent, and further monitoring of

an account, where the unique identifier shared as potentially fraudulent designates a

customer of that payment service provider. Payment fraud data shared amongst payment

service providers in the context of such arrangements should not constitute grounds for

withdrawal of payment account services without a detailed investigation.

8543/1/26 REV 1 115

EN

(150) When developing measures to combat fraud in the area of payment services, it is

particularly important to conduct appropriate consultations with relevant stakeholders in

order to exchange best practices and share experiences. Those consultations should build

on input from public- and private-sector experts with proven knowledge and experience in

the areas concerned. To that end, the Commission should establish a platform on

combatting fraud. The platform on combatting fraud should be composed of experts and

may include, for example, representatives of relevant Union bodies, national competent

authorities, payment service providers, technical service providers, providers of online

platforms, telecommunications providers, internet service providers, experts representing

different payment systems or schemes, merchants, consumer organisations, and

dispute-resolution bodies.

(151) The platform on combatting fraud should be constituted in accordance with the applicable

horizontal rules on the creation and operation of Commission expert groups, including with

regard to the selection process. The selection process should aim to ensure a high level of

expertise and a geographical and gender balance, as well as a balanced representation of

relevant knowledge and experience, taking into account the specific tasks of the platform

on combatting fraud. During the selection process, the Commission should carry out an

assessment in accordance with those horizontal rules to determine whether potential

conflicts of interest exist among candidates for selection and should take appropriate

measures to prevent or address any such conflicts.

8543/1/26 REV 1 116

EN

(152) The platform on combatting fraud should advise the Commission on developing and

monitoring the implementation of legal acts aimed at combatting fraud in the area of

payment services. For the purpose of drawing up a voluntary code of conduct to foster

prevention, enhance security and combat payment fraud and financial scams, the platform

on combatting fraud should provide recommendations to the Commission and the

European Board for Digital Services. The platform on combatting fraud should also share

information on and analyse trends in fraud in the area of payment services, as well as share

information on measures to combat fraud in the area of payment services, including

mitigation measures, and on ways to improve cross-border and cross-sectoral cooperation

on the means of combatting fraud in the area of payment services. The platform on

combatting fraud should carry out its tasks in accordance with the principle of

transparency. It should also take into account the work of existing initiatives to combat

payment fraud, avoiding duplication, and work closely with them.

8543/1/26 REV 1 117

EN

(153) Payment fraud is becoming increasingly sophisticated, with fraudsters using manipulative

and impersonating techniques which are difficult for payment service users to detect

without a sufficient level of awareness and information about fraud. Payment service

providers can play an important role in reinforcing fraud prevention by regularly taking

every necessary initiative to increase their payment service users’ understanding and

awareness about the risks and trends of payment fraud. In particular, payment service

providers should run proper awareness raising programmes and campaigns on fraud trends

and risks addressed to customers and employees of payment service providers, with the

aim of helping customers realise that they are victims of attempted fraud. Payment service

providers should give their consumers, through various media, appropriate information

about fraud, providing clear messages and warnings and helping them to react properly

when exposed to potentially fraudulent situations. EBA should be encouraged to develop

guidelines on the different programmes to be developed by payment service providers on

payment fraud risks, taking into account the ever-changing nature of fraud-related risks,

where it deems it necessary to achieve consistency of such programmes across the Union.

8543/1/26 REV 1 118

EN

(154) Awareness of fraud threats is essential to enhance the level of protection of payment

service users against such threats, and therefore their level of confidence in the use of

payment services across the Union, in particular in light of rapid change in the techniques

and strategies deployed by fraudsters. Member States can play a crucial role in ensuring

the collective levelling up of awareness and the preparedness of citizens in that regard,

beyond the individual information supplied by service providers to their customers.

Directive (EU) 2022/2555 already requires Member States to develop national

cybersecurity strategies, in the context of which specific policies should be adopted with

the aim of promoting and developing education and training on cybersecurity,

cybersecurity skills, awareness raising and research and development initiatives, as well as

guidance on good cyber hygiene practices and controls, aimed at enhancing the level of

awareness and preparedness of citizens, stakeholders and entities against cybersecurity

risk, including techniques used to carry out fraud, such as phishing, spoofing, malware and

other forms of social engineering. Furthermore, Directive (EU) 2019/713 requires Member

States to establish or strengthen policies to prevent fraud and counterfeiting of non-cash

means of payment and measures to reduce the risk of such offences occurring, including

attempts to commit fraud such as phishing and skimming, by means of information and

awareness-raising campaigns and education programmes. In compliance with their

obligations under those Directives, Member States should develop and keep up to date

permanent and adequate measures to raise awareness among the public about the existing

and emerging patterns of payment fraud, procedures to be followed in accordance with this

Regulation in order to identify and report attempted fraud and the rights and obligations of

payment service users with regard to fraud under this Regulation. Member States should

inform the Commission of the measures adopted.

8543/1/26 REV 1 119

EN

(155) Member States should ensure that sufficient funding is available for such awareness raising

and education measures, and that they are adequately targeted, in particular to the needs

and interests of vulnerable consumer groups, including young and elderly people and those

with limited digital skills. Payment service providers, providers of interpersonal

communications services as defined in Directive (EU) 2018/1972 of the European

Parliament and of the Council33, and providers of very large online platforms and of very

large online search engines should cooperate with Member States in the development and

updating of such fraud awareness campaigns, including by providing information on fraud

threats and patterns identified in their services, and best practices in terms of users’

awareness. Such cooperation should be free of charge, within reasonable and proportionate

terms.

(156) Security of electronic payments is fundamental for ensuring the protection of users and the

development of a sound environment for e-commerce. All payment services offered

electronically should be carried out in a secure manner, adopting technologies that are able

to guarantee the safe authentication of the user and to reduce, to the maximum extent

possible, the risk of fraud. In the area of fraud, the major innovation of Directive

(EU) 2015/2366 was the introduction of strong customer authentication. The

Commission’s evaluation of the implementation of Directive (EU) 2015/2366 concluded

that strong customer authentication has already been highly successful in reducing fraud.

33 Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December

2018 establishing the European Electronic Communications Code (OJ L 321, 17.12.2018,

p. 36, ELI: http://data.europa.eu/eli/dir/2018/1972/oj).

8543/1/26 REV 1 120

EN

(157) Requirements for strong customer authentication should not be changed substantially from

the existing requirements under Directive (EU) 2015/2366. Strong customer authentication

will continue to be based on two or more elements, from the categories of knowledge,

possession and inherence, that are independent from each other. The category inherence

relates to physical properties of body parts, physiological characteristics and behavioural

processes created by the body, and any combination of these. At least two of the elements

used need to come from different categories. To allow for innovations in authentication

technology, an exception to that principle permits the usage of two elements from the

category inherence, where that does not lower the level of security. To ensure a high level

of security and the uniform application of this exception by national competent authorities,

EBA should develop guidelines on how to assess the independence of the two elements in

such cases.

8543/1/26 REV 1 121

EN

(158) Strong customer authentication should not be circumvented, in particular by any

unjustified reliance on strong customer authentication exemptions. Clear definitions of

merchant-initiated transactions and of mail order or telephone order transactions should be

introduced since these notions, which may be relied upon to justify non-application of

strong customer authentication, are diversely understood and applied and are subject to

abusive reliance. Regarding merchant-initiated transactions, strong customer authentication

should be applied at the set-up of the initial mandate, without the need to apply strong

customer authentication for subsequent merchant-initiated payment transactions.

Regarding mail order or telephone order transactions, only the placement of the payment

order, and not also its authentication or execution, should be non-digital for a transaction to

be considered as a mail order or telephone order transaction and, therefore, not be covered

by the obligation to apply strong customer authentication. In that sense, a card-based

payment transaction could be considered a mail order or telephone order transaction if the

placement of the payment order takes place in a non-electronic way, for example, when

payment details are transmitted from the cardholder to a merchant via non-electronic

channels. However, payment transactions based on paper-based payment orders, mail

orders or telephone orders placed by the payer should still entail security requirements and

checks by the payer’s payment service provider allowing authentication of the payment

transaction. Strong customer authentication should also not be circumvented by practices

including resorting to a provider of services of acquiring payment transactions established

outside of the Union to escape the strong customer authentication requirements.

8543/1/26 REV 1 122

EN

(159) As the payment service provider that should apply strong customer authentication is the

payment service provider that issues the personalised security credentials, payment

transactions that are not initiated by the payer but by the payee only should not be subject

to strong customer authentication, to the extent that those transactions are initiated without

any interaction or involvement of the payer. The regulatory approach to merchant-initiated

transactions and direct debits, both being transactions initiated by the payee, should be

aligned and benefit from the same consumer protection measures, excluding the

unconditional right to a refund, which should apply only to direct debits.

8543/1/26 REV 1 123

EN

(160) In the interest of establishing a level-playing field among different payment instruments, it

should be possible to initiate one or several recurring credit transfers, including of varying

amounts, without the obligation to apply strong customer authentication where such credit

transfers are initiated by the payer’s payment service provider following a request from the

payee, provided that certain cumulative conditions are met. In particular, this should be

possible where the request from the payee is based on the payee’s agreement with the

payer which sets out the conditions regarding frequency of payments and amounts to be

paid, where the payer sets up an agreement with its payment service provider which is

subject to strong customer authentication and which instructs the provider to execute the

respective credit transfers in line with the agreement of the payer with the payee, and

where the initiation of the respective credit transfers by the payer’s payment service

provider does not require any additional action from the payer. To ensure equivalent

safeguards, the provisions concerning refunds and requests for refunds applicable to

payment transactions initiated by or through a payee should apply to credit transfers falling

under this framework under the same conditions as those applicable to merchant-initiated

transactions. In addition, to promote unhindered innovation and accelerate broader

availability of efficient payment methods to payers and payees at the point of interaction, it

is necessary to allow for the initiating of one or several recurring credit transfers under that

framework as of the date of entry into force of this Regulation.

8543/1/26 REV 1 124

EN

(161) To improve financial inclusion, and in line with Directive (EU) 2019/882, all payment

service users, including persons with disabilities, older persons, persons with limited

digital skills and those who do not have access to digital devices such as smartphones,

should benefit from the protection against fraud which is provided by strong customer

authentication, in particular when it comes to the use of remote digital payment

transactions and online access to payment accounts as fundamental financial services. With

the introduction of strong customer authentication, certain consumers in the Union found it

impossible to carry out online transactions because they lacked the capability to perform

strong customer authentication. Therefore, payment service providers should ensure that

their customers can benefit from various methods to perform strong customer

authentication which are adapted to their needs and situations. Those methods should be

free of charge and should not depend on one single technology, device or mechanism, or

on the possession of a smartphone or another smart device.

8543/1/26 REV 1 125

EN

(162) European Digital Identity Wallets implemented under Regulation (EU) No 910/2014 of the

European Parliament and of the Council34 are electronic identification means that offer

identification and authentication tools for accessing financial services across borders,

including payment services. The introduction of the European Digital Identity Wallet is

intended to further facilitate cross-border digital identification and authentication for

secure digital payments and facilitate the development of a pan-European digital payments

landscape. Pursuant to Article 5f(2) of Regulation (EU) No 910/2014, payment service

providers will be under an obligation to accept the use of European Digital Identity Wallets

to support the fulfilment of the strong customer authentication requirements for online

identification for the purposes of account login and of initiation of transactions in the field

of payment services. EBA should be tasked with the drafting of regulatory technical

standards which should specifically take into account the use of European Digital Identity

Wallets to support the fulfilment of the strong customer authentication requirements for the

purposes above.

(163) The growth of electronic commerce and mobile payments should be accompanied by a

generalised enhancement of security measures. In cases of remote initiation of a payment

transaction, namely where a payment order is placed via the internet, the authentication of

transactions should rely on dynamic codes in order to make the payment service user

aware, at all times, of the amount of the payment and the payee of the transaction that the

payment service user is authorising.

34 Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July

2014 on electronic identification and trust services for electronic transactions in the internal

market and repealing Directive 1999/93/EC (OJ L 257, 28.8.2014, p. 73,

ELI: http://data.europa.eu/eli/reg/2014/910/oj).

8543/1/26 REV 1 126

EN

(164) The requirement to apply strong customer authentication to remote payment transactions

using codes which dynamically link transactions to a specific amount and a specific payee

should reflect the growth of mobile payments and the emergence of a variety of models

through which mobile payments are executed.

(165) Dynamic linking addresses the risk of tampering with the payee’s name and the specific

amount of the transaction between the moment a payment order is placed and the

authentication of the payment, but also the risk of fraud more generally, for mobile

payments for which the performance of strong customer authentication requires the use of

internet on the payer’s device. Therefore, payment service providers should also apply

elements which dynamically link transactions to a specific amount and a specific payee or

harmonised security measures of identical effect which ensure the confidentiality,

authenticity and integrity of the transaction throughout all of the phases of initiation.

8543/1/26 REV 1 127

EN

(166) Under the exemption from strong customer authentication under Article 18 of Delegated

Regulation (EU) 2018/389, payment service providers were allowed not to apply strong

customer authentication where the payer initiated a remote electronic payment transaction

identified by the payment service provider as posing a low level of risk evaluated on the

basis of transaction monitoring mechanisms. Feedback from the market showed however

that, in order to have more payment service providers implementing transaction risk

analysis, it is necessary to adopt appropriate rules on the scope of such analysis,

introducing clear audit requirements, providing more detail and better definitions on risk

monitoring requirements and the data to be shared, and to assess the potential benefits of

allowing payment service providers to report fraudulent transactions for which they are

solely liable. EBA should therefore develop draft regulatory technical standards laying

down rules on transaction risk analysis.

(167) Security measures should be compatible with the level of risk involved in payment

services. To allow the development of user-friendly and accessible means of payment for

low-risk payments, such as low value contactless payments at the point of sale or payment

transactions initiated by legal persons, whether or not those payments are made via mobile

phone, the exemptions to the application of security requirements should be specified in

regulatory technical standards. Safe use of personalised security credentials is necessary to

limit the risks relating to spoofing, phishing and other fraudulent activities. The user

should be able to rely on the adoption of measures that protect the confidentiality and

integrity of personalised security credentials.

8543/1/26 REV 1 128

EN

(168) Payment service providers should apply strong customer authentication when, among

others, the payment service user is carrying out any action through a remote channel which

may imply the risk of payment fraud or other abuses. Payment service providers should

have in place adequate security measures to protect the confidentially and integrity of the

payment service user’s personalised security credentials.

(169) There is no consistent understanding among market stakeholders across Member States of

the strong customer authentication requirements applicable to the enrolment of payment

instruments, in particular payment cards, in digital wallets. The creation of a token or its

replacement process may give rise to a risk of payment fraud or other abuses. The creation

or replacement of a token of a payment instrument, which is done via a remote channel

with the participation of the payment service user, should therefore require the application

of strong customer authentication by the payment service provider of the payment service

user at the time of the issuance or replacement of the token. By applying strong customer

authentication at the token creation or replacement stage, the payment service provider

should verify remotely that the payment service user is the rightful user of the payment

instrument and associate the user and the digitised version of the payment instrument with

the relevant device.

8543/1/26 REV 1 129

EN

(170) Operators of digital pass-through wallets that verify the elements of strong customer

authentication when tokenised instruments stored in the digital wallets are used for

payments should be required to enter into outsourcing agreements with payers’ payment

service providers to allow them to continue to perform such verifications while requiring

them to comply with key security obligations. The payer’s payment service providers

should, under such agreements, retain full liability for any failure by operators of digital

pass-through wallets to apply strong customer authentication and have the right to audit

and control the wallet operator’s security provisions.

(171) Where technical service providers or operators of payment schemes provide services to

payees or to the payment service providers of payees or of payers, they should support the

application of strong customer authentication within the remit of their role in the initiation

or execution of payment transactions. Given the role that they play in ensuring that key

security requirements concerning retail payments are properly implemented, including by

providing appropriate IT solutions, technical service providers and operators of payment

schemes should be held liable for direct financial damage caused to payees, to the payment

service providers of payees or of payers for, and proportionate to, their failure, within the

remit of their contractual relationship, and not exceeding the amount of the transaction in

question, to provide the services that are necessary to enable the application of strong

customer authentication.

8543/1/26 REV 1 130

EN

(172) Member States should ensure that competent authorities designated by Member States

under Article 18 of Directive 2013/11/EU of the European Parliament and of the Council35

perform the functions set out in Articles 19 and 20 of that Directive regarding dispute

resolution entities established on their territories, which intend to qualify as alternative

dispute resolution (ADR) entities for the settlement of disputes concerning the rights and

obligations under this Regulation.

(173) Competent authorities should have the power to request information from providers of

intermediary services within the meaning of Regulation (EU) 2022/2065 that contribute to

the operation of unauthorised payment services and to instruct them to block or restrict

access to websites hosted by operators of unauthorised payment services. In the interest of

temporarily safeguarding customer funds and other assets, that power should already be

available at the investigation stage if there is a reasonable suspicion based on facts

justifying the assumption that unauthorised business operations are taking place.

35 Directive 2013/11/EU of the European Parliament and of the Council of 21 May 2013 on

alternative dispute resolution for consumer disputes and amending Regulation (EC) No

2006/2004 and Directive 2009/22/EC (Directive on consumer ADR) (OJ L 165, 18.6.2013,

p. 63, ELI: http://data.europa.eu/eli/dir/2013/11/oj).

8543/1/26 REV 1 131

EN

(174) Without prejudice to the right of customers to bring actions before the courts, Member

States should ensure the existence of easily accessible, adequate, independent, impartial,

transparent and effective ADR procedures between payment service providers and

payment service users. Regulation (EC) No 593/2008 of the European Parliament and of

the Council36 provides that the protection afforded to consumers by the mandatory rules of

the law of the country in which they have their habitual residence is not to be undermined

by any contractual terms concerning the law applicable to the contract. With a view to

establishing an efficient and effective dispute resolution procedure, Member States should

ensure that payment service providers subscribe to an ADR procedure in compliance with

the quality requirements laid down in Directive 2013/11/EU, to resolve disputes before

resorting to a court. For contractual consumer-to-business disputes regarding the purchase

of goods or services, Directive 2013/11/EU ensures that consumers and businesses in the

Union have access to quality-certified out-of-court dispute resolution entities that comply

with the quality requirements set out in Directive 2013/11/EU. Participation in ADR

procedures for the settlement of disputes between payment service providers and

consumers concerning rights and obligations pursuant to this Regulation should be

mandatory for payment service providers. That would allow consumers, who do not have

the same means and resources as legal persons, to enforce their rights under this

Regulation, to have access to more expedient and cheaper enforcement means. However,

consumers should not be forced to participate in such ADR procedures.

36 Regulation (EC) No 593/2008 of the European Parliament and of the Council of 17 June

2008 on the law applicable to contractual obligations (Rome I) (OJ L 177, 4.7.2008, p. 6,

ELI: http://data.europa.eu/eli/reg/2008/593/oj).

8543/1/26 REV 1 132

EN

(175) The right to an effective remedy and the right to a fair trial are fundamental rights laid

down in Article 47 of the Charter of Fundamental Rights of the European Union

(‘the Charter’). Therefore, ADR procedures should not be designed to replace court

procedures and should not deprive consumers or traders of their rights to seek redress

before the courts. This Regulation should not prevent parties from exercising their right of

access to the judicial system. In cases where a dispute could not be resolved through a

given ADR procedure whose outcome is not binding, the parties should not subsequently

be prevented from initiating judicial proceedings in relation to that dispute. Member States

should be free to choose the appropriate means to achieve that objective. They should have

the possibility to provide, among others, that limitation or prescription periods do not

expire during an ADR procedure.

(176) Consumers should be entitled to enforce their rights in relation to the obligations imposed

on payment service providers under this Regulation through representative actions in

accordance with Directive (EU) 2020/1828 of the European Parliament and of the

Council37.

37 Directive (EU) 2020/1828 of the European Parliament and of the Council of 25 November

2020 on representative actions for the protection of the collective interests of consumers and

repealing Directive 2009/22/EC (OJ L 409, 4.12.2020, p. 1,

ELI: http://data.europa.eu/eli/dir/2020/1828/oj).

8543/1/26 REV 1 133

EN

(177) Appropriate procedures should be established to pursue complaints against payment

service providers which do not comply with their obligations and to ensure that, where

appropriate, effective, proportionate and dissuasive penalties are imposed. To ensure

effective compliance with this Regulation, Member States should designate competent

authorities which meet the conditions laid down in Regulation (EU) No 1093/2010 and

which act independently of payment service providers. Member States should notify the

Commission of the authorities which have been designated, including a clear description of

their tasks.

(178) In light of the fact that certain provisions in Directive (EU) 2015/2366, such as those on ex

ante transparency of costs and execution time, were designed with traditional electronic

payments in mind and did not take into account the specific characteristics of the use of

distributed ledger technology or similar technology for payment transactions with

electronic money tokens, it is important to specify whether those requirements apply to

payment transactions with electronic money tokens, and to introduce transitional

provisions in this regard.

8543/1/26 REV 1 134

EN

(179) It is necessary to enhance convergence of powers at the disposal of competent authorities

so as to pave the way towards an equivalent intensity of enforcement across the integrated

payments market. Competent authorities should be granted all supervisory, investigatory

and sanctioning powers necessary to ensure compliance with this Regulation. This

Regulation should therefore lay down a common minimum set of the powers with which

competent authorities should be entrusted, coupled with adequate resources to guarantee

supervisory effectiveness. In order to protect consumers and ensure adequate information

for the market at any time, competent authorities should be empowered to adopt timely

supervisory measures, such as suspending or prohibiting the provision, marketing and

advertising of services, or issuing public notices to warn the public about an actual or

suspected infringement of this Regulation. Competent authorities should use those powers

in particular when the infringement takes the form of unauthorised payment services, false

or misleading information disseminated through the payments market, and, more generally,

where a payment service provider or third party involved in the provision of payment

services has failed to fulfil its obligations under this Regulation. Where information

published by competent authorities through public notices appears to be inaccurate,

incomplete or its underlying circumstances incorrect, competent authorities should

promptly rectify it through the same communication channels used to inform the public.

8543/1/26 REV 1 135

EN

(180) In a digital environment, competent authorities should be able to stop infringements of this

Regulation swiftly and effectively, notably where the infringer conceals his identity or

relocates within the Union or to a third country in order to avoid enforcement. In cases

where there is a risk of serious harm to the interests of consumers, the competent

authorities should be able to adopt interim measures, including the removal of content from

an online interface or ordering the explicit display of a warning to consumers when they

access an online interface. Such measures should not go beyond what is necessary to

achieve the objective of bringing to an end or prohibiting the infringement of this

Regulation.

(181) Without prejudice to the right to bring action in court to ensure compliance with this

Regulation, competent authorities should exercise the necessary powers granted under this

Regulation, including the power to investigate alleged infringements and to impose

administrative sanctions and administrative measures, where the payment service provider

does not comply with the rights and obligations laid down in this Regulation, in particular

if there is a risk of re-offending or another concern for consumer interests. Competent

authorities should establish effective mechanisms to encourage reporting of potential or

actual infringements. Those mechanisms should be without prejudice to the rights of the

defence of anyone who has been charged.

8543/1/26 REV 1 136

EN

(182) Member States should be required to provide for effective, proportionate and dissuasive

administrative sanctions and administrative measures in relation to infringements of

provisions from this Regulation. Those administrative sanctions, periodic penalty

payments and administrative measures should meet certain minimum requirements,

including the minimum powers that should be vested on competent authorities to be able to

impose them, the criteria that competent authorities should take into account in their

application, in their publication and in reporting about them. Member States should lay

down specific rules and effective mechanisms regarding the application of periodic penalty

payments.

(183) Competent authorities should be empowered to impose administrative pecuniary penalties

which are sufficiently high to offset the benefits that can be expected and to be dissuasive

even to larger institutions.

(184) When imposing administrative sanctions and administrative measures, competent

authorities should have regard to any previous criminal penalties imposed on the same

natural or legal person responsible for the same infringement when determining the type of

administrative penalties or other administrative measures and the level of administrative

pecuniary penalties. The aim is to ensure that the severity of the penalties and other

administrative measures imposed for punitive purposes, in cases of duplication of

administrative and criminal proceedings, is limited to what is necessary in view of the

seriousness of the infringement concerned.

8543/1/26 REV 1 137

EN

(185) An effective supervisory system requires that supervisors be aware of any weaknesses in

payment service providers’ compliance with the rules set out in this Regulation. It is

therefore important that supervisors be able to inform one another of the administrative

sanctions and administrative measures imposed on payment service providers, when such

information would be relevant for other supervisors too.

(186) The effectiveness of the Union framework for payment services depends on cooperation

between a wide array of competent authorities, including national authorities responsible

for taxation, and other enforcement authorities. Member States should ensure that their

legal frameworks allow and facilitate such cooperation as is required to achieve the goals

of the Union framework for payment services, including through the proper enforcement of

its rules. Such cooperation should include exchanges of information as well as mutual

assistance for the effective enforcement of administrative sanctions and administrative

measures, in particular in the cross-border recovery of pecuniary penalties.

8543/1/26 REV 1 138

EN

(187) Regardless of their designation under national law, forms of expedited enforcement

procedures or settlement agreements can be found in many Member States and are used as

an alternative to formal proceedings in order to achieve a swifter adoption of a decision to

impose an administrative sanction or administrative measure or to put an end to the alleged

infringement concerned and its consequences before formal sanctioning proceedings are

initiated. Due to the variety of legal approaches adopted at national level, it does not

appear appropriate to strive to harmonise at Union level the enforcement methods

introduced by Member States. Nevertheless, it should be acknowledged that such methods

allow the competent authorities that can implement them to handle infringement cases in a

speedier, less costly and overall more efficient way under certain circumstances and they

should therefore be encouraged. However, Member States should not be under an

obligation to introduce such enforcement methods in their legal frameworks nor should

they be required to compel competent authorities to use them if they do not deem it

appropriate.

(188) Member States have established and currently provide for a diverse range of administrative

sanctions and administrative measures for infringements of the key provisions of Union

law regulating the provision of payment services and there are inconsistent approaches to

investigating and sanctioning violations of those provisions. Failing to set out more clearly

which core provisions must trigger sufficiently dissuasive enforcement in every Member

State would thwart the achievement of the single market for payment services and risks

incentivising forum shopping in so far as competent authorities are unevenly equipped to

enforce promptly and with the same deterrence infringements of those provisions.

8543/1/26 REV 1 139

EN

(189) Since the purpose of periodic penalty payments, which are applied in accordance with

national law, is to compel natural or legal persons who are identified as responsible for an

ongoing infringement of Union law or who are required to comply with an order from an

investigating competent authority, to comply with that order or terminate the ongoing

infringement, the application of periodic penalty payments should not prevent competent

authorities from imposing subsequent administrative sanctions or other administrative

measures for the same infringement.

(190) Unless otherwise provided for by Member States, periodic penalty payments should be

calculated on a daily basis.

(191) Competent authorities should be empowered by Member States to impose administrative

sanctions and administrative measures on payment service providers or other natural or

legal persons where relevant to remedy the infringement of this Regulation. The range of

sanctions and measures available to competent authorities should be sufficiently broad to

allow Member States and competent authorities to take account of the differences between

payment service providers, in particular between credit institutions and other payment

institutions, as regards their size, characteristics and the nature of their business.

8543/1/26 REV 1 140

EN

(192) The publication of an administrative sanction or administrative measure for infringement

of provisions of this Regulation can have a strong dissuasive effect against repetition of

such infringement. Publication also informs other entities of the risks associated with the

sanctioned payment service provider before entering into a business relationship and

assists competent authorities in other Member States in relation to the risks associated with

a payment service provider when it operates in their territories on a cross-border basis. For

those reasons, the publication of decisions on administrative sanctions and administrative

measures as well as information on the right to appeal them and the outcome of such an

appeal should be allowed as long as it concerns legal persons. In taking a decision on

whether to publish an administrative sanction or administrative measure, competent

authorities should take into account the gravity of the infringement and the dissuasive

effect that the publication is likely to produce. However, where any such publication refers

to natural persons, it may impinge on their rights stemming from the Charter and the

applicable Union data protection legislation in a disproportionate manner. Therefore,

publication should occur in an anonymised way unless the competent authority deems the

publication of decisions containing personal data to be necessary for the effective

enforcement of this Regulation, including in the case of public statements or temporary

bans. In such cases the competent authority should justify its decision.

8543/1/26 REV 1 141

EN

(193) To collect more accurate information on the level of compliance with Union law on the

ground, while giving competent authorities’ enforcement activity more visibility, it is

necessary to enlarge the scope and improve the quality of the data that competent

authorities report to EBA. Information to be reported should be anonymised to comply

with data protection rules in force and provided in aggregated form to comply with

professional secrecy and confidentiality rules as regards proceedings. EBA should report

regularly to the Commission on the progress of enforcement actions in Member States.

(194) The power to adopt acts in accordance with Article 290 TFEU should be delegated to the

Commission in respect of supplementing this Regulation by further specifying the fee

information that payment card schemes and processing entities must disclose to providers

of services of acquiring payment transactions; updating the amount up to which a payer

may be obliged to bear losses relating to unauthorised payment transactions resulting from

the loss, theft or misappropriation of a payment instrument or personalised security

credentials; adjusting the rules applicable to payment transactions with electronic money

tokens in light of technological and market developments; and specifying the criteria and

factors to be taken into account by EBA when determining certain conditions related to

temporary intervention powers. It is of particular importance that the Commission carry

out appropriate consultations during its preparatory work, including at expert level, and

that those consultations be conducted in accordance with the principles laid down in the

Interinstitutional Agreement of 13 April 2016 on Better Law-Making38. In particular, to

ensure equal participation in the preparation of delegated acts, the European Parliament

and the Council receive all documents at the same time as Member States’ experts, and

their experts systematically have access to meetings of Commission expert groups dealing

with the preparation of delegated acts.

38 OJ L 123, 12.5.2016, p. 1, ELI: http://data.europa.eu/eli/agree_interinstit/2016/512/oj.

8543/1/26 REV 1 142

EN

(195) In order to ensure consistent application of this Regulation, the Commission should be able

to rely on the expertise and support of EBA, which should have the task of preparing

guidelines and draft regulatory and implementing technical standards. The Commission

should be empowered to adopt those draft regulatory technical standards. When developing

guidelines, draft regulatory technical standards and draft implementing technical standards

pursuant to this Regulation and in accordance with Regulation (EU) No 1093/2010, EBA

should consult all relevant stakeholders, including those in the payment services market,

reflecting all interests involved.

(196) EBA should, in line with Article 9(5) of Regulation (EU) No 1093/2010, be granted

product intervention powers to be able to temporarily prohibit or restrict in the Union a

certain type or specific feature of a payment service which is identified as potentially

causing harm to consumers, thereby threatening the orderly functioning and integrity of

financial markets. Regulation (EU) No 1093/2010 should therefore be amended

accordingly.

(197) To facilitate cross-border cooperation on the enforcement of this Regulation, the Annex to

Regulation (EU) 2017/2394 of the European Parliament and of the Council39 should be

amended to include a reference to this Regulation.

39 Regulation (EU) 2017/2394 of the European Parliament and of the Council of 12 December

2017 on cooperation between national authorities responsible for the enforcement of

consumer protection laws and repealing Regulation (EC) No 2006/2004 (OJ L 345,

27.12.2017, p. 1, ELI: http://data.europa.eu/eli/reg/2017/2394/oj).

8543/1/26 REV 1 143

EN

(198) Since the objective of this Regulation, namely further integration of an internal market in

payment services, cannot be sufficiently achieved by the Member States because it requires

harmonisation of various different rules in Union and national law, but can rather, by

reason of its scale and effects, be better achieved at Union level, the Union may adopt

measures in accordance with the principle of subsidiarity as set out in Article 5 of the

Treaty on European Union. In accordance with the principle of proportionality as set out in

that Article, this Regulation does not go beyond what is necessary in order to achieve that

objective.

(199) Considering that this Regulation and Directive (EU) 2026/…+ lay down the legal

framework governing the provision of payment services within the Union, to ensure legal

certainty and consistency of the Union’s legal framework, this Regulation should apply

from the same date as the date of application of the laws, regulations and administrative

provisions that Member States are required to adopt to comply with Directive

(EU) 2026/…+. However, the provisions requiring payment service providers to verify

discrepancies between the name and unique identifier of a payee in the case of credit

transfers, and the corresponding liability regime, should apply from … [27 months from

the date of entry into force of this Regulation], thus granting payment service providers

enough time to take the necessary steps to adjust their internal systems to comply with

such requirements.

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 144

EN

(200) In keeping with the principles of better regulation, this Regulation should be reviewed for

its effectiveness and efficiency in achieving its objectives. The review should take place a

sufficient time after the date of application of this Regulation for adequate evidence to

exist on which the review can be based. Seven years is considered to be an appropriate

period. While the review should consider this Regulation as a whole, certain topics should

be singled out for particular attention, namely the functioning of open banking, further

solutions to combat fraud and the appropriateness and impact of the rules on the extent of

situations where a consumer has a refund right for authorised transactions. However

regarding other topics, namely charging practices for payment services, the obligations

imposed on providers of electronic communications services and on providers of hosting

services on payments fraud prevention, the scope of this Regulation, and the

appropriateness and impact of the rules set out in this Regulation with regard to payment

transactions with electronic money tokens, it is appropriate for a review to take place

earlier than … [seven years from the date of entry into force of this Regulation], given the

fundamental importance attached to those topics for the functioning of a competitive,

innovative and secure payments market in the Union. That review of scope should consider

both the possible extension of the list of covered payment services to include services such

as those performed by payment systems and payment schemes, and the possible inclusion

in the scope of some technical services currently excluded.

8543/1/26 REV 1 145

EN

(201) In view of the increasing relevance of virtual IBANs being used for legitimate business

purposes within the Union, it is essential to enhance legal certainty and ensure compliance

with Regulation (EU) No 260/2012. It is therefore necessary to clarify that virtual IBANs

are subject to the same rules as IBANs, containing the elements specified by ISO.

Regulation (EU) No 260/2012 should be amended accordingly. In addition, virtual IBANs

are permissible as valid payment account identifiers where the use of an IBAN is required.

Considering the risks and challenges posed by virtual IBANs, including from an anti-

money laundering and countering the financing of terrorism perspective, on the one hand,

and their benefits, on the other, the Commission should submit a report to the European

Parliament, the Council, the ECB and the European Economic and Social Committee

assessing whether it is necessary to introduce any further measures regulating virtual

IBANs at Union level and, if appropriate, submit a legislative proposal together with the

report.

(202) In keeping with the principles of better regulation, this Regulation should be reviewed for

the appropriateness and the impact of the rules set out in Titles II and III of this Regulation

with regard to payment transactions with electronic money tokens. In its review, the

Commission should assess whether, given developments, it would be desirable, to extend

the requirements on the verification of the payee and open banking under this Regulation

to payment transactions with electronic money tokens.

8543/1/26 REV 1 146

EN

(203) This Regulation respects fundamental rights and observes the principles recognised by the

Charter, including the right to respect for private and family life, the right to protection of

personal data, the freedom to conduct a business, the right to an effective remedy and the

right not to be tried or punished twice in criminal proceedings for the same offence. This

Regulation must be applied in accordance with those rights and principles.

(204) References to amounts in euro in this Regulation are to be understood as the national

currency equivalent as determined by each Member State whose currency is not the euro.

References to payment transactions in euro or other currencies are to be understood as

payment transactions with funds denominated in euro or other currencies, including

electronic money tokens denominated in euro or other currencies.

(205) The European Data Protection Supervisor has been consulted in accordance with

Article 42(1) of Regulation (EU) 2018/1725 and delivered an opinion

on 22 August 202340,

HAVE ADOPTED THIS REGULATION:

40 OJ C, C/2023/1019, 16.11.2023, ELI: http://data.europa.eu/eli/C/2023/1019/oj.

8543/1/26 REV 1 147

EN

TITLE I

SUBJECT MATTER, SCOPE AND DEFINITIONS

Article 1

Subject matter

1. This Regulation lays down uniform rules for the provision of payment services, as regards:

(a) the transparency of conditions and information requirements;

(b) the respective rights and obligations of payment service users, and of payment

service providers.

2. Unless otherwise specified, a reference in this Regulation to payment services shall be

understood as any payment service referred to in Annex I to Directive (EU) 2026/…+.

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 148

EN

Article 2

Scope

1. This Regulation applies to payment services provided within the Union by the following

categories of payment service provider:

(a) credit institutions as defined in Article 4(1), point (1), of Regulation

(EU) No 575/2013 of the European Parliament and of the Council41, including

branches thereof where such branches are located in the Union, whether the head

offices of those branches are located within the Union or outside the Union;

(b) post office giro institutions which are entitled under national law to provide payment

services;

(c) payment institutions;

(d) the ECB and national central banks when not acting in their capacity as monetary

authority or other public authorities;

(e) Member States and their regional or local authorities when not acting in their

capacity as public authorities.

41 Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June

2013 on prudential requirements for credit institutions and amending Regulation (EU)

No 648/2012 (OJ L 176, 27.6.2013, p. 1, ELI: http://data.europa.eu/eli/reg/2013/575/oj).

8543/1/26 REV 1 149

EN

2. This Regulation also applies to services provided within the Union by the following

entities:

(a) technical service providers, for the purposes of Article 23(2) and

Articles 59, 94, 96, 97, 101 and 103;

(b) payment system operators and operators of payment schemes, for the purposes of

Articles 31, 84, 101 and 103, operators of payment schemes, including payment card

schemes, for the purposes of Article 59 and operators of payment card schemes and

processing entities for the purposes of Article 32;

(c) providers of interpersonal communications services, for the purposes of

Articles 61, 90, 96, 101 and 103;

(d) providers of electronic communications services, for the purposes of Article 96;

(e) providers of hosting services, for the purposes of Articles 61, 82 and 101;

(f) providers of very large online platforms and of very large online search engines, for

the purposes of Articles 61, 62, 90 and 98;

(g) original equipment manufacturers of mobile devices, for the purposes of Article 96.

3. This Regulation does not apply to:

(a) payment transactions made exclusively in cash directly from the payer to the payee,

without any intermediary intervention;

8543/1/26 REV 1 150

EN

(b) payment transactions made exclusively in electronic money tokens directly from the

payer to the payee, without any intermediary intervention;

(c) payment transactions from the payer to the payee through a commercial agent,

provided that the following conditions are met:

(i) the commercial agent is authorised via an agreement to negotiate or conclude

the sale or purchase of goods or services solely on behalf of the payer or solely

on behalf of the payee, but not both of them; and

(ii) such agreement gives the commercial agent actual scope to negotiate with the

payer or payee or to conclude the sale or purchase of goods or services;

(d) payment transactions consisting of non-professional cash collection and delivery

within the framework of a non-profit or charitable activity;

(e) services where cash is provided by the payee to the payer as part of a payment

transaction for the purchase of goods and services, following an explicit request by

the payment service user just before the execution of that payment transaction;

(f) services where retail stores agree to provide cash following an explicit request by the

payment service user but independently of the execution of any payment transaction

and without any obligation to make a purchase of goods or services;

8543/1/26 REV 1 151

EN

(g) payment transactions based on any of the following documents, drawn on the

payment service provider to place funds at the disposal of the payee:

(i) paper cheques governed by the Geneva Convention of 19 March 1931

providing a uniform law for cheques;

(ii) paper cheques similar to those referred to in point (i) and governed by the laws

of Member States which are not party to the Geneva Convention

of 19 March 1931 providing a uniform law for cheques;

(iii) paper-based drafts referred to in the Geneva Convention of 7 June 1930

providing a uniform law for bills of exchange and promissory notes;

(iv) paper-based drafts similar to those referred to in point (iii) and governed by the

laws of Member States which are not party to the Geneva Convention

of 7 June 1930 providing a uniform law for bills of exchange and promissory

notes;

(v) paper-based vouchers or physical vouchers of a similar nature;

(vi) paper-based traveller’s cheques;

(vii) paper-based postal money orders as defined by the Universal Postal Union;

(h) payment transactions carried out within a payment or securities settlement system

between settlement agents, central counterparties, clearing houses, central banks or

other participants of the system, and payment service providers, without prejudice to

Article 31;

8543/1/26 REV 1 152

EN

(i) payment transactions related to securities asset servicing, including dividends,

income or other distributions, or redemption or sale, carried out by persons referred

to in point (h) or by investment firms, credit institutions, collective investment

undertakings or asset management companies providing investment services and any

other entities allowed to have the custody of financial instruments;

(j) payment transactions carried out by a crypto-asset service provider intermediating

between a buyer and a seller where electronic money tokens are exchanged for other

electronic money tokens or for other crypto-assets, or the exchange of electronic

money tokens for funds, including electronic money tokens, or for crypto-assets

carried out by a crypto-asset service provider acting in its own name as buyer or

seller of those electronic money tokens;

(k) services based on specific payment instruments, including electronic money-based

instruments, that meet one of the following conditions:

(i) instruments allowing the holder to acquire goods or services only on the

premises, including physical premises or online stores, of the issuer or within a

single limited network of service providers under direct commercial agreement

with a professional issuer;

(ii) instruments which can be used only to acquire a very limited range of goods or

services, including instruments restricted to use in transactions between

payment service users who are not consumers;

8543/1/26 REV 1 153

EN

(iii) instruments valid only in a single Member State, which are provided at the

request of an undertaking or a public sector entity and regulated by a national

or regional public authority for specific social or tax purposes to acquire

specific goods or services from suppliers having a commercial agreement with

the issuer, and which cannot be converted into cash;

(l) payment transactions by a provider of electronic communications networks as

defined in Article 2, point (1), of Directive (EU) 2018/1972 or of services provided

in addition to electronic communications services as defined in Article 2, point (4),

of that Directive to a subscriber to the network or service:

(i) for the purchase of digital content and voice-based services, regardless of the

device used for the purchase or consumption of the digital content and charged

to the related bill; or

(ii) performed from or via an electronic device and charged to the related bill

within the framework of a charitable activity or for the purchase of tickets;

provided that the value of any single payment transaction does not exceed EUR 60

and:

– the cumulative value of payment transactions for an individual subscriber does

not exceed EUR 360 per month, or

– where a subscriber pre-funds its account with the provider of the electronic

communications network or service, the cumulative value of payment

transactions does not exceed EUR 360 per month;

8543/1/26 REV 1 154

EN

(m) payment transactions carried out between payment service providers, their agents or

branches for their own account;

(n) payment transactions carried out between crypto-asset service providers or their

branches for their own account;

(o) payment transactions and related services between a parent undertaking and its

subsidiary or between subsidiaries of the same parent undertaking, without any

intermediary intervention by a payment service provider other than an undertaking

belonging to the same group, and the collection of payment orders on behalf of a

group by a parent undertaking or its subsidiary for onward transmission to a payment

service provider;

(p) professional physical transport of banknotes and coins, including their collection,

processing and delivery;

(q) cash-to-cash currency exchange operations where the funds are not held on a

payment account.

4. Titles II and III apply to payment transactions in the currency of a Member State where

both the payer’s payment service provider and the payee’s payment service provider are, or

the sole payment service provider in the payment transaction is, located within the Union.

8543/1/26 REV 1 155

EN

5. Title II, with the exception of Article 13(1), point (b), Article 20(2),point (e), and

Article 24, point (a), and Title III, with the exception of Articles 70 to 76, apply to

payment transactions in a currency that is not the currency of a Member State, where both

the payer’s payment service provider and the payee’s payment service provider are, or the

sole payment service provider in the payment transaction is, located within the Union, in

respect of those parts of the payment transaction which are carried out in the Union.

6. Title II, with the exception of Article 13(1), point (b), Article 20(2), point (e),

Article 20(5), point (h), and Article 24, point (a), and Title III, with the exception of

Article 28(2) and (3), Articles 51, 58, 65, 66 and 70, Article 73(1), and Articles 79 and 82,

apply to payment transactions in all currencies where only one of the payment service

providers is located within the Union, in respect of those parts of the payments transaction

which are carried out in the Union.

7. Member States may exempt the institutions referred to in Article 2(5), points (4) to (23), of

Directive 2013/36/EU from the application of all or part of the provisions of this

Regulation.

8. By … [12 months from the date of entry into force of this Regulation], EBA shall issue

guidelines in accordance with Article 16 of Regulation (EU) No 1093/2010, addressed to

the competent authorities, on the exclusion from the scope of this Regulation of payment

transactions from the payer to the payee through a commercial agent referred to in

paragraph 3, point (c), of this Article.

8543/1/26 REV 1 156

EN

9. EBA shall develop draft regulatory technical standards to specify the conditions for the

exclusion from the scope of this Regulation of the services based on specific payment

instruments referred to in paragraph 3, point (k), of this Article. When developing those

draft regulatory technical standards, EBA shall take into account the experience acquired

in the application of its guidelines of 24 February 2022 regarding the exclusion of limited

networks from the scope of Directive (EU) 2015/2366.

EBA shall submit the draft regulatory technical standards referred to in the first

subparagraph to the Commission by … [12 months from the date of entry into force of this

Regulation].

Power is delegated to the Commission to adopt those regulatory technical standards in

accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

10. By … [21 months from the date of entry into force of this Regulation], Member States

shall notify to the Commission the provisions of the law which they adopt pursuant to

paragraph 7. They shall notify the Commission without undue delay of any subsequent

amendments thereto and of any provisions of the law which they adopt pursuant to

paragraph 7 at a later date.

8543/1/26 REV 1 157

EN

Article 3

Definitions

For the purposes of this Regulation, the following definitions apply:

(1) ‘payment service’ means any business activity set out in Annex I to Directive

(EU) 2026/…+;

(2) ‘payment service provider’ means a body referred to in Article 2(1) of this Regulation or a

natural or legal person benefiting from an exemption pursuant to Article 33 or referred to

in Article 35(1) or 36(1) of Directive (EU) 2026/…+;

(3) ‘payment service user’ means a natural or legal person making use of a payment service in

the capacity of payer, payee, or both;

(4) ‘consumer’ means a natural person who, in payment service contracts covered by this

Regulation, is acting for purposes other than that person’s trade, business or profession;

(5) ‘payer’ means a natural or legal person who holds a payment account and places or allows

a payment order from that payment account, or, where there is no payment account, a

natural or legal person who places a payment order;

(6) ‘payee’ means a natural or legal person who is the intended recipient of funds which are

the subject of a payment transaction;

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 158

EN

(7) ‘funds’ means central bank money issued for retail use, scriptural money and electronic

money, including electronic money tokens;

(8) ‘payment transaction’ means an act of placing, transferring or withdrawing funds, based on

a payment order placed by the payer, or on the payer’s behalf, or by the payee, or on the

payee’s behalf, irrespective of any underlying obligations between the payer and the payee;

(9) ‘initiation of a payment transaction’ means the steps necessary to prepare the execution of

a payment transaction, including the placement of a payment order and the completion of

the authentication process;

(10) ‘execution of a payment transaction’ means the process starting once the initiation of a

payment transaction is completed and ending once the funds placed, withdrawn, or

transferred are available to the payee;

(11) ‘payment order’ means an instruction by a payer or payee to its payment service provider

requesting the execution of a payment transaction;

(12) ‘remote placement of a payment order’ means a placement of a payment order via the

internet;

(13) ‘payment institution’ means a legal person that has been granted authorisation in

accordance with Article 13 of Directive (EU) 2026/…+ to provide payment services

throughout the Union;

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 159

EN

(14) ‘applicant payment institution’ means an undertaking which has applied for authorisation

in accordance with Article 3 of Directive (EU) 2026/…+ and in respect of which the

decision is pending;

(15) ‘home Member State’ means either of the following:

(a) the Member State in which the payment service provider has its registered office; or

(b) if the payment service provider has, under its national law, no registered office, the

Member State in which the payment service provider has its head office;

(16) ‘host Member State’ means the Member State other than the home Member State in which

a payment service provider has an agent or a branch or provides payment services;

(17) ‘agent’ means a natural or legal person who acts in the name and on behalf of a payment

institution in providing payment services and either enters into possession of funds on

behalf of the payment institution or is directly involved in the payment institution’s

provision of payment services;

(18) ‘branch’ means a place of business other than the head office which is a part of a payment

service provider, which has no legal personality and which carries out directly some or all

of the transactions inherent in the business of a payment service provider; all of the places

of business set up in the same Member State by a payment service provider with a head

office in another Member State shall be regarded as a single branch;

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 160

EN

(19) ‘group’ means a group of undertakings that are linked to each other by a relationship as

referred to in Article 22(1), (2) or (7) of Directive 2013/34/EU of the European Parliament

and of the Council42, or undertakings as referred to in Articles 4, 5, 6 and 7 of Commission

Delegated Regulation (EU) No 241/201443, which are linked to each other by a relationship

as referred to in Article 10(1) or Article 113(6), first subparagraph, or Article 113(7), first

subparagraph, of Regulation (EU) No 575/2013;

(20) ‘payment system’ means a funds transfer system with formal and standardised

arrangements and common rules for the processing, clearing or settlement of payment

transactions;

(21) ‘payment system operator’ means the legal entity legally responsible for operating a

payment system;

(22) ‘technical service provider’ means a provider of services which, although not being

payment services, support the provision of payment services, without entering at any time

into possession of the funds to be transferred;

42 Directive 2013/34/EU of the European Parliament and of the Council of 26 June 2013 on the

annual financial statements, consolidated financial statements and related reports of certain

types of undertakings, amending Directive 2006/43/EC of the European Parliament and of

the Council and repealing Council Directives 78/660/EEC and 83/349/EEC (OJ L 182,

29.6.2013, p. 19, ELI: http://data.europa.eu/eli/dir/2013/34/oj). 43 Commission Delegated Regulation (EU) No 241/2014 of 7 January 2014 supplementing

Regulation (EU) No 575/2013 of the European Parliament and of the Council with regard to

regulatory technical standards for own funds and eligible liabilities requirements for

institutions (OJ L 74, 14.3.2014, p. 8, ELI: http://data.europa.eu/eli/reg_del/2014/241/oj).

8543/1/26 REV 1 161

EN

(23) ‘provider of electronic communications services’ means a provider of electronic

communications services as defined in Article 2, point (4), of Directive (EU) 2018/1972;

(24) ‘provider of interpersonal communications services’ means a provider of interpersonal

communications services as defined in Article 2, point (5), of Directive (EU) 2018/1972;

(25) ‘provider of hosting services’ means a provider of hosting services within the meaning of

Article 3, point (g)(iii), of Regulation (EU) 2022/2065;

(26) ‘provider of very large online platforms and of very large online search engines’ means a

provider of very large online platforms and of very large online search engines within the

meaning of Article 33 of Regulation (EU) 2022/2065;

(27) ‘crypto-asset service provider’ means a crypto-asset service provider as defined in

Article 3(1), point (15), of Regulation (EU) 2023/1114;

(28) ‘crypto-asset service’ means a crypto-asset service as defined in Article 3(1), point (16), of

Regulation (EU) 2023/1114;

(29) ‘electronic money token’ means an electronic money token as defined in Article 3(1),

point (7), of Regulation (EU) 2023/1114;

(30) ‘electronic money’ means electronically, including magnetically, stored monetary value

which is issued on receipt of funds for the purpose of making payment transactions and

which is accepted by natural or legal persons other than the issuer;

8543/1/26 REV 1 162

EN

(31) ‘digital content’ means goods or services which are produced and supplied in digital form,

the use or consumption of which is restricted to a technical device and which do not

include in any way the use or consumption of physical goods or services;

(32) ‘microenterprise’ means an enterprise which at the time of conclusion of the payment

service contract is an enterprise as defined in Article 1 and Article 2(1) and (3) of the

Annex to Recommendation 2003/361/EC;

(33) ‘framework contract’ means a payment service contract which governs the future

execution of individual and successive payment transactions and which may contain the

obligation and conditions for setting up a payment account;

(34) ‘means of distance communication’ means a method which, without the simultaneous

physical presence of the payment service provider and the payment service user, may be

used for the conclusion of a payment services contract;

(35) ‘payment account’ means an account held by a payment service provider in the name of

one or more payment service users which can be used for the execution of one or more

payment transactions and allows for sending and receiving funds to and from third parties;

(36) ‘mandate’ means the expression of authorisation given by the payer to the payee and,

directly or indirectly via the payee, to the payer’s payment service provider allowing the

payee to initiate a payment transaction for debiting the payer’s specified payment account

and to allow the payer’s payment service provider to comply with such instructions;

8543/1/26 REV 1 163

EN

(37) ‘account servicing payment service provider’ means a payment service provider providing

and maintaining a payment account for a payment service user;

(38) ‘ATM deployer’ means a natural or legal person providing cash withdrawal services as

referred to in Annex I, point 1, of Directive (EU) 2026/…+ and which is not an account

servicing payment service provider and does not provide any other payment services

referred to in Annex I to that Directive;

(39) ‘durable medium’ means any instrument which enables the payment service user to store

information addressed personally to that payment service user in a way accessible for

future reference for a period of time adequate to the purposes of the information and which

allows the unchanged reproduction of the information stored;

(40) ‘commercial trade name’ means the name which is commonly used by the payee in the

trade and marketing of its business to identify itself to the payer;

(41) ‘money remittance’ means a payment service where funds are received from a payer,

without any payment accounts being created in the name of the payer or the payee, for the

sole purpose of transferring a corresponding amount to a payee or to another payment

service provider acting on behalf of the payee, or where such funds are received on behalf

of and made available to the payee;

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 164

EN

(42) ‘payment instrument’ means an individualised device or devices or set of procedures

agreed between the payment service user and the payment service provider which enables

the initiation of a payment transaction;

(43) ‘payment initiation service’ means a service to place a payment order at the request of the

payment service user with respect to a payment account held at another payment service

provider;

(44) ‘account information service’ means an online service where a provider accesses one or

several payment accounts that are accessible online and held by a payment service user

with one or several account servicing payment service providers, in order to provide a

service of aggregation or consolidation of payment account data to the payment service

user or to transmit the data to another entity that will provide that service to the payment

service user;

(45) ‘payment initiation service provider’ means a payment service provider providing payment

initiation services;

(46) ‘account information service provider’ means a payment service provider providing

account information services;

(47) ‘payment card scheme’ means a payment card scheme as defined in Article 2, point (16),

of Regulation (EU) 2015/751;

8543/1/26 REV 1 165

EN

(48) ‘processing’, in the context of payment transactions, means processing as defined in

Article 2, point (27), of Regulation (EU) 2015/751;

(49) ‘processing entity’ means a processing entity as defined in Article 2, point (28), of

Regulation (EU) 2015/751;

(50) ‘acquiring of payment transactions’ means a payment service provided by a payment

service provider contracting with a payee to accept and process payment transactions,

which results in a transfer of funds to the payee;

(51) ‘issuing of payment instruments’ means a payment service provided by a payment service

provider contracting to provide a payer with a payment instrument to initiate and process

the payer’s payment transactions;

(52) ‘direct debit’ means a payment service for debiting a payer’s payment account, where a

payment transaction is initiated by the payee on the basis of a mandate given by the payer

to the payee, to the payee’s payment service provider or to the payer’s own payment

service provider;

(53) ‘credit transfer’ means a payment service for crediting a payee’s payment account with a

payment transaction or a series of payment transactions from a payer’s payment account by

the payment service provider which holds the payer’s payment account, based on an

instruction given by the payer;

8543/1/26 REV 1 166

EN

(54) ‘instant credit transfer’ means a credit transfer which is executed immediately, 24 hours a

day and on any calendar day;

(55) ‘value date’ means a reference time used by a payment service provider for the calculation

of interest on the funds debited from or credited to a payment account;

(56) ‘reference exchange rate’ means the exchange rate which is used as the basis to calculate

any currency conversion cost and which is disclosed by the payment service provider or

comes from a publicly available source;

(57) ‘reference interest rate’ means the interest rate which is used as the basis for calculating

any interest to be applied and which comes from a publicly available source which can be

verified by both parties to a payment service contract;

(58) ‘aggregated mid-market exchange rate’ means a rate that represents the mid-point between

the buy and sell prices of a currency pair in the foreign exchange market and that is

calculated by combining data from multiple sources to provide an accurate and real-time

reflection of market conditions;

(59) ‘authentication’ means a procedure which allows the payment service provider to verify

the identity of a payment service user or the validity of the use of a specific payment

instrument, including the use of the user’s personalised security credentials;

8543/1/26 REV 1 167

EN

(60) ‘strong customer authentication’ means an authentication which is based on the use of two

or more elements categorised as knowledge (something only the user knows), possession

(something only the user possesses) and inherence (something the user is) that are

independent in that the breach of one does not compromise the reliability of the others, and

is designed in such a way as to protect the confidentiality of the authentication data;

(61) ‘personalised security credentials’ means personalised features provided by the payment

service provider to a payment service user for the purposes of authentication;

(62) ‘sensitive payment data’ means data which can be used to carry out fraud, including

personalised security credentials;

(63) ‘unique identifier’ means a combination of letters, numbers or symbols specified by the

payment service provider to the payment service user and to be provided by the payment

service user to identify unambiguously another payment service user or the payment

account of that other payment service user for a payment transaction;

(64) ‘business day’ means a day on which the payment service provider of the payer or of the

payee involved in the execution of a payment transaction is open for business to execute a

payment transaction other than instant credit transfers;

(65) ‘self-hosted address’ means a self-hosted address as defined in Article 3, point (20), of

Regulation (EU) 2023/1113;

8543/1/26 REV 1 168

EN

(66) ‘custodial wallet’ means a crypto-asset wallet address where a crypto-asset service

provider ensures the safekeeping or controlling, on behalf of its client, of crypto-assets or

of the means of access to such crypto-assets, where applicable in the form of private

cryptographic keys;

(67) ‘merchant-initiated transaction’ means a payment transaction where the payer has given a

mandate authorising the payee to place a payment order for a payment transaction or a

series of payment transactions through a particular payment instrument that is issued in

order to be used by the payer to place payment orders for the payment transactions, where

that mandate is based on an agreement between the payer and the payee for the provision

of products or services, and where those transactions do not need to be preceded by a

specific action of the payer to trigger their initiation by the payee;

(68) ‘mail order or telephone order transaction’ means a payment transaction for which

payment orders are placed by the payer using means other than the use of electronic

platforms or devices, such as paper-based payment orders, mail orders or telephone orders,

irrespective of whether or not the execution of the transaction is performed electronically;

(69) ‘periodic penalty payments’ means periodic pecuniary enforcement measures aimed at

ending ongoing infringements of this Regulation or of any decision issued by a competent

authority pursuant to this Regulation and compelling a natural or legal person to return to

compliance with the infringed provisions or decision.

8543/1/26 REV 1 169

EN

TITLE II

TRANSPARENCY OF CONDITIONS AND

INFORMATION REQUIREMENTS FOR PAYMENT SERVICES

Chapter 1

General rules

Article 4

Scope

1. This Title applies to single payment transactions and framework contracts and to payment

transactions covered by those contracts. Parties to such single payment transactions and

framework contracts and to payment transactions covered by those contracts may agree

that this Title does not apply in whole or in part where the payment service user is not a

consumer.

2. Member States may apply this Title to microenterprises in the same way as it applies to

consumers.

8543/1/26 REV 1 170

EN

3. By … [21 months from the date of entry into force of this Regulation], Member States

shall notify to the Commission the provisions of the law they adopt pursuant to

paragraph 2. They shall notify the Commission without undue delay of any subsequent

amendments thereto and of any provisions of the law which they adopt pursuant to

paragraph 2 at a later date.

Article 5

Currency and currency conversion

1. Payment transactions shall be made in the currency agreed between the parties.

2. Where a currency conversion service is offered prior to the initiation of the payment

transaction and where that currency conversion service is offered at an ATM, at the point

of sale or by the payee, the party offering the currency conversion service to the payer shall

disclose to the payer all charges and the exchange rate to be used for converting the

payment transaction.

3. For the purposes of paragraph 2 of this Article, and of Article 7, Article 13(1), point (f),

and Article 20(3), point (e), the aggregated mid-market exchange rate used shall accurately

reflect the market, with a maximum delay of 10 minutes or, for currencies where that is not

possible, it shall reflect the last traded price from a reputable trading venue. It shall be

provided by a trusted administrator who complies with the IOSCO Principles for Financial

Benchmarks.

8543/1/26 REV 1 171

EN

4. The payer shall be given the opportunity to agree to the currency conversion service on the

basis of information provided in accordance with paragraph 2.

Article 6

Information on additional charges or reductions

1. Where, for the use of a given payment instrument, the payee requests a charge or offers a

reduction, the payee shall inform the payer thereof prior to the initiation of the payment

transaction, in a clear, neutral and comprehensible manner.

2. Where, for the use of a given payment instrument, the payment service provider or another

party involved in the transaction requests a charge, it shall inform the payment service user

thereof in a clear, neutral and comprehensible manner prior to the initiation of the payment

transaction.

3. The payer shall only be obliged to pay for the charges referred to in paragraphs 1 and 2 if

their full amount was made known prior to the initiation of the payment transaction.

8543/1/26 REV 1 172

EN

Article 7

Information requirements applicable to cash withdrawal services

Natural or legal persons providing cash withdrawal services, including those referred to in

Article 36 of Directive (EU) 2026/…+, shall display to their customers at the ATM information on

any charges for the withdrawal payable by the customer, including, if applicable, conversion

charges in accordance with Article 5(2) of this Regulation. The information shall be displayed in a

clear, neutral and comprehensible manner prior to the initiation of the payment transaction. Upon

the request of the customer, the information on any charges shall also be made available on a

durable medium when the transaction is completed.

Article 8

Charges for information

1. Payment service providers shall not charge payment service users for providing

information under this Title.

2. Payment service providers and payment service users may agree on charges for additional

or more frequent information, or transmission by means of communication other than those

specified in the framework contract, provided at the payment service user’s request.

3. Charges for information referred to in paragraph 2 shall be reasonable and in line with the

payment service provider’s actual costs.

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 173

EN

Article 9

Burden of proof on information requirements

The burden of proving that they have complied with the information requirements set out in this

Title shall lie with payment service providers.

Article 10

Derogation from information requirements for low-value payment instruments

and electronic money

1. In the case of payment instruments which, according to the relevant framework contract,

concern only individual payment transactions that do not exceed EUR 50 or that either

have a spending limit that does not exceed EUR 300 or store funds that do not exceed

EUR 300 at any time:

(a) by way of derogation from Articles 19, 20 and 24, the payment service provider shall

provide the payer only with information on the main characteristics of the payment

service, including the way in which the payment instrument can be used, liability,

charges levied and other material information needed for the payer to take an

informed decision as well as an indication of where any other information and

conditions specified in Article 20 are made available in an easily accessible manner;

8543/1/26 REV 1 174

EN

(b) it may be agreed by the parties to the framework contract that, by way of derogation

from Article 22, the payment service provider is not required to propose changes to

the conditions of the framework contract in the same way as provided for in

Article 19(1);

(c) it may be agreed by the parties to the framework contract that, by way of derogation

from Articles 25 and 26, after the execution of a payment transaction:

(i) the payment service provider provides or makes available only a reference

enabling the payment service user to identify the payment transaction, the

amount of the payment transaction, any charges or, in the case of several

payment transactions of the same kind made to the same payee, information on

the total amount and charges for those payment transactions;

(ii) the payment service provider is not required to provide or make available

information referred to in point (i) if the payment instrument is used

anonymously or if the payment service provider is not otherwise technically in

a position to provide it; in such cases, the payment service provider shall

provide the payer with an opportunity to verify the amount of funds stored.

2. In the case of prepaid payment instruments, the spending and storing limits referred to in

paragraph 1 shall not exceed EUR 500.

8543/1/26 REV 1 175

EN

Chapter 2

Single payment transactions

Article 11

Scope

1. This Chapter applies to single payment transactions not covered by a framework contract.

2. Where a payment order for a single payment transaction is transmitted by a payment

instrument covered by a framework contract, the payment service provider shall not be

obliged to provide or make available information which is already given to the payment

service user on the basis of a framework contract with another payment service provider or

which will be given to the payment service user according to that framework contract.

8543/1/26 REV 1 176

EN

Article 12

Prior general information

1. Before the payment service user is bound by a single payment service contract or offer, the

payment service provider shall make available to the payment service user, in an easily

accessible manner, the information and conditions set out in Article 13 with regard to its

own services. At the payment service user’s request, the payment service provider shall

provide the information and conditions on paper or on another durable medium. The

information and conditions shall be given in easily understandable words and in a clear,

neutral and comprehensible manner, in an official language of the Member State where the

payment service is offered or in any other language agreed between the parties.

2. If the single payment service contract has been concluded at the request of the payment

service user using a means of distance communication which does not enable the payment

service provider to comply with paragraph 1, the payment service provider shall fulfil its

obligations under that paragraph immediately after the execution of the payment

transaction.

3. Payment service providers may comply with their obligations under paragraph 1 by

providing to payment service users a copy of the draft single payment service contract or

the draft payment order including the information and conditions set out in Article 13.

8543/1/26 REV 1 177

EN

Article 13

Information and conditions

1. Payment service providers shall provide or make available to payment service users the

following information and conditions:

(a) a specification of the information or unique identifier to be provided by the payment

service user in order for a payment order to be properly placed or executed;

(b) the maximum execution time for the payment service to be provided;

(c) where the payee’s payment service provider is located outside the Union, the

estimated time for the funds of credit transfers and money remittance transactions to

be received by that payment service provider;

(d) all charges payable by the payment service user to the payment service provider and,

where applicable, a breakdown of those charges;

(e) where applicable, the actual or reference exchange rate to be applied to the payment

transaction;

(f) where applicable, the estimated charges for currency conversion in relation to credit

transfers and money remittance transactions, expressed as a monetary amount in the

currency of the payer’s account and as a percentage mark-up over an aggregated

mid-market exchange rate as referred to in Article 5(3);

8543/1/26 REV 1 178

EN

(g) the alternative dispute resolution (ADR) procedures available to the payment service

user in accordance with Articles 100, 104 and 105.

The information referred to in the first subparagraph, point (f), shall be disclosed to the

payer prior to the initiation of the payment transaction.

2. Payment initiation service providers shall, prior to initiation of the payment transaction,

provide the payer with, or make available to the payer clear and comprehensive

information on the following:

(a) the name of the payment initiation service provider, the geographical address of its

head office and, where applicable, the geographical address of its agent or branch

established in the Member State where the payment service is offered, and any other

contact details, including electronic mail address, relevant for communication with

the payment initiation service provider; and

(b) the contact details of the competent authority designated under this Regulation.

3. Where applicable, any other relevant information and conditions set out in Article 20 shall

be made available to the payment service user in an easily accessible manner.

8543/1/26 REV 1 179

EN

Article 14

Information for the payer and payee after the placement of a payment order

Where a payment order is placed through a payment initiation service provider, the payment

initiation service provider shall, immediately after initiation, provide or make available to the payer

and, where applicable, to the payee all of the following data:

(a) confirmation of the successful placement of the payment order with the payer’s account

servicing payment service provider;

(b) a reference enabling the payer and the payee to identify the payment transaction and,

where appropriate, the payee to identify the payer, and any information transferred with the

payment transaction;

(c) the amount of the payment transaction;

(d) where applicable, the amount of any charges payable to the payment initiation service

provider for the transaction, and where applicable a breakdown of the amounts of such

charges.

8543/1/26 REV 1 180

EN

Article 15

Information for the payer’s account servicing payment service provider

where a payment order is placed through a payment initiation service

Where a payment order is placed through a payment initiation service provider, the payment

initiation service provider shall make available to the payer’s account servicing payment service

provider the reference of the payment transaction.

Article 16

Information for the payer after receipt of the payment order

Immediately after receipt of the payment order, the payer’s payment service provider shall provide

the payer with or make available to the payer, in the same way as provided for in Article 12(1), all

of the following data with regard to its own services:

(a) a reference enabling the payer to identify the payment transaction and the information

needed for the payer to unambiguously identify the payee, including the payee’s

commercial trade name and, where available to the payment service provider and if

different from the commercial trade name, the payee’s legal name;

(b) the amount of the payment transaction in the currency used in the payment order;

8543/1/26 REV 1 181

EN

(c) the amount of any charges for the payment transaction payable by the payer and, where

applicable, a breakdown of the amounts of such charges;

(d) where applicable, the exchange rate used in the payment transaction by the payer’s

payment service provider or a reference thereto, where different from the rate provided in

accordance with Article 13(1), point (e), and the amount of the payment transaction after

that currency conversion;

(e) the date of receipt of the payment order.

Article 17

Information for the payee after execution

Immediately after the execution of the payment transaction, the payee’s payment service provider

shall provide the payee with, or make available to the payee, in the same way as provided for in

Article 12(1), all of the following data with regard to its own services:

(a) a reference enabling the payee to identify the payment transaction and, where appropriate,

the payer and any information transferred with the payment transaction;

(b) the amount of the payment transaction in the currency in which the funds are at the payee’s

disposal;

(c) the amount of any charges for the payment transaction payable by the payee and, where

applicable, a breakdown of the amounts of such charges;

8543/1/26 REV 1 182

EN

(d) where applicable, the exchange rate used in the payment transaction by the payee’s

payment service provider, and the amount of the payment transaction before that currency

conversion;

(e) the credit value date.

Chapter 3

Framework contracts

Article 18

Scope

This Chapter applies to payment transactions covered by a framework contract.

Article 19

Prior general information

1. In good time before the payment service user is bound by any framework contract or offer,

the payment service provider shall provide the payment service user on paper or on another

durable medium with the information and conditions set out in Article 20. The information

and conditions shall be given in easily understandable words and in a clear, neutral and

comprehensible manner, in an official language of the Member State where the payment

service is offered or in any other language agreed between the parties.

8543/1/26 REV 1 183

EN

2. Where the framework contract has been concluded at the request of the payment service

user using a means of distance communication which does not enable the payment service

provider to comply with paragraph 1, the payment service provider shall fulfil its

obligations under that paragraph immediately after conclusion of the framework contract.

3. Payment service providers may comply with their obligations under paragraph 1 by

providing to payment service users a copy of the draft framework contract including the

information and conditions set out in Article 20.

Article 20

Information and conditions

1. The payment service provider shall provide the payment service user with the following

information and conditions in relation to the payment service provider:

(a) the name of the payment service provider, the geographical address of its head office

and, where applicable, the geographical address of its agent or branch established in

the Member State where the payment service is offered, and any other address,

including electronic mail address, relevant for communication with the payment

service provider;

8543/1/26 REV 1 184

EN

(b) the particulars of the relevant supervisory authorities designated under Directive

(EU) 2026/…+ and of the registers provided for in Articles 17 and 18 of that

Directive or of any other relevant public register of authorisation of the payment

service provider and the registration number or equivalent means of identification in

that register.

2. The payment service provider shall provide the payment service user with the following

information and conditions in relation to the use of the payment service:

(a) a description of the main characteristics of the payment service to be provided;

(b) a specification of the information or unique identifier that has to be provided by the

payment service user in order for a payment order to be properly placed or executed;

(c) the form of and procedure for placing a payment order or giving consent to execute a

payment transaction and withdrawal of such consent in accordance with Articles 50

and 69;

(d) a reference to the time of receipt of a payment order in accordance with Article 67

and the cut-off time, if any, established by the payment service provider;

(e) the maximum execution time for the payment services to be provided;

(f) the estimated time for the funds of credit transfers to be received by the payee’s

payment service provider located outside the Union;

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 185

EN

(g) the setting of spending limits for the use of payment instruments and means of

payment by the payment service user in accordance with Article 52(1), with

information on the length of a delay for any resulting increase in spending limits to

come into effect and on how the payment service user can modify those spending

limits and adjust or opt out of that delay period;

(h) in the case of co-badged card-based payment instruments, the payment service user’s

rights under Article 8 of Regulation (EU) 2015/751.

3. The payment service provider shall provide the payment service user with the following

information and conditions in relation to charges, interest and exchange rates:

(a) all charges payable by the payment service user to the payment service provider

including those connected to the manner in and frequency with which information

under this Regulation is provided or made available and, where applicable, the

breakdown of the amounts of such charges;

(b) all charges, if any, for domestic ATM withdrawals payable by payment service users

to their payment service provider at an ATM of:

(i) their payment service provider;

(ii) a payment service provider belonging to the same network of ATMs as the

user’s payment service provider;

8543/1/26 REV 1 186

EN

(iii) a payment service provider belonging to a network of ATMs with which the

user’s payment service provider has a contractual relationship;

(iv) an ATM deployer;

(c) where applicable, the interest and exchange rates to be applied or, if reference

interest rate and reference exchange rate are to be used, the method of calculating the

actual interest, and the relevant date and index or base for determining such reference

interest rate or reference exchange rate;

(d) where agreed, the immediate application of changes in the reference interest rate or

reference exchange rate and information requirements relating to those changes in

accordance with Article 22(3);

(e) where applicable, the estimated charges for currency conversion services in relation

to a credit transfer, expressed as a monetary amount in the currency of the payer’s

account and as a percentage mark-up over an aggregated mid-market exchange rate

as referred to in Article 5(3).

The information referred to in the first subparagraph, point (e), shall be disclosed to the

payer prior to the initiation of each payment transaction.

8543/1/26 REV 1 187

EN

4. The payment service provider shall provide the payment service user with the following

information and conditions in relation to communication:

(a) where applicable, the means of communication, including the technical requirements

for the payment service user’s equipment and software, agreed between the parties

for the transmission of information or notifications under this Regulation;

(b) the manner in, and frequency with which, information under this Regulation is to be

provided or made available;

(c) the language or languages in which the framework contract will be concluded and

communication during that contractual relationship undertaken;

(d) the payment service user’s right to receive the contractual terms of the framework

contract and information and conditions in accordance with Article 21.

5. The payment service provider shall provide the payment service user with the following

information and conditions in relation to safeguards and corrective measures:

(a) where applicable, a description of the steps that the payment service user is to take in

order to keep safe a payment instrument and how to notify the payment service

provider for the purposes of Article 53, first paragraph, point (b);

(b) the secure procedure for notification of the payment service user by the payment

service provider in the event of suspected or actual fraud or security threats;

8543/1/26 REV 1 188

EN

(c) the conditions under which the payment service provider reserves the right to block a

payment instrument in accordance with Article 52;

(d) the liability of the payer in accordance with Article 60(4) and Article 63, including

information on the relevant amount;

(e) how and within what period of time the payment service user is to notify the payment

service provider of any unauthorised or incorrectly initiated or executed payment

transaction, in accordance with Article 55, and also the police in the case of

impersonation fraud referred to in Article 60;

(f) the payment service provider’s liability for unauthorised payment transactions in

accordance with Article 57, for the incorrect application of the name and unique

identifier matching verification service in accordance with Article 58, and for

impersonation fraud in accordance with Article 60;

(g) the liability of the payment service provider for the initiation or execution of

payment transactions in accordance with Articles 79 and 80;

(h) the conditions for refund in accordance with Articles 65 and 66.

8543/1/26 REV 1 189

EN

6. The payment service provider shall provide the payment service user with the following

information and conditions in relation to changes to, and termination of, the framework

contract:

(a) where agreed, information that the payment service user will be deemed to have

accepted changes in the conditions in accordance with Article 22, unless the payment

service user notifies the payment service provider before the date of their proposed

date of entry into force that they are not accepted;

(b) the duration of the framework contract;

(c) the right of the payment service user to terminate the framework contract and any

agreements relating to termination in accordance with Article 22(1) and Article 23.

7. The payment service provider shall provide the payment service user with the following

information and conditions in relation to redress:

(a) any contractual clause on the law applicable to the framework contract or the

competent courts;

(b) the ADR procedures available to the payment service user in accordance with

Articles 100, 104 and 105.

8543/1/26 REV 1 190

EN

Article 21

Accessibility of information and conditions of the framework contract

At any time during the contractual relationship the payment service user shall have a right to

receive, on request, the contractual terms of the framework contract and the information and

conditions set out in Article 20 on paper or on another durable medium.

Article 22

Changes to the framework contract

1. The payment service provider shall propose any changes to the framework contract,

including to the information and conditions set out in Article 20, in the same way as

provided for in Article 19(1) and no later than two months before their proposed date of

entry into force. The payment service user may either accept or reject the changes before

their proposed date of entry into force.

2. Where applicable, in accordance with Article 20(6), point (a), the payment service provider

shall inform the payment service user that the payment service user is to be deemed to have

accepted those changes if the payment service user does not notify the payment service

provider before their proposed date of entry into force that they are not accepted. The

payment service provider shall also inform the payment service user that, if the payment

service user rejects those changes, the payment service user has the right to terminate the

framework contract free of charge and with effect at any time before the date on which

those changes would have applied.

8543/1/26 REV 1 191

EN

3. Changes in the interest or exchange rates may be applied by the payment service provider

immediately and without notice, provided that such a right is agreed upon in the

framework contract and that the changes in the interest or exchange rates are based on the

reference interest rate or reference exchange rate agreed on in accordance with

Article 20(3), points (c) and (d). The payment service provider shall inform the payment

service user of any change in the interest rate at the earliest opportunity in the same way as

provided for in Article 19(1), unless the parties have agreed on a specific frequency or

manner in which the information is to be provided or made available. However, changes in

interest or exchange rates which are more favourable to the payment service users, may be

applied by the payment service provider without notice.

4. The payment service provider shall implement and calculate changes in the interest or

exchange rates used in payment transactions in a neutral manner that does not discriminate

against payment service users.

Article 23

Termination

1. The payment service user may terminate the framework contract at any time, unless the

parties have agreed on a period of notice. Such a period shall not exceed one month.

8543/1/26 REV 1 192

EN

2. Termination of the framework contract shall be free of charge for the payment service user

except where the contract has been in force for less than three months. Charges, if any, for

termination of the framework contract shall be appropriate and in line with costs. Where,

under the framework contract, payment services are offered jointly with technical services

that support the provision of payment services and are provided by the payment service

provider or by a third party that the payment service provider has partnered with, such

technical services shall be subject to the same framework contract requirements on

termination fees.

3. If agreed in the framework contract, the payment service provider may terminate a

framework contract concluded for an indefinite period by giving at least three months’

notice in the same way as provided for in Article 19(1).

4. Charges for payment services levied on a regular basis shall be payable by the payment

service user only proportionally up to the termination of the contract. If such charges are

paid in advance, those charges shall be reimbursed proportionally by the payment service

provider.

5. The provisions of this Article are without prejudice to the Member States’ laws and

regulations governing the rights of the parties to declare the framework contract

unenforceable or void.

8543/1/26 REV 1 193

EN

6. Member States may provide for more favourable provisions on termination for payment

service users.

7. By … [21 months from the date of entry into force of this Regulation], Member States

shall notify to the Commission the provisions of the law they adopt pursuant to

paragraph 6. They shall notify the Commission without undue delay of any subsequent

amendments thereto and of any provisions of the law which they adopt pursuant to

paragraph 6 at a later date.

Article 24

Information before execution of individual payment transactions

In the case of an individual payment transaction initiated by the payer under a framework contract,

a payment service provider shall, at the payer’s request for this specific payment transaction,

provide, prior to the initiation of the payment transaction, explicit information on the following:

(a) the maximum execution time;

(b) the charges payable by the payer; and

(c) where applicable, a breakdown of the amounts of any charges.

8543/1/26 REV 1 194

EN

Article 25

Information for the payer on individual payment transactions

1. After the amount of an individual payment transaction is debited from the payer’s account

or, where the payer does not use a payment account, after receipt of the payment order, the

payer’s payment service provider shall provide the payer, without undue delay and in the

same way as provided for in Article 19(1), with the following information:

(a) a reference enabling the payer to identify each payment transaction and the

information needed to unambiguously identify the payee, including the payee’s

commercial trade name and, where available to the payment service provider and if

different from the commercial trade name, the payee’s legal name;

(b) the amount of the payment transaction in the currency in which the payer’s payment

account is debited or in the currency used for the payment order;

(c) the amount of any charges for the payment transaction and, where applicable, a

breakdown of the amounts of such charges, or the interest payable by the payer;

(d) where applicable, the exchange rate used in the payment transaction by the payer’s

payment service provider, and the amount of the payment transaction after that

currency conversion;

(e) the debit value date or the date of receipt of the payment order.

8543/1/26 REV 1 195

EN

2. A framework contract shall include a condition that the payer may require the information

referred to in paragraph 1 to be provided or made available periodically, at a frequency to

be determined by the payer, free of charge and in an agreed manner which allows the payer

to store and reproduce that information unchanged. At a minimum, the payer shall be

entitled to require the provision or making available of that information on a monthly

basis.

3. Member States may require payment service providers to provide information on paper or

on another durable medium at least once a month, free of charge.

4. By … [21 months from the date of entry into force of this Regulation], Member States

shall notify to the Commission the provisions of the law they adopt pursuant to

paragraph 3. They shall notify the Commission without undue delay of any subsequent

amendments thereto and of any provisions of the law which they adopt pursuant to

paragraph 3 at a later date.

Article 26

Information for the payee on individual payment transactions

1. After the execution of an individual payment transaction, the payee’s payment service

provider shall provide the payee without undue delay in the same way as provided for in

Article 19(1) with the following information:

(a) a reference enabling the payee to identify the payment transaction and the payer, and

any information transferred with the payment transaction;

8543/1/26 REV 1 196

EN

(b) the amount of the payment transaction in the currency in which the payee’s payment

account is credited;

(c) the amount of any charges for the payment transaction and, where applicable, a

breakdown of the amounts of such charges, or the interest payable by the payee;

(d) where applicable, the exchange rate used in the payment transaction by the payee’s

payment service provider, and the amount of the payment transaction before that

currency conversion;

(e) the credit value date.

2. A framework contract may include a condition that the information referred to in

paragraph 1 is to be provided or made available periodically no less frequently than at least

once a month and in an agreed manner which allows the payee to store and reproduce that

information unchanged.

3. Member States may require payment service providers to provide information on paper or

on another durable medium at least once a month, free of charge.

4. By … [21 months from the date of entry into force of this Regulation], Member States

shall notify to the Commission the provisions of the law they adopt pursuant to

paragraph 3. They shall notify the Commission without undue delay of any subsequent

amendments thereto and of any provisions of the law which they adopt pursuant to

paragraph 3 at a later date.

8543/1/26 REV 1 197

EN

TITLE III

RIGHTS AND OBLIGATIONS

IN RELATION TO THE PROVISION

AND USE OF PAYMENT SERVICES

Chapter 1

Common provisions

Article 27

Scope

1. Where the payment service user is not a consumer, the payment service user and the

payment service provider may agree that Article 28(1), Article 50(7), and

Articles 56, 63, 65, 66, 69, 79 and 80 do not apply in whole or in part. The payment service

user and the payment service provider may also agree on time limits that are different from

those laid down in Article 55.

8543/1/26 REV 1 198

EN

2. Member States may provide that Article 105 does not apply where the payment service

user is not a consumer.

3. Member States may apply this Title to microenterprises in the same way as it applies to

consumers.

4. By … [21 months from the date of entry into force of this Regulation], Member States

shall notify to the Commission the provisions of the law they adopt pursuant to

paragraphs 2 and 3. They shall notify the Commission without undue delay of any

subsequent amendments thereto and of any provisions of the law which they adopt

pursuant to paragraphs 2 and 3 at a later date.

Article 28

Charges applicable

1. The payment service provider shall not charge the payment service user for fulfilment of

its information obligations or corrective and preventive measures under this Title, unless

otherwise specified in Article 68(3), Article 69(5) and Article 78(3). Those charges shall

be agreed between the payment service user and the payment service provider and shall be

reasonable and in line with the payment service provider’s actual costs.

8543/1/26 REV 1 199

EN

2. For payment transactions provided within the Union, where both the payer’s and the

payee’s payment service providers are, or the sole payment service provider in the payment

transaction is, located in the Union, the payee shall pay the charges levied by the payee’s

payment service provider, and the payer shall pay the charges levied by the payer’s

payment service provider.

3. The payee shall not request charges for the use of payment instruments for which

interchange fees are regulated under Chapter II of Regulation (EU) 2015/751 or for credit

transfers, including instant credit transfers, and direct debit transactions within the Union.

4. Member States may prohibit payees from, or limit the right of payees to, request charges

for the use of payment instruments other than those referred to in paragraph 3, taking into

account the need to encourage competition and promote the use of efficient payment

instruments.

5. The payment service provider shall not prevent the payee offering the payer a reduction or

otherwise steering the payer towards the use of a given payment instrument. Without

prejudice to paragraphs 3 and 4 and with regard to instruments not covered in those

paragraphs, the payment service provider shall not prevent the payee from requesting from

the payer a charge. Any charges applied shall not exceed the direct costs borne by the

payee for the use of the specific payment instrument.

8543/1/26 REV 1 200

EN

6. By … [21 months from the date of entry into force of this Regulation], Member States

shall notify to the Commission the provisions of the law they adopt pursuant to

paragraph 4. They shall notify the Commission without undue delay of any subsequent

amendments thereto and of any provisions of the law which they adopt pursuant to

paragraph 4 at a later date.

Article 29

Derogation for low value payment instruments and electronic money

1. In the case of payment instruments which, according to the framework contract, concern

only individual payment transactions that do not exceed EUR 50 or that either have a

spending limit that does not exceed EUR 300, or store funds that do not exceed EUR 300

at any time, payment service providers may agree with their payment service users that:

(a) Article 53, first paragraph, point (b), Article 54(1), first subparagraph, points (c)

and (d), and Article 63(5) do not apply if the payment instrument does not allow its

blocking or prevention of its further use;

(b) Articles 56 and 57, and Article 63(1) and (5) do not apply if the payment instrument

is used anonymously or the payment service provider is not in a position for other

reasons which are intrinsic to the payment instrument to prove that a payment

transaction was authorised;

8543/1/26 REV 1 201

EN

(c) by way of derogation from Article 68(1), the payment service provider is not

required to notify the payment service user of the refusal of a payment order, if the

non-execution is apparent from the context;

(d) by way of derogation from Article 69, the payer shall not revoke the payment order

after transmitting the payment order or authorising the payment transaction to the

payee;

(e) by way of derogation from Articles 73 and 74, other execution periods apply.

2. In the case of prepaid payment instruments, the spending and storing limits referred to in

paragraph 1 shall not exceed EUR 500.

3. Articles 57 and 63 shall apply to electronic money, except where the payer’s payment

service provider does not have the ability to freeze the payment account on which the

electronic money is stored or to block the payment instrument. Member States may limit

that derogation to payment accounts on which the electronic money is stored or to payment

instruments of a certain value.

4. By … [21 months from the date of entry into force of this Regulation], Member States

shall notify to the Commission the provisions of the law they adopt pursuant to

paragraph 3. They shall notify the Commission without undue delay of any subsequent

amendments thereto and of any provisions of the law which they adopt pursuant to

paragraph 3 at a later date.

8543/1/26 REV 1 202

EN

Article 30

Issuance and redeemability of electronic money

1. Issuers of electronic money shall issue electronic money at par value on receipt of funds.

2. Upon request by the holder of electronic money, the issuer of electronic money shall

redeem, at any moment and at par value, the monetary value of the electronic money held.

3. The contract between the issuer of electronic money and the holder of electronic money

shall clearly and prominently state the conditions of redemption, including any applicable

fees, and the holder of electronic money shall be informed of those conditions before being

bound by any contract or offer.

4. Redemption of electronic money may be subject to a fee only if stated in the contract in

accordance with paragraph 3 and only in any of the following cases:

(a) where the holder of electronic money requests redemption before the termination of

the contract;

(b) where the contract provides for a termination date and the holder of electronic money

terminates the contract before that date;

(c) where redemption is requested more than one year after the date of termination of the

contract.

Any such fee shall be proportionate to and commensurate with the actual costs incurred by

the issuer of electronic money.

8543/1/26 REV 1 203

EN

5. Where the holder of electronic money requests redemption of the electronic money before

the termination of the contract, that request may be for redemption in whole or in part.

6. Where a redemption of electronic money is requested by the holder of electronic money on

the date of the termination of the contract, or up to one year after such termination, the

issuer of electronic money shall do either of the following:

(a) redeem the total monetary value of the electronic money;

(b) redeem all funds requested by the holder of electronic money where the payment

institution carries out other business activities as referred to in Article 10(1),

point (c), of Directive (EU) 2026/…+ and it is unknown in advance what proportion

of the funds is to be used as electronic money by holders of electronic money.

7. Notwithstanding paragraphs 4, 5 and 6, the redemption rights of a person, other than a

consumer, who accepts electronic money shall be subject to the contractual agreement

between the issuer of electronic money and that person.

8. A payment institution that issues electronic money shall not grant to the holder of

electronic money interest or any other benefit related to the length of time during which

that holder holds the electronic money.

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 204

EN

Chapter 2

Access to payment systems and to accounts

maintained with credit institutions

Article 31

Access to payment systems

1. Payment system operators shall have in place objective, non-discriminatory, transparent

and proportionate rules on access to a payment system by authorised or registered payment

service providers that are legal persons. Payment system operators shall not inhibit access

to a payment system more than is necessary to safeguard against specific risks, including

where applicable settlement risk, operational risk, credit risk, liquidity risk and business

risk or more than is necessary to protect the financial and operational stability of the

payment system.

2. A payment system operator shall make publicly available the rules and procedures for

admission to participation in its payment system and the criteria and methodology it uses to

assess the risk for such participation.

8543/1/26 REV 1 205

EN

3. Upon receiving an application for participation by a payment service provider, a payment

system operator shall assess the relevant risks of granting the applicant payment service

provider access to the system. A payment system operator shall refuse participation to an

applicant payment service provider only where the applicant poses risks to the system, as

referred to in paragraph 1. The payment system operator shall notify that applicant

payment service provider in writing whether the request for participation is granted or

refused and shall duly justify any refusal.

4. Payment system operators shall not impose:

(a) restrictive rules on effective participation in other payment systems;

(b) rules which discriminate between authorised payment service providers or between

registered payment service providers in relation to the rights, obligations and

entitlements of members;

(c) restrictions based on institutional status.

5. Paragraphs 1 to 4 shall apply to operators of payment schemes. Those paragraphs shall not

apply to payment system operators or operators of payment schemes composed exclusively

of payment service providers belonging to the same group.

8543/1/26 REV 1 206

EN

6. A participant of a payment system that allows an authorised or registered payment service

provider that is not a participant of the payment system to pass transfer orders through that

payment system shall, when requested, give the same possibility to other authorised or

registered payment service providers in an objective, proportionate, transparent and

non-discriminatory manner. If such a request is refused, the participant of the payment

system shall provide any requesting payment service provider with the reasons for such

refusal.

7. Member States shall designate a competent authority to ensure compliance with

paragraphs 1 to 4 and paragraph 6, as applicable, by payment systems and payment

schemes governed by their national law, except for cases where those requirements are

enforced or implemented by the Eurosystem or central banks of Member States whose

currency is not the euro as part of the oversight of the operations of those payment systems

or schemes such as payment systems subject to Regulation (EU) 2025/1355.

8543/1/26 REV 1 207

EN

Article 32

Transparent practices of payment card schemes, processing entities

and providers of services of acquiring payment transactions

1. Operators of payment card schemes and processing entities shall ensure that the fees

imposed on payment service providers providing services of acquiring payment

transactions are categorised and disclosed in a clear and consistent manner allowing for the

comparability of billing categories between schemes and processing entities on the basis of

at least the following fee categories:

(a) interchange fees;

(b) processing fees; and

(c) scheme fees of which:

(i) mandatory fees;

(ii) fees linked to a specific behaviour or to the use or non-use of a technology; and

(iii) fees related to optional services.

Fee categories shall be clearly defined.

8543/1/26 REV 1 208

EN

The information referred to in the first subparagraph shall be disclosed to payment service

providers providing services of acquiring payment transactions in a manner that ensures

full clarity as to which fees correspond to which services.

The information referred to in the first subparagraph shall be as specific as possible and,

where possible, distinguish the fees applied according to the card category, the sales

channel, the transaction volume and value of the merchant and the geographical location.

2. Payment service providers providing services of acquiring payment transactions shall use

the information disclosed under paragraph 1 of this Article when fulfilling their obligations

under Articles 9 and 12 of Regulation (EU) 2015/751.

3. For the purposes of paragraph 1, operators of payment card schemes and processing

entities shall:

(a) no later than six months prior to their implementation communicate any new fees and

any change in scheme and processing fees unambiguously and in a transparent and

consistent manner to the payment service providers providing services of acquiring

payment transactions;

(b) maintain a single Union public repository of their scheme and processing rules and

fees, according to the fee categories referred to in paragraph 1.

8543/1/26 REV 1 209

EN

4. By … [15 months from the date of entry into force of this Regulation], the Commission

shall adopt a delegated act in accordance with Article 115 to supplement this Regulation by

further specifying the information to be disclosed to payment service providers providing

services of acquiring payment transactions under paragraph 1.

Article 33

Provision by credit institutions of payment accounts to payment institutions

1. Credit institutions shall provide access to payment accounts to payment institutions, their

agents and applicant payment institutions on an objective, non-discriminatory and

proportionate basis. Such access shall be sufficiently extensive to allow payment

institutions to provide payment services in an unhindered and efficient manner.

2. A credit institution may refuse to open or may close a payment account for a payment

institution, for its agents, or for an applicant payment institution, only where:

(a) opening or maintaining such a payment account would result in an infringement of

Regulation (EU) 2024/1624;

(b) there is or has been a material breach of contract committed by the payment

institution, or its agents, or by the applicant payment institution;

(c) relevant information or documents have not been received from the applicant for an

account;

8543/1/26 REV 1 210

EN

(d) the competent authority has refused to grant, or has withdrawn, an authorisation as a

payment institution.

3. Access granted to an agent under paragraph 1 shall be granted exclusively for the provision

of payment services on behalf of a payment institution.

4. Without undue delay and at the latest one month after receiving a complete application, a

credit institution shall notify the payment institution or its agents or the applicant payment

institution, as well as the competent authority, of any decision to refuse to open a payment

account for a payment institution or its agents or for an applicant payment institution. Such

decision shall provide duly justified reasons and specify the risks posed by the activity or

planned activity of that payment institution or of its agents or of that applicant payment

institution, as assessed by the credit institution, based upon the grounds referred to in

paragraph 2 and shall not be generic in nature.

The credit institution shall notify the payment institution or its agents or the applicant

payment institution, as well as the competent authority, of a decision to close the payment

account at least four months before closing it. Any decision to close a payment account

shall provide duly justified reasons, be specific and be based upon the grounds referred to

in paragraph 2 of this Article, and shall consider the payment institution’s ability to comply

with the safeguarding requirement set out in Article 9 of Directive (EU) 2026/…+.

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 211

EN

By way of derogation from the first and second subparagraphs of this paragraph, credit

institutions shall in the cases covered under paragraph 2, point (a):

(a) only notify the payment institution, its agents or the applicant payment institution

that opening or maintaining a payment account would result in an infringement of

Regulation (EU) 2024/1624 and not disclose any details of the nature of that

infringement;

(b) be entitled to close the payment account following a shorter notice period.

5. The competent authority may publish aggregate data on payment account refusals and

closures.

6. A payment institution or its agents, or an applicant payment institution which is the subject

of a decision by a credit institution to refuse to open, or to close, a payment account may

appeal to the competent authority.

7. EBA shall develop draft regulatory technical standards specifying the harmonised format

and information to be contained in the notification and decision referred to in paragraph 4

of this Article.

EBA shall submit the draft regulatory technical standards referred to in the first

subparagraph to the Commission by … [12 months from the date of entry into force of this

Regulation].

Power is delegated to the Commission to adopt those regulatory technical standards in

accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

8543/1/26 REV 1 212

EN

Chapter 3

Account information services and payment initiation services

SECTION 1

GENERAL PRINCIPLES

Article 34

Rights of payment service users

1. Payment service providers shall not prevent payment service users from making use of a

payment initiation service provider to obtain payment initiation services. That obligation

shall apply to all payment accounts held by the payment service user that are accessible

online.

2. Payment service providers shall not prevent payment service users from making use of

account information services. That obligation shall apply to all payment accounts held by

the payment service user that are accessible online.

8543/1/26 REV 1 213

EN

Article 35

Contractual relations

1. The provision of account information services and payment initiation services shall not be

made conditional by any party on the existence of a contractual relationship to that end

between providers of such services and an account servicing payment service provider.

2. Where a multilateral contractual arrangement is in place and where the same payment

account data as that regulated under this Regulation is also available in the framework of

that multilateral contractual arrangement, access by account information service providers

and payment initiation service providers to payment account data regulated under this

Regulation shall always be possible without the need for those providers to be part of such

multilateral contractual arrangement.

SECTION 2

DATA ACCESS INTERFACES FOR ACCOUNT INFORMATION SERVICES

AND PAYMENT INITIATION SERVICES

Article 36

Provision of dedicated access interfaces

1. Account servicing payment service providers that offer to a payer a payment account that

is accessible online shall have in place at least one dedicated interface for the purpose of

exchanging data with account information service providers and payment initiation service

providers.

8543/1/26 REV 1 214

EN

2. An account servicing payment service provider shall put in place the dedicated interface

referred to in paragraph 1 within three months of obtaining its authorisation. In order to

ensure that the dedicated interface can be used as soon as possible, the account servicing

payment service provider shall provide the relevant technical documentation of the

dedicated interface without undue delay, upon request by authorised payment initiation

service providers, by account information service providers or by undertakings that have

applied to their competent authorities for the relevant authorisation.

Account servicing payment service providers shall always permit access to the dedicated

interface referred to in paragraph 1 in order to allow business continuity for payment

initiation service providers and account information service providers.

8543/1/26 REV 1 215

EN

3. An account servicing payment service provider shall ensure that the dedicated interface

referred to in paragraph 1 uses standards of communication which are issued by European

or international standardisation organisations including the European Committee for

Standardization (CEN) or the International Organization for Standardization (ISO) or other

relevant, widely recognised standards offering equivalent security. An account servicing

payment service provider shall also ensure that the technical specifications of a dedicated

interface as referred to in paragraph 1 are documented, specifying the set of routines,

protocols and tools needed by payment initiation service providers and account

information service providers in order to enable the interoperability of their software and

applications with the systems of the account servicing payment service provider. Account

servicing payment service providers shall make the documentation on the technical

specifications of their dedicated interfaces referred to in paragraph 1 available, free of

charge and without undue delay, upon request by authorised payment initiation service

providers, account information service providers or by payment service providers that have

applied to their competent authorities for the relevant authorisation and shall make a

summary of that documentation publicly available on their website.

8543/1/26 REV 1 216

EN

4. An account servicing payment service provider shall ensure that, except where an

emergency situation prevents it from doing so, any change to the technical specifications of

the dedicated interface referred to in paragraph 1 is made available, as a minimum through

publication on its website, to authorised payment initiation service providers, account

information service providers, or relevant applicant payment institutions, in advance, as

soon as possible and not less than two months before that change is implemented. Account

servicing payment service providers shall document emergency situations where changes

were implemented without advance notification of the relevant information and make the

documentation available to competent authorities on request.

5. Account servicing payment service providers shall publish on their websites quarterly

statistics on the availability, unplanned unavailability and performance of their dedicated

interfaces, and, for comparison purposes, of the interfaces that they make available to their

payment service users for direct access to payment accounts online. The performance of

dedicated interfaces shall be measured by the number of successful account information

requests over the total number of account information requests, and by the number and

transaction volume of the successful payment initiation requests over the total number and

transaction volume of the total number of payment initiation requests.

8543/1/26 REV 1 217

EN

6. An account servicing payment service provider shall make available a testing facility,

including support, for connectivity and functional testing of dedicated interfaces to enable

authorised payment initiation service providers and account information service providers,

or relevant applicant payment institutions, to test their software and the applications used

for offering a payment service to users. No sensitive payment data or any other personal

data shall be shared through the testing facility.

7. In the case of an unexpected event or error occurring during the identification or

authentication process, or during the exchange of the data elements via its dedicated

interface, the account servicing payment service provider shall provide for notification

messages to be sent to the payment initiation service provider or the account information

service provider, explaining the reason for the unexpected event or error.

Article 37

Requirements for dedicated data access interfaces

1. An account servicing payment service provider shall ensure that the dedicated interface it

puts in place pursuant to Article 36(1) meets the following security and performance

requirements:

(a) the dedicated interface establishes and maintains communication sessions between

the account servicing payment service provider, the account information service

provider, the payment initiation service provider and any payment service user

concerned throughout the authentication of the payment service user;

8543/1/26 REV 1 218

EN

(b) the dedicated interface ensures the integrity and confidentiality of the personalised

security credentials and of authentication codes transmitted by or through the

payment initiation service provider or the account information service provider;

(c) the response time of the dedicated interface to requests for access from account

information service providers and payment initiation service providers does not

exceed the response time of the interface that the account servicing payment service

provider makes available to its payment service users for direct access to their

payment account online.

2. An account servicing payment service provider shall ensure that the dedicated interface

referred to in paragraph 1 allows account information service providers and payment

initiation service providers to:

(a) identify themselves to the account servicing payment service provider;

(b) instruct the account servicing payment service provider to start the authentication

based on the consent given by the payment service user to the account information

service provider or to the payment initiation service provider in accordance with

Article 50(3);

(c) make use, in a non-discriminatory manner, of any authentication exemptions applied

by the account servicing payment service provider;

8543/1/26 REV 1 219

EN

3. Account servicing payment service providers shall allow account information service

providers to communicate securely, via the dedicated interface referred to in paragraph 1,

in order to request and receive information on one or more designated payment accounts

and associated payment transactions. That information shall include the unique identifier of

the account, the associated names of the account holders, the currencies, the account

balance, and payment transactions initiated through a payment instrument which have not

yet been charged to the payment account, where those transactions are already visible in

the customer interface.

4. Account servicing payment service providers shall ensure that the dedicated interface

referred to in paragraph 1 allows payment initiation service providers to, at a minimum:

(a) place and revoke a standing payment order;

(b) initiate a single payment transaction;

(c) initiate and revoke a future-dated payment;

(d) initiate payment transactions to multiple beneficiaries;

(e) initiate payment transactions, regardless of whether the payee is on the payer’s

beneficiaries list, unless the payment service user is unable to execute those payment

transactions in the customer interface;

8543/1/26 REV 1 220

EN

(f) communicate securely to place a payment order from the payer’s payment account

and receive all information on the initiation of the payment transaction and all

information accessible to the account servicing payment service provider regarding

the execution of the payment transaction;

(g) verify the name of the account holder before the payment transaction is initiated,

regardless of whether the name of the account holder is available via the direct

interface;

(h) in cases where the account servicing payment service provider offers multiple

authentication procedures, choose which authentication procedure is to be presented

to the payer;

(i) prior to initiation of the payment transaction, see the unique identifier of the account,

the associated names of the account holders and, where available to the payment

service user, the currencies.

5. Account servicing payment service providers shall ensure that the dedicated interface

referred to in paragraph 1 provides payment initiation service providers with:

(a) immediate confirmation, upon request, in a simple ‘yes’ or ‘no’ format, of whether

the amount necessary for the execution of a payment transaction is available on the

payment account of the payer;

8543/1/26 REV 1 221

EN

(b) confirmation from the account servicing payment service provider, as soon as

possible, that the payment transaction has been or will be executed on the basis of the

information available to the account servicing payment service provider, taking into

account any pre-existing payment orders that might affect the full execution of the

payment order being placed.

The information referred to in the first subparagraph, point (b),shall not be shared with the

payment initiation service provider but may be used by the account servicing payment

service provider in order to provide confirmation of the execution of the operation.

6. For the purposes of the activities of payment initiation service providers and account

information service providers, the name of the account owner and the unique identifier of

the account shall not constitute sensitive payment data.

Article 38

Data access parity between dedicated access interface and customer interface

1. Without prejudice to Article 37, an account servicing payment service provider shall

ensure that the dedicated interface referred to in Article 36(1) offers at all times at least the

same level of availability and performance, including technical and IT support, as the

interfaces that the account servicing payment service provider makes available to the

payment service user for direct access to its payment account online.

8543/1/26 REV 1 222

EN

2. An account servicing payment service provider shall provide account information service

providers with at least the same information from designated payment accounts and

associated payment transactions as that which is made available to the payment service

user when directly requesting access to the account information, provided that that

information does not include sensitive payment data.

3. An account servicing payment service provider shall provide payment initiation service

providers with at least the same information on the initiation and execution of the payment

transaction as that which is provided or made available to the payment service user when

the transaction is initiated directly by the payment service user. That information shall be

provided immediately upon receipt of the payment order. Any update to that information,

including to the payment status, shall be made available to the payment initiation service

provider via the dedicated interface and on an ongoing basis until the payment transaction

is executed or rejected.

Article 39

Availability and performance requirements for the dedicated interface

1. An account servicing payment service provider shall take all measures in its power to limit

any planned unavailability of the dedicated interface to the extent strictly necessary and to

prevent unplanned unavailability and underperformance of the dedicated interface.

Unavailability shall be presumed to have arisen when five consecutive requests for access

to information for the provision of payment initiation services or account information

services receive server error responses or no response from the account servicing payment

service provider’s dedicated interface within 30 seconds.

8543/1/26 REV 1 223

EN

2. In cases of planned unavailability of the dedicated interface, account servicing payment

service providers shall, with the exception of emergency changes, inform payment service

providers making use of the dedicated interface at least one month in advance of the

planned unavailability and its duration. Planned unavailability shall normally occur

between 00:00 and 06:00.

3. In cases of unplanned unavailability of the dedicated interface, account servicing payment

service providers shall inform, in a timely manner, payment initiation service providers and

account information service providers making use of the dedicated interface, of the

measures being taken to restore the interface and of the estimated time necessary for the

problem to be resolved. Account servicing payment service providers shall ensure an

optimal recovery time of the dedicated interface.

4. An account servicing payment service provider shall ensure that the dedicated interface

provides availability and performance that are equal at least to those of the interface that

the account servicing payment service provider uses for authentication and communication

with its payment service users.

8543/1/26 REV 1 224

EN

5. EBA shall develop draft regulatory technical standards specifying:

(a) the requirements related to quarterly statistics on the availability and performance of

the interfaces referred to in Article 36(5) and the publication thereof;

(b) the standards establishing an optimal recovery time in cases of unplanned

unavailability of a dedicated interface pursuant to paragraph 3, based on the severity

of the incident.

For the purposes of the first subparagraph, point (b), an assessment of severity shall take

into account, among others, the number of customers impacted and types of functionality

affected of account information service providers and payment initiation service providers.

EBA shall submit the draft regulatory technical standards referred to in the first

subparagraph to the Commission by … [9 months from the date of entry into force of this

Regulation].

Power is delegated to the Commission to adopt the regulatory technical standards referred

to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of

Regulation (EU) No 1093/2010.

8543/1/26 REV 1 225

EN

Article 40

Derogation from the requirement to have a dedicated interface for data access

1. By way of derogation from Article 36(1), at the request of an account servicing payment

service provider, the competent authority may exempt that account servicing payment

service provider from the obligation to have in place a dedicated interface and allow it to

either:

(a) offer, as an interface for secure data exchange, one of the interfaces that the account

servicing payment service provider uses for authentication and communication with

its payment service users, provided that that interface offers equivalent functionality

to support access by payment initiation service providers and account information

service providers and uses widely accepted and interoperable standards; or

(b) where justified, not offer any interface for secure data exchange.

Where appropriate, Member States may exempt national central banks not acting in their

capacity as monetary authority or other public authorities referred to in Article 2(1),

point (d), from the obligation to have in place a dedicated interface.

2. EBA shall develop draft regulatory technical standards specifying the criteria on the basis

of which, in accordance with paragraph 1, it is justified for an account servicing payment

service provider not to offer any interface for secure data exchange. When specifying those

criteria, EBA shall, among others, consider the size, annual turnover and payments volume

of the account servicing payment service provider.

8543/1/26 REV 1 226

EN

EBA shall submit the draft regulatory technical standards referred to in the first

subparagraph to the Commission by … [12 months from the date of entry into force of this

Regulation].

Power is delegated to the Commission to adopt those regulatory technical standards in

accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

SECTION 3

RIGHTS AND OBLIGATIONS OF ACCOUNT

SERVICING PAYMENT SERVICE PROVIDERS

Article 41

Obligations of account servicing payment service providers

regarding payment initiation services

The account servicing payment service provider shall perform the following actions to ensure the

payment service user’s right to use the payment initiation service:

(a) communicate securely with payment initiation service providers;

(b) immediately after receipt of the payment order, and on an ongoing basis, on request from a

payment initiation service provider, make available all information on the initiation of the

payment transaction and all information accessible to the account servicing payment

service provider regarding the execution of the payment transaction to the payment

initiation service provider;

8543/1/26 REV 1 227

EN

(c) treat payment orders transmitted through the services of a payment initiation service

provider as if those payment orders were payment orders transmitted directly by the payer

or the payee, in particular in terms of timing, priority or charges.

For the purposes of the first subparagraph, point (b), where some or all of the information referred

to in that point is unavailable immediately after receipt of the payment order, the account servicing

payment service provider shall ensure that any information, including any payment status update,

relating to the execution of the payment transaction is made available to the payment initiation

service provider immediately after that information becomes available to the account servicing

payment service provider.

Article 42

Obligations of account servicing payment service providers

regarding account information services

1. The account servicing payment service provider shall perform the following actions to

ensure the payment service user’s right to use the account information service:

(a) communicate securely with the account information service provider;

(b) treat data requests transmitted through the services of an account information service

provider as if the data were requested by the payment service user via the interface

that the account servicing payment service provider makes available to its payment

service users to allow them direct access to their payment account.

8543/1/26 REV 1 228

EN

2. The account servicing payment service provider shall allow account information service

providers to access information from designated payment accounts and associated payment

transactions held by that account servicing payment service provider for the purpose of

providing the account information service whether or not the payment service user is

actively requesting such information.

3. Where the account information service provider intends to access information pursuant to

paragraph 2 at times when the payment service user is not actively requesting such

information, it shall ensure that the payment service user is duly aware of that intention

before making use of that functionality.

8543/1/26 REV 1 229

EN

Article 43

Restriction of access to payment accounts by account information service providers

and payment initiation service providers

1. An account servicing payment service provider may deny an account information service

provider or a payment initiation service provider access to a payment account for

objectively justified and duly evidenced reasons. Those reasons shall relate to access to the

payment account by that account information service provider or that payment initiation

service provider which is deemed unauthorised, pursuant to Article 50(4), or fraudulent,

including the unauthorised or fraudulent initiation of a payment transaction. In such cases,

the account servicing payment service provider shall inform the payment service user that

access to the payment account is denied and provide the reasons therefor. That information

shall, where possible, be provided to the payment service user before access is denied and,

at the latest, immediately thereafter, unless providing it would compromise objectively

justified security reasons or it is prohibited by other relevant Union or national law.

2. In the cases referred to in paragraph 1, the account servicing payment service provider

shall immediately report the incident relating to the account information service provider

or the payment initiation service provider to the competent authority. The information shall

include the relevant details of a case and the reasons for taking action. The competent

authority shall assess that case and shall, if necessary, take appropriate measures.

8543/1/26 REV 1 230

EN

Article 44

Data access management by payment service users

1. The account servicing payment service provider shall provide the payment service user

with a dashboard, integrated into its user interface, to monitor and manage the consents

that the payment service user has given for the purposes of account information services or

payment initiation services covering multiple or recurrent payments.

2. The dashboard shall:

(a) provide the payment service user, at any time and in a format that is easy to

understand, with an overview of each ongoing consent given for the purposes of

account information services or payment initiation services, including:

(i) the name of the account information service provider or payment initiation

service provider to which access has been granted;

(ii) the customer account to which access has been granted;

(iii) the purpose of the consent;

(iv) the period of validity of the consent, including the date on which the payment

service user has given that consent;

(v) the categories of data being shared;

(vi) the dates on which payment account data was accessed.

8543/1/26 REV 1 231

EN

(b) allow the payment service user to withdraw data access for all account information

service or payment initiation service providers or for a given account information

service or payment initiation service provider at any time and free of charge;

(c) within 48 hours of withdrawal of a consent, allow the payment service user to

re-establish any data access withdrawn;

(d) include a record of data access consents that have been withdrawn or that have

expired, for a duration of two years.

3. Where, pursuant to paragraph 2, point (b), a payment service user decides to withdraw data

access, the payment initiation service provider or account information service provider

concerned shall:

(a) cease accessing and using the data; and

(b) delete without undue delay, but not before 48 hours have passed after the withdrawal

of a consent, the data received as a result of the data access consent granted by the

payment service user.

By way of derogation from the first subparagraph, point (b), the payment service provider

concerned may retain the data if the payment service user explicitly so chooses.

8543/1/26 REV 1 232

EN

4. The account servicing payment service provider shall ensure that the dashboard is easy to

find in its user interface and that information displayed on the dashboard is clear, neutral,

accurate and easily understandable for the payment service user and does not contain any

deterring or discouraging language that might dissuade the payment service user from

making use of the services of a payment initiation service provider or account information

service provider.

The account servicing payment service provider shall not:

(a) prompt the payment service user to withdraw a consent given for the purposes of

account information services or payment initiation services;

(b) design, organise or operate its dashboard in a manner that deceives, manipulates, or

directs the payment service user to grant consents that are not in the user’s best

interest, or in a manner that materially distorts or impairs the user’s ability to make

free and informed decisions.

5. The account information service provider or payment initiation service provider to which

consent has been granted shall provide the information referred to in paragraph 2, point (a),

to the account servicing payment service provider without undue delay. The account

servicing payment service provider shall only provide that information to the extent that it

was provided to it by the account information service provider or payment initiation

service provider to which consent has been granted.

8543/1/26 REV 1 233

EN

6. The account servicing payment service provider and the account information service

provider or payment initiation service provider to which consent has been granted shall

cooperate to make information available to the payment service user via the dashboard

without undue delay.

The account servicing payment service provider shall make information available to the

account information service provider or payment initiation service provider without undue

delay of any changes made by the payment service user via the dashboard to a consent,

including the withdrawal of a consent.

An account information service provider or payment initiation service provider shall

inform the account servicing payment service provider without undue delay of a new

consent granted by a payment service user regarding a payment account provided by that

account servicing payment service provider, including the information listed in

paragraph 2(a), points (i) to (v).

7. The account servicing payment service provider shall bear no liability for the undertaking

by the payment service user of the actions referred to in paragraph 2, points (b) and (c).

Article 45

Prohibited obstacles to data access

1. Account servicing payment service providers shall ensure that their dedicated interfaces do

not create obstacles to the provision of payment initiation services and account information

services.

8543/1/26 REV 1 234

EN

Prohibited obstacles shall include the following:

(a) preventing the use by payment initiation service providers or account information

service providers of the personalised security credentials issued by account servicing

payment service providers to their payment service users;

(b) requiring payment service users to manually input their unique identifier into the

domain of the account servicing payment service provider in order to be able to use

account information services or payment initiation services;

(c) requiring checks of the consent given by payment service users to a payment

initiation service provider or an account information service provider;

(d) requiring additional registrations by payment initiation service providers and account

information service providers in order to be able to access the payment service user’s

payment account or the dedicated interface;

(e) requiring, unless necessary to facilitate the exchange of information between account

servicing payment service providers and payment initiation service providers and

account information service providers related, in particular, to the updating of the

dashboard referred to in Article 44, that payment initiation service providers and

account information service providers pre-register their contact details with the

account servicing payment service provider;

8543/1/26 REV 1 235

EN

(f) restricting the ability of a payment service user to initiate payments via a payment

initiation service provider only to those payees that are on the payer’s beneficiaries

list, unless the payment service user is unable to perform those payments in the

customer interface;

(g) restricting payment initiations to or from domestic unique identifiers only;

(h) requiring strong customer authentication more times than the account servicing

payment service provider requires when the payment service user is directly

accessing that user’s payment account or initiating a payment with the account

servicing payment service provider;

(i) providing a dedicated interface that does not support all authentication procedures

made available by the account servicing payment service provider to its payment

service user;

(j) imposing an account information or payment initiation journey, by way of a

redirection or decoupled approach, whereby the authentication of the payment

service user with the account servicing payment service provider includes additional

steps or required actions in the user journey compared to the equivalent

authentication procedure offered to payment service users when they directly access

their payment accounts or initiate payments with the account servicing payment

service provider;

8543/1/26 REV 1 236

EN

(k) imposing automatic redirection of a user, at the stage of authentication, to the

account servicing payment service provider’s web page, when the dedicated interface

does not support all the authentication procedures made available by the account

servicing payment service provider to its payment service users;

(l) requiring strong customer authentication two times in a payment initiation

service-only journey where the payment initiation service provider transmits to the

account servicing payment service provider all information necessary to initiate the

payment, namely one strong customer authentication for the ‘Yes’ or ‘No’

confirmation and a second strong customer authentication for payment initiation.

2. Measures taken by account servicing payment service providers which are necessary to

address suspected fraud under this Regulation or to comply with Regulation

(EU) 2016/679 shall not be deemed to constitute obstacles to data access unless those

measures are prohibited obstacles as referred to in paragraph 1, points (a) to (l), of this

Article.

8543/1/26 REV 1 237

EN

SECTION 4

RIGHTS AND OBLIGATIONS OF ACCOUNT INFORMATION SERVICE PROVIDERS

AND PAYMENT INITIATION SERVICE PROVIDERS

Article 46

Use of the customer interface by account information service providers

and payment initiation service providers

1. Account information service providers and payment initiation service providers shall

access payment account data exclusively via the dedicated interface referred to in

Article 36, other than in the circumstances set out in Article 40(1) or exceptionally via

another safe and efficient interface.

2. Where only the interface referred to in Article 40(1), point (a), is accessible to a payment

initiation service provider or an account information service provider, the account

information service provider or the payment initiation service provider shall at all times:

(a) identify itself to the account servicing payment service provider;

(b) provide information in accordance with Article 44(2), points (a)(ii) to (v);

(c) rely on the authentication procedures provided by the account servicing payment

service provider to the payment service user;

8543/1/26 REV 1 238

EN

(d) take the necessary measures to ensure that it does not process data, including access

and storage of data, for purposes other than the provision of the service requested by

the payment service user;

(e) in order to allow the competent authority to investigate compliance with this Section,

log the data that are accessed through the interface operated by the account servicing

payment service provider for its payment service users, and provide, upon request

and without undue delay, the log files to the competent authority.

For the purposes of the first subparagraph, point (e), logs shall be deleted three years after

their creation. Logs may be kept for longer than that retention period to the extent that they

are required for monitoring procedures that are already underway.

Article 47

Specific obligations of payment initiation service providers

1. Payment initiation service providers shall:

(a) provide account servicing payment service providers with the same information as

the information requested from the payment service user when initiating the payment

transaction directly;

(b) provide services only on the basis of the payment service user’s consent, in

accordance with Article 50;

8543/1/26 REV 1 239

EN

(c) not hold at any time the payer’s funds in connection with the provision of the

payment initiation service;

(d) ensure that the personalised security credentials of the payment service user are not,

with the exception of the payer and the issuer of the personalised security credentials,

accessible to other parties and that they are transmitted by the payment initiation

service provider through safe and efficient channels;

(e) ensure that any other information relating to the payment service user obtained when

providing payment initiation services, is only provided to the payee and only with the

payment service user’s consent;

(f) every time a payment is initiated, identify itself to the account servicing payment

service provider and securely communicate with the account servicing payment

service provider, the payer and the payee;

(g) be able to refuse to initiate a payment transaction for objectively justified reasons.

2. Payment initiation service providers shall not:

(a) without prejudice to Article 46(2), point (e), store sensitive payment data of the

payment service user;

8543/1/26 REV 1 240

EN

(b) request from the payment service user any data other than those necessary to provide

the payment initiation service;

(c) process any personal or non-personal data, including use, access or storage of data,

for purposes other than the provision of the payment initiation service as permitted

by the payment service user;

(d) modify the amount, the payee or any other feature of the payment transaction.

Article 48

Specific obligations of and other provisions

concerning account information service providers

1. The account information service provider shall:

(a) provide services only on the basis of the payment service user’s consent, in

accordance with Article 50;

(b) ensure that the personalised security credentials of the payment service user are not

accessible to other parties with the exception of the user and the issuer of the

personalised security credentials, and that when those credentials are transmitted by

the account information service provider, transmission is done through safe and

efficient channels;

8543/1/26 REV 1 241

EN

(c) for each communication session, identify itself to the account servicing payment

service provider of the payment service user and securely communicate with the

account servicing payment service provider and the payment service user;

(d) access only information from designated payment accounts and associated payment

transactions;

(e) have in place suitable and effective mechanisms that prevent access to information

other than from designated payment accounts and associated payment transactions, in

accordance with the payment service user’s consent.

2. The account information service provider shall not:

(a) access sensitive payment data linked to the payment accounts;

(b) process any data for purposes other than the provision of the account information

service as permitted by the payment service user.

3. Articles 4 to 8, Articles 10, 11 and 12, Articles 14 to 19, Articles 21 to 29, Articles 51

and 52, Articles 54 to 83, and Articles 87 and 90 shall not apply to account information

service providers.

8543/1/26 REV 1 242

EN

SECTION 5

IMPLEMENTATION

Article 49

Role of competent authorities

1. Competent authorities shall ensure that account servicing payment service providers

comply at all times with their obligations in relation to the dedicated interface referred to in

Article 36(1) and Article 39 and that any identified prohibited obstacle listed in Article 45

is immediately removed by the relevant account servicing payment service provider.

Where any non-compliance of the dedicated interfaces with this Regulation, or prohibited

obstacles, are identified, including on the basis of information transmitted by payment

initiation service providers or account information service providers, the competent

authorities shall take without undue delay the necessary and adequate enforcement

measures and impose any appropriate sanction.

2. Competent authorities shall take without delay every necessary enforcement action where

necessary to preserve the access rights of payment initiation service providers and account

information service providers. Enforcement actions may include appropriate sanctions.

8543/1/26 REV 1 243

EN

3. Competent authorities shall ensure that payment initiation service providers and account

information service providers comply with their obligations in relation to the use of data

access interfaces.

4. Competent authorities shall have the necessary resources, in particular in terms of

dedicated staff, in order to carry out their tasks at all times.

5. Competent authorities shall cooperate with the supervisory authorities under Regulation

(EU) 2016/679 where the processing of personal data is concerned.

6. Competent authorities shall, on their own initiative, hold joint meetings with account

servicing payment service providers, payment initiation service providers and account

information service providers for the purposes of paragraph 7.

7. Competent authorities shall deploy their best efforts to ensure that possible issues arising

from the use of and access to data exchange interfaces between account servicing payment

service providers, payment initiation service providers and account information service

providers are rapidly and durably resolved.

8. Account servicing payment service providers shall provide competent authorities with data

on access by account information service providers and payment initiation service

providers to payment accounts which they service. Competent authorities may also, where

appropriate, require account information service providers and payment initiation service

providers to provide any relevant data on their operations.

8543/1/26 REV 1 244

EN

In accordance with its powers pursuant to Article 29(1), point (b), Article 31 and

Article 35(2) of Regulation (EU) No 1093/2010, EBA shall coordinate monitoring activity

by competent authorities as referred to in the first subparagraph of this paragraph, avoiding

data reporting duplication. EBA shall report every two years to the Commission on the size

and operation of the markets for account information services and payment initiation

services in the Union. Those reports may, where appropriate, contain recommendations.

9. EBA shall develop draft regulatory technical standards specifying the data to be provided

to competent authorities pursuant to paragraph 8 as well as the methodology and

periodicity to be applied for such data provision.

EBA shall submit the draft regulatory technical standards referred to in the first

subparagraph to the Commission by … [18 months from the date of entry into force of this

Regulation].

Power is delegated to the Commission to adopt those regulatory technical standards in

accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

8543/1/26 REV 1 245

EN

Chapter 4

Authorisation of payment transactions

Article 50

Authorisation

1. A payment transaction or a series of payment transactions shall be authorised only if the

payer has given its consent for the execution of the payment transaction. A payment

transaction may be authorised by the payer prior to or, if agreed between the payer and the

payment service provider, after the execution of the payment transaction.

2. A payment transaction shall be deemed to be unauthorised where the transaction was

initiated or modified by a third party who is acting without the consent of the payer,

including by using the fraudulently-obtained personalised security credentials of the payer.

3. Access to a payment account for the purposes of account information services or payment

initiation services by payment service providers shall be authorised only if the payment

service user has given its consent to the account information service provider or,

respectively, to the payment initiation service provider, to access the payment account and

the relevant data in that account.

8543/1/26 REV 1 246

EN

4. In the absence of consent, a payment transaction or access to a payment account by an

account information service provider or a payment initiation service provider shall be

deemed to be unauthorised.

5. Account servicing payment service providers shall not verify the consent given by the

payment service user to the account information service provider or the payment initiation

service provider.

6. The consent referred to in paragraphs 1 and 3 shall be expressed in the form agreed

between the payment service user and the relevant payment service provider. Consent to

execute a payment transaction may also be expressed via the payee or the payment

initiation service provider.

The procedure for giving consent shall be agreed between the payment service user and the

relevant payment service provider.

7. The payer may withdraw consent to execute a payment transaction or to access a payment

account for the purposes of payment initiation services at any time, but no later than at the

moment of irrevocability in accordance with Article 69. The payment service user may

withdraw consent to access a payment account for the purposes of account information

services at any time. The payer may also withdraw consent to execute a series of payment

transactions, in which case any future payment transaction in that series shall be deemed to

be unauthorised.

8543/1/26 REV 1 247

EN

Article 51

Discrepancies between the name and unique identifier of a payee in case of credit transfers

In the case of credit transfers, payment service providers shall comply with Article 5c(1) to (7) and

Article 5b(2) of Regulation (EU) No 260/2012, and those articles shall apply mutatis mutandis to all

credit transfers, including those that fall outside the scope of Regulation (EU) No 260/2012.

For the purposes of the first subparagraph of this paragraph, where the payment account of the

payee is not identified by the payment account identifier specified in point (1)(a) of the Annex to

Regulation (EU) No 260/2012, references in Article 5c of that Regulation to the payment account

identifier shall be construed as referring to the unique identifier used to unambiguously identify the

payment account of the payee.

Article 52

Limits and blocking of the use of the payment instrument

1. The payment service provider shall offer to the payment service user in the framework

contract the possibility of setting in that contract a limit of a maximum amount that can be

transferred, which may differ according to each means of payment, including for credit

transfers, and each payment instrument. A limit may be on a per-transaction basis or within

a set timeframe, at the sole discretion of the payment service user.

Payment service providers shall not unilaterally change the spending limits set in the

framework contract with their payment service users.

8543/1/26 REV 1 248

EN

It shall be possible for the payment service user to modify the spending limits set in the

framework contract. Payment service providers shall ensure that the payer is able to

modify the spending limits set prior to the placing of a payment order.

2. If the payment service user increases the spending limits remotely, payment service

providers shall set a delay of four hours for that increase to come into effect. Payment

service users shall have the right to adjust or opt out of the application of such a delay

period. Where a delay period is in place, it shall apply before any subsequent adjustment or

opt out comes into effect.

Payment service providers shall immediately notify payment service users, in an agreed

manner, where a change to a spending limit is requested, that the delay period referred to in

the first subparagraph has ended or that the adjustment or opt-out referred to in the first

subparagraph is exercised.

3. Where a payment service user’s payment order exceeds, or leads to the exceeding of the

maximum amount, the payer’s payment service provider shall not execute the payment

order and shall inform the payment service user of the reasons thereof and how to modify

the maximum amount.

4. The payment service provider may block the payment instrument for objectively justified

reasons relating to the security of the payment instrument, the suspicion of unauthorised or

fraudulent use of the payment instrument or, in the case of a payment instrument with a

credit line, a significantly increased risk that the payer might be unable to meet its

obligation to pay.

8543/1/26 REV 1 249

EN

5. Where a payment instrument is blocked pursuant to paragraph 4, the payment service

provider shall inform the payer of the blocking of the payment instrument and the specific

reasons for it in an agreed manner, where possible before the payment instrument is

blocked and at the latest immediately thereafter, unless providing such information is

prohibited by other relevant Union or national law. The payer’s payment service provider

shall without undue delay and within two business days at the latest, assess whether the

reasons for blocking the payment instrument are still justified.

6. The payment service provider shall unblock the payment instrument or replace it with a

new payment instrument once the reasons for blocking it no longer exist.

7. Where the payment service provider offers the payment service user the possibility to

initiate or give consent to payment transactions by means of a mobile application, the

payment service provider shall require strong customer authentication and the use of

different communication channels to activate that mobile application.

8. If the payment service user activates the mobile application remotely, the payment service

provider shall set a delay of four hours for that activation to take effect. The payment

service user shall have the right to adjust or opt out of the application of such a delay

period. Where a delay period is in place, it shall apply before any subsequent adjustment or

opt out comes into effect.

8543/1/26 REV 1 250

EN

9. The payment service provider shall immediately notify the payment service user, in an

agreed manner, and through different communication channels, of the activation of a

mobile application. The notification shall include instructions in case the payment service

user has not installed the mobile application themselves.

The procedure for the notification referred to in this paragraph shall be agreed between the

payment service user and the payment service provider.

10. Where the payment service user notifies the payment service provider that they have not

activated the mobile application linked to their payment account in accordance with the

procedure referred to in paragraph 9, the payment service provider shall without undue

delay ensure that the mobile application does not make it possible to access the payment

account of the payment service user, or to initiate or give consent to payment transactions.

11. Paragraphs 7, 8 and 9 shall not apply to the initial establishment of the customer

relationship between the payment service user and the payment service provider through

the use of a mobile application nor to the activation by the payment service provider at its

physical premises of a mobile application on a device of the payment service user.

12. This Article applies to all credit transfers, including credit transfers in euro,

notwithstanding Regulation (EU) No 260/2012.

8543/1/26 REV 1 251

EN

Article 53

Obligations of the payment service user in relation to payment instruments

and personalised security credentials

The payment service user entitled to use a payment instrument shall:

(a) use the payment instrument in accordance with the terms governing the issue and use of

the payment instrument, which shall be objective, non-discriminatory and proportionate;

(b) notify the payment service provider, or the entity specified by the payment service

provider, without undue delay on becoming aware of the loss, theft, misappropriation or

unauthorised use of the payment instrument or its relevant personalised security

credentials.

For the purposes of the first subparagraph, point (a), the payment service user shall, as soon as in

receipt of a payment instrument, take all reasonable steps to keep its personalised security

credentials safe.

Article 54

Obligations of the payment service provider in relation to payment instruments

1. The payment service provider issuing a payment instrument shall:

(a) ensure that personalised security credentials are not accessible to parties other than

the payment service user that is entitled to use the payment instrument, without

prejudice to the obligations of the payment service user set out in Article 53;

8543/1/26 REV 1 252

EN

(b) refrain from sending an unsolicited payment instrument, except where a payment

instrument already given to the payment service user is to be replaced;

(c) ensure that appropriate means are available at all times and free of charge to enable

the payment service user to make a notification pursuant to Article 53, first

paragraph, point (b), or to request unblocking of the payment instrument pursuant to

Article 52(6), and that human support is, at least during business hours, available free

of charge for those purposes in an official language of the Member State where the

payment service is provided;

(d) provide the payment service user with the possibility to make a notification pursuant

to Article 53, first paragraph, point (b), free of charge and only charge any possible

replacement costs directly attributed to the payment instrument;

(e) prevent all use of the payment instrument once a notification pursuant to Article 53,

first paragraph, point (b), has been made;

(f) ensure that sensitive payment data are transmitted to the payment service user

through safe channels.

For the purposes of the first subparagraph, point (c), the payment service provider shall

provide the payment service user upon its request, for 18 months after notification, with the

means to prove that the payment service user made such a notification.

2. The payment service provider shall bear the risk of sending a payment instrument or any

personalised security credentials relating to it to the payment service user.

8543/1/26 REV 1 253

EN

Article 55

Notification and rectification of unauthorised, authorised

or incorrectly executed payment transactions

1. The payment service provider shall only rectify any unauthorised, incorrectly executed

payment transaction or authorised payment transaction where the payment service user

notifies the payment service provider in accordance with Article 57, 60 or 87 without

undue delay after becoming aware of any such transaction giving rise to a claim, including

a claim under Article 79, and, in any case, no later than 18 months after the debit date.

The time limits for notification laid down in the first subparagraph shall not apply where

the payment service provider has failed to provide or make available the information on the

payment transaction in accordance with Title II.

2. Where a payment initiation service provider is involved, the payment service user shall

obtain rectification from the account servicing payment service provider pursuant to

paragraph 1 of this Article, without prejudice to Article 57(4) and Article 79(1).

Article 56

Evidence on authorisation and execution of payment transactions

1. Where a payment service user denies having authorised an executed payment transaction

or claims that the payment transaction was not correctly executed, the burden shall be on

the payment service provider to prove that the payment transaction was authorised,

accurately recorded, entered in the accounts and not affected by a technical breakdown or

some other deficiency of the service provided by the payment service provider.

8543/1/26 REV 1 254

EN

If the payment transaction is initiated through a payment initiation service provider, the

burden shall be on the payment initiation service provider to prove that within its sphere of

competence, the payment transaction was authorised, accurately recorded and not affected

by a technical breakdown or other deficiency linked to the payment service of which it is in

charge.

2. Where a payment service user denies having authorised an executed payment transaction,

the fact that the payment transaction was authenticated, including where applicable, via

strong customer authentication, accurately recorded, entered in the accounts and not

affected by a technical breakdown or some other deficiency of the service provided shall

not, in itself, necessarily be sufficient to prove either that the payment transaction was

authorised by the payer or that the payer acted fraudulently or failed with intent or gross

negligence to fulfil one or more of the obligations under Article 53. The payment service

provider, including, where appropriate, the payment initiation service provider, shall

provide supporting evidence to prove fraud or gross negligence on part of the payment

service user.

8543/1/26 REV 1 255

EN

3. For the purposes of paragraphs 1 and 2 of this Article, and before concluding that a

payment service user has authorised the transaction, acted fraudulently or failed with intent

or gross negligence to fulfil one or more of the obligations under Article 53, the payment

service provider shall invite the payment service user to provide information regarding the

events leading up to the payment transaction and include that information in its assessment.

Where the payment service user does not provide such information, that shall not, in itself,

lead the payment service provider to conclude that the payment service user has authorised

the transaction, acted fraudulently or failed with intent or gross negligence to fulfil one or

more of the obligations under Article 53. The payment service user shall not be expected to

provide information beyond what such a payment service user can reasonably be expected

to have.

Article 57

Payment service provider’s liability for unauthorised payment transactions

1. Without prejudice to Article 55, in the case of an unauthorised payment transaction, the

payer’s payment service provider shall refund the payer the amount of the unauthorised

payment transaction immediately, and in any event no later than by the end of the

following business day, after noting or being notified of the unauthorised transaction,

except where the payer’s payment service provider has objectively justified reasons for

suspecting that the payer failed with intent or gross negligence to fulfil one or more of the

obligations under Article 53, and communicates those grounds to the payer in writing, or

for suspecting that the payer acted fraudulently.

8543/1/26 REV 1 256

EN

2. Where the payer’s payment service provider had objectively justified reasons for

suspecting that the payer acted fraudulently or failed with intent or gross negligence to

fulfil one or more of the obligations under Article 53, the payer’s payment service provider

shall, within 15 business days after noting or being notified of the transaction, do either of

the following:

(a) refund the payer the amount of the unauthorised payment transaction if the payer’s

payment service provider has concluded, after further investigation, that the payer

did not act fraudulently or fail with intent or gross negligence to fulfil one or more of

the obligations under Article 53;

(b) provide a justification to the payer for refusing the refund and indicate the bodies to

which the payer is able to refer the matter in accordance with Articles 100, 101, 103,

104 and 105 if the payer does not accept the reasons provided and, where the

payment service provider concludes that the payer acted fraudulently, communicate

the reasons for that conclusion to the relevant national authority.

For the purposes of the first subparagraph, point (b), Member States shall publish the name

of the relevant national authority to whom the justification is to be provided.

3. Where applicable, the payer’s payment service provider shall restore the debited payment

account to the state in which it would have been had the unauthorised payment transaction

not taken place. The payer’s payment service provider shall also ensure that the credit

value date for the payer’s payment account is no later than the date on which the amount

was debited.

8543/1/26 REV 1 257

EN

4. Where the payment transaction is initiated through a payment initiation service provider,

the account servicing payment service provider shall refund immediately, and in any event

no later than the end of the following business day, the amount of the unauthorised

payment transaction and, where applicable, restore the debited payment account to the state

in which it would have been had the unauthorised payment transaction not taken place.

5. If the payment initiation service provider is liable for the unauthorised payment

transaction, the payment initiation service provider shall immediately compensate the

account servicing payment service provider at its request for the losses incurred or sums

paid as a result of the refund to the payer, including the amount of the unauthorised

payment transaction. In accordance with Article 56(1), the burden shall be on the payment

initiation service provider to prove that, within its sphere of competence, the payment

transaction was authorised, accurately recorded and not affected by a technical breakdown

or other deficiency linked to the payment service of which it is in charge.

6. Any further financial loss caused to the payer may be compensated in accordance with the

law applicable to the contract concluded between the payer and the relevant payment

service provider.

8543/1/26 REV 1 258

EN

Article 58

Payment service provider’s liability

for incorrect application of the matching verification service

Where a payment service provider fails to comply with Article 51, and that failure results in a

defectively executed payment transaction, the payer’s payment service provider shall without delay

refund the payer the amount transferred and, where applicable, restore the debited payment account

to the state in which it would have been had the transaction not taken place.

Where that failure occurs because the payee’s payment service provider, or the payment initiation

service provider, failed to comply with Article 51, the payee’s payment service provider or, where

relevant, the payment initiation service provider, shall compensate the payer’s payment service

provider for the financial damage caused to the payer’s payment service provider by that failure.

Any further financial loss caused to the payer may be compensated in accordance with the law

applicable to the contract concluded between the payer and the relevant payment service provider.

8543/1/26 REV 1 259

EN

Article 59

Liability of technical service providers and of operators of payment schemes for failure

to support the application of strong customer authentication

Technical service providers and operators of payment schemes that provide services to the payee, or

to the payee’s or payer’s payment service provider, shall be liable for direct financial damage

caused to the payee, or to the payee’s or payer’s payment service provider, for, and proportionate to,

their failure, within the remit of their contractual relationship, and not exceeding the amount of the

transaction in question, to provide the services that are necessary to enable the application of strong

customer authentication.

Article 60

Payment service provider’s liability for impersonation fraud

1. Payment service providers shall have adequate prevention measures and robust technical

safeguards in place to prevent the replication and misuse by fraudsters of their

communication channels in order to mislead payment service users into making fraudulent

transactions.

8543/1/26 REV 1 260

EN

2. Where a payment service user who is a consumer has been manipulated by a third party

pretending to be the consumer’s payment service provider using communication channels

attributed to the consumer’s payment service provider and that manipulation has resulted in

fraudulent authorised payment transactions, the payment service provider shall refund the

consumer the full amount of the fraudulent authorised payment transaction provided that

the consumer has, without undue delay after becoming aware of the fraud, notified its

payment service provider and reported the fraud to the police.

3. Within 15 business days of being notified pursuant to paragraph 2 and provided with the

police report by the consumer, the payment service provider shall do either of the

following:

(a) refund the consumer the amount of the fraudulent authorised payment transaction;

(b) where the payment service provider has objectively justified reasons to suspect fraud

or a gross negligence by the consumer, provide a justification to the consumer for

refusing the refund and indicate the bodies to which the consumer is able to refer the

matter in accordance with Articles 100, 101, 103, 104 and 105 if the consumer does

not accept the reasons provided and, where the payment service provider concludes

that the consumer acted fraudulently, communicate the reasons for that conclusion to

the national authority referred to in Article 57(2), first subparagraph, point (b).

4. Paragraph 2 shall not apply if the consumer has acted fraudulently or with gross

negligence.

8543/1/26 REV 1 261

EN

5. The burden shall be on the payment service provider of the consumer to prove that the

consumer acted fraudulently or with gross negligence.

Before concluding that the consumer acted fraudulently or with gross negligence, the

payment service provider shall invite the consumer to provide information regarding the

events leading up to the payment transaction and take into account that information in its

assessment. Where the consumer does not provide such information, that shall not in itself

lead the payment service provider to conclude that the consumer acted fraudulently or with

gross negligence. The consumer shall not be expected to provide information beyond what

such a consumer can reasonably be expected to have.

Article 61

Cross-sectoral cooperation for the purposes of fraud prevention and detection

1. Where payment fraud originates in the publication of fraudulent content online, payment

service providers shall, without undue delay, inform providers of hosting services

following the procedure laid down in Article 16, or, where applicable, Article 22 of

Regulation (EU) 2022/2065.

8543/1/26 REV 1 262

EN

2. To the extent necessary for the purposes of preventing and detecting potentially fraudulent

payment transactions, including transactions involving payment initiation services, data

may be exchanged when there are objectively justified reasons to suspect fraudulent

behaviour by a user of their services:

(a) between payment service providers and providers of hosting services;

(b) between payment service providers and providers of interpersonal communications

services.

3. For the purposes of paragraph 2, without prejudice to Directive (EU) 2022/2555,

Directive 2002/58/EC or Article 101 of this Regulation, providers of interpersonal

communications services and providers of very large online platforms and of very large

online search engines shall establish dedicated communication channels with payment

service providers, or participate in a system for effective communication or in an

information sharing mechanism, to allow for faster and more effective exchanges in

compliance with Regulation (EU) 2016/679 and Directive 2002/58/EC.

4. Providers of interpersonal communications services and providers of very large online

platforms and of very large online search engines shall have in place all necessary

educational measures, including alerts to the recipients of their services via all appropriate

means and media when new forms of online scams emerge, taking into account the needs

of the most vulnerable groups of recipients of their services.

8543/1/26 REV 1 263

EN

For the purposes of the first subparagraph of this paragraph, providers of interpersonal

communications services shall give the recipients of their services clear indications as to:

(a) how to identify attempted fraud;

(b) actions and precautions to be taken to avoid falling victim to fraudulent activity

targeting them; and

(c) the procedure for reporting fraudulent activity.

For the purposes of the first subparagraph of this paragraph, providers of very large online

platforms and of very large online search engines shall give the recipients of their services

clear indications as to:

(a) how to identify attempted fraud;

(b) actions and precautions to be taken to avoid falling victim to fraudulent activity

targeting them; and

(c) the procedure for reporting fraudulent activity, for the purposes of compliance with

Article 16 of Regulation (EU) 2022/2065.

5. The Commission and the European Board for Digital Services shall encourage and

facilitate the drawing up of a voluntary code of conduct at Union level to foster prevention,

enhance security and combat payment fraud and financial scams, under the conditions set

out in Article 45 of Regulation (EU) 2022/2065.

8543/1/26 REV 1 264

EN

6. Without prejudice to Directive (EU) 2022/2555, providers of interpersonal

communications services shall take appropriate organisational and technical measures to

detect and prevent the use of their services for impersonation fraud, including by means of

manipulation of calling line identification or electronic mail addresses, where that use aims

to induce payment service users to make a payment or to take an action that would

compromise the security of the payment account. Those measures shall comply with

applicable Union law on data protection, in particular Regulation (EU) 2016/679 and

Directive 2002/58/EC.

Article 62

Advertising of regulated financial services on very large online platforms

and very large online search engines

1. For the purposes of this Article, ‘regulated financial service’ means any service of a

banking, credit, insurance, personal pension, payment or investment nature, including

crypto-assets and crowdfunding, for which authorisation from or registration with a

competent authority is required under Union law.

2. Providers of very large online platforms and of very large online search engines shall

request from each advertiser of a regulated financial service an authorisation number,

registration number or other information attesting that that advertiser is a regulated

financial service provider that is authorised or registered to provide the advertised

regulated financial service in a Member State or at the Union level or is acting on behalf of

such a provider.

8543/1/26 REV 1 265

EN

3. Providers of very large online platforms and of very large online search engines shall, upon

receiving the information referred to in paragraph 2 of this Article, and prior to allowing

the advertiser concerned to use their service for the purpose of advertising those regulated

financial services, make best efforts, including by using the registers of authorised or

registered providers of regulated financial services made available in accordance with

Directive (EU) 2026/…+ or other relevant Union law, to assess whether that information,

for the accuracy of which advertisers are solely responsible for the purposes of this

Regulation, is reliable and complete, provided that the assessment can be carried out in a

proportionate manner by automated tools.

4. Providers of very large online platforms and of very large online search engines who have

not obtained the information referred to in paragraph 2 shall refuse to allow the advertiser

of regulated financial services to use their services for the purpose of advertising those

regulated financial services.

5. For the purposes of compliance with Article 39(2), points (a), (b) and (c), of Regulation

(EU) 2022/2065, where the subject matter of an advertisement is a regulated financial

service, providers of very large online platforms and of very large online search engines

shall include in their advertisement repositories information that the subject matter of the

advertisement is a regulated financial service and whether the advertiser is acting on behalf

of a provider of regulated financial services.

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 266

EN

Article 63

Payer’s liability for unauthorised payment transactions

1. By way of derogation from Article 57, the payer may be obliged to bear the losses relating

to any unauthorised payment transactions, up to a maximum of EUR 50, resulting from the

loss, theft or misappropriation of a payment instrument or personalised security

credentials.

The first subparagraph shall not apply where either of the following occurred:

(a) the loss, theft or misappropriation of a payment instrument or personalised security

credentials was not detectable to the payer prior to a payment, except where the

payer has acted fraudulently; or

(b) the loss was caused by acts or lack of action of an employee, agent or branch of a

payment service provider or of an entity to which its activities were outsourced.

Where the payer has neither acted fraudulently nor intentionally failed to fulfil its

obligations under Article 53, national competent authorities, dispute resolution bodies or

payment service providers may reduce the liability referred to in this paragraph, taking into

account, in particular, the nature of the personalised security credentials and the specific

circumstances under which the payment instrument was lost, stolen or misappropriated.

8543/1/26 REV 1 267

EN

2. The payer shall bear all of the losses relating to any unauthorised payment transactions if

those losses were incurred by the payer acting fraudulently or failing to fulfil one or more

of the obligations set out in Article 53 with intent or gross negligence. In such cases, the

maximum amount referred to in paragraph 1 of this Article shall not apply.

3. Where the payer’s payment service provider fails to fulfil the obligation to require strong

customer authentication set out in Article 91, the payer shall not bear any financial losses

unless the payer has acted fraudulently. The payer shall not bear any financial losses also

where either the payer’s or the payee’s payment service provider applies an exemption

from the application of strong customer authentication. Where the payee or the payee’s

payment service provider fails to develop or amend the systems, hardware and software

that are necessary to apply strong customer authentication, the payee or the payee’s

payment service provider shall refund the financial loss caused to the payer’s payment

service provider.

4. Where the payee’s payment service provider applies an exemption from the application of

strong customer authentication, the payee’s payment service provider shall be liable to the

payer’s payment service provider for any financial loss incurred by the latter.

5. The payer shall not bear any financial consequences resulting from use of the lost, stolen or

misappropriated payment instrument after notification in accordance with Article 53, first

paragraph, point (b), except where the payer has acted fraudulently.

8543/1/26 REV 1 268

EN

If the payment service provider does not provide appropriate means for the notification at

all times of a lost, stolen or misappropriated payment instrument, as required under

Article 54(1), first subparagraph, point (c), the payer shall not be liable for the financial

consequences resulting from use of that payment instrument, except where the payer has

acted fraudulently.

6. The Commission is empowered to adopt a delegated act in accordance with Article 115 to

amend this Regulation by updating the amount referred to in paragraph 1 of this Article.

Article 64

Payment transactions where the transaction amount is not known in advance

1. Where a payment transaction is initiated by or through the payee, in particular in the

context of a card-based payment or of a credit transfer, and the exact future amount is not

known at the moment when the payer authorises the execution of the payment transaction,

the payer’s payment service provider may only block funds on the payer’s payment

account if the payer has given consent to the precise amount of funds to be blocked.

2. The amount of funds blocked by the payer’s payment service provider pursuant to

paragraph 1 shall be proportionate to the amount of the payment transaction which can

reasonably be expected by the payer.

3. The payee shall inform its payment service provider of the exact amount of the payment

transaction immediately after delivery of the service or goods to the payer.

8543/1/26 REV 1 269

EN

4. The payer’s payment service provider shall release the funds blocked on the payer’s

payment account pursuant to paragraph 1 immediately after receipt of the information

about the exact amount of the payment transaction.

Article 65

Refunds for payment transactions initiated by or through a payee

1. A payer shall be entitled to a refund from the payment service provider of an authorised

payment transaction which was initiated by or through a payee and which has already been

executed, where both of the following conditions are met:

(a) the authorisation did not specify the exact amount of the payment transaction when

the authorisation was made;

(b) the amount of the payment transaction exceeded the amount the payer could

reasonably have expected taking into account the previous spending pattern, the

conditions in the framework contract and relevant circumstances of the case.

At the payment service provider’s request, the payer shall bear the burden of proving such

conditions are met.

The refund shall consist of the full amount of the executed payment transaction. The credit

value date for the payer’s payment account shall be no later than the date the amount was

debited.

8543/1/26 REV 1 270

EN

Without prejudice to paragraph 3 of this Article, in addition to the right referred to in the

first subparagraph of this paragraph, for direct debits, the payer shall have an unconditional

right to a refund within the time limits laid down in Article 66.

2. For the purposes of paragraph 1, first subparagraph, point (b), of this Article the payer shall

not rely on reasons related to possible currency exchange costs if the reference exchange

rate agreed with its payment service provider in accordance with Article 13(1), first

subparagraph, point (e), and Article 20(3), first subparagraph, point (c), was applied.

3. The payer and the payment service provider may agree in a framework contract that the

payer has no right to a refund where:

(a) the payer has authorised the execution of the payment transaction directly with the

payment service provider;

(b) where applicable, information on the future payment transaction was provided or

made available in an agreed manner to the payer for at least four weeks before the

due date by the payment service provider or by the payee.

4. For direct debits in currencies other than euro, payment service providers may offer more

favourable refund rights in accordance with their direct debit schemes provided that they

are more advantageous to the payer.

8543/1/26 REV 1 271

EN

Article 66

Requests for refunds for payment transactions initiated by or through a payee

1. The payer may request the refund referred to in Article 65 of an authorised payment

transaction initiated by or through a payee for a period of eight weeks from the date on

which the funds were debited.

2. Within 15 business days of receiving a request for a refund, the payment service provider

shall do either of the following:

(a) refund the full amount of the payment transaction;

(b) provide a justification for refusing the refund and indicate the bodies to which the

payer may refer the matter in accordance with Articles 100, 101, 103, 104 and 105 if

the payer does not accept the reasons provided.

The payment service provider’s right under the first subparagraph of this paragraph to

refuse the refund shall not apply in the case of direct debits.

8543/1/26 REV 1 272

EN

Chapter 5

Execution of payment transactions

SECTION 1

PAYMENT ORDERS AND AMOUNTS TRANSFERRED

Article 67

Receipt of payment orders

1. The time of receipt of a payment order shall be when the payment order is received by the

payer’s payment service provider.

The payer’s account shall not be debited before receipt of the payment order. If the time of

receipt is not on a business day for the payer’s payment service provider, the payment

order shall be deemed to have been received on the following business day. The payment

service provider may establish a cut-off time near the end of a business day beyond which

any payment order received shall be deemed to have been received on the following

business day.

8543/1/26 REV 1 273

EN

2. If the payment service user placing a payment order and the payment service provider

agree that the execution of the payment order shall start on a specific day or at the end of a

certain period or on the day on which the payer has put the funds at the payment service

provider’s disposal, the time of receipt for the purposes of Article 73 shall be deemed to be

the agreed day. If the agreed day is not a business day for the payment service provider, the

payment order received shall be deemed to have been received on the following business

day.

3. This Article shall not apply to instant credit transfers denominated in euro that fall within

the scope of Regulation (EU) No 260/2012.

Article 68

Refusal by the payer’s payment service provider to execute a payment transaction

1. Subject to paragraph 2 and unless relevant Union or national law provides otherwise,

where all of the conditions set out in the payer’s framework contract are met, the payer’s

payment service provider shall not refuse to execute an authorised payment transaction,

irrespective of whether the payment order is placed by a payer, including through a

payment initiation service provider, or by or through a payee.

8543/1/26 REV 1 274

EN

2. Without prejudice to Regulation (EU) 2024/1624, the payer’s payment service provider

shall refuse to execute a payment transaction in the circumstances set out in this paragraph.

Notwithstanding Article 5c(5) of Regulation (EU) No 260/2012 and Article 51 and

Article 73(1) of this Regulation, where, based on the transaction monitoring referred to in

Article 87 of this Regulation or on any other relevant information available to the payment

service provider, but not solely on the basis of the outcome of the service ensuring the

verification of the payee, the payer’s payment service provider has objectively justified

reasons to suspect that a payment transaction is fraudulent, the payer’s payment service

provider shall suspend the execution of a payment transaction.

Where the payer’s payment service provider has objectively justified reasons to suspect

that the payment transaction is fraudulent and does not suspend the execution of the

payment transaction in accordance with this Article, the payer shall not bear any financial

losses, except if the payer has acted fraudulently.

The burden of proving that there was no breach of this Article shall be on the payment

service provider.

8543/1/26 REV 1 275

EN

Without undue delay following the suspension of the execution of the payment transaction,

unless prohibited by other relevant Union or national law, the payment service provider

shall notify the payer, in an agreed manner, of any information or action needed from the

payer to enable the payment service provider to assess, whether the reasons for such

suspension are still justified. The notification shall give the payer sufficient information to

enable the payer to understand the risks that the payment service provider has identified.

Within the timelines specified in Article 73(1), the payment service provider shall make all

reasonable efforts to contact the payer, and shall ensure that appropriate means are

available at all times to enable the payer to contact the payment service provider where

additional information is requested by the payment service provider to assess whether there

are objectively justified reasons to suspect fraud.

If, on the basis of the assessment referred to in the fifth subparagraph, there are still

objectively justified reasons to suspect fraud, the payer’s payment service provider shall

refuse to execute the payment transaction and, where applicable, restore the debited

payment account to the state in which it would have been had the payment order not been

submitted.

8543/1/26 REV 1 276

EN

The obligation to notify the payer under the fifth subparagraph shall not apply in the case

of instant credit transfers. In such cases or where it has not been possible for the payer’s

payment service provider to receive information from the payer within the timelines

specified in Article 73(1), the payment service provider shall assess, based on the

transaction monitoring referred to in Article 87, and on any other relevant information

available to the payment service provider, but not solely on the basis of the outcome of the

service ensuring the verification of the payee, whether there are objectively justified

reasons to suspect fraud, in which case it shall refuse to execute the payment transaction.

3. Where, on the basis of the assessment in paragraph 2, the payment service provider refuses

to execute a payment transaction, the payer’s payment service provider shall notify to the

payer and the payee’s payment service provider and, where applicable, make available to

the payment initiation service provider, the refusal, the specific reasons for that refusal and,

where applicable, the procedure for correcting the decision to refuse to execute the

transaction, unless such notification is prohibited under relevant Union or national law.

The payer’s payment service provider shall make the notification in an agreed manner,

and, where applicable, shall make the information available to the payment initiation

service provider without undue delay and in any case within the periods specified in

Article 73. In the case of instant credit transfers, the payer’s payment service provider shall

provide the notification, and where applicable shall make the information available to the

payment initiation service provider, within 10 seconds of the time of receipt of the

payment order by the payer’s payment service provider.

8543/1/26 REV 1 277

EN

The framework contract may provide for the possibility for the payment service provider to

charge a reasonable fee for a refusal to execute a payment transaction if such refusal is

objectively justified, but not in the case of a refusal due to a suspected fraudulent

transaction.

4. For the purposes of this Article, the fact that a payment order is unusual shall not by itself

constitute objectively justified reasons to suspect fraud.

5. For the purposes of Articles 73 and 79, a payment order for a payment transaction whose

execution has been refused shall be deemed not to have been received.

Article 69

Irrevocability of payment orders

1. A payment service user shall not revoke a payment order once it has been received by the

payer’s payment service provider, unless otherwise specified in this Article.

2. Where the payment transaction is initiated by a payment initiation service provider or by or

through the payee, the payer shall not revoke the payment order after giving consent to the

payment initiation service provider to initiate the payment transaction or after giving

consent to execute the payment transaction to the payee.

3. In the case of a direct debit, and without prejudice to refund rights, the payer may revoke

the payment order at the latest by the end of the business day preceding the day agreed for

debiting the funds.

8543/1/26 REV 1 278

EN

4. In the circumstances referred to in Article 67(2), the payment service user may revoke a

payment order at the latest by the end of the business day preceding the agreed day.

5. After the time limits laid down in paragraphs 1 to 4, the payment order may be revoked

only if agreed between the payment service user and the relevant payment service

providers. In the case referred to in paragraphs 2 and 3, the payee’s agreement shall also be

required. If agreed in the framework contract, the relevant payment service provider may

charge for revocation.

Article 70

Amounts transferred and amounts received

1. The payer’s payment service provider, the payee’s payment service provider and any

intermediaries of the payment service providers shall transfer the full amount of the

payment transaction and shall refrain from deducting charges from the amount transferred.

2. The payee and the payment service provider may agree that the relevant payment service

provider deduct its charges from the amount transferred before crediting it to the payee. In

such a case, the full amount of the payment transaction and charges shall be separated in

the information given to the payee.

3. If any charges other than those referred to in paragraph 2 are deducted from the amount

transferred, the payer’s payment service provider shall ensure that the payee receives the

full amount of the payment transaction initiated by the payer. Where the payment

transaction is initiated by or through the payee, the payee’s payment service provider shall

ensure that the full amount of the payment transaction is received by the payee.

8543/1/26 REV 1 279

EN

Article 71

Payment transactions with electronic money tokens

1. By way of derogation from Article 13(1), first subparagraph, points (b) and (d),

Article 20(2), point (e), Article 20(3), first subparagraph, point (a) and Article 24, where

payment service providers are unable, due to circumstances that are not attributable to

them, to comply with the obligations set out therein as regards payment transactions with

electronic money tokens settled on the distributed ledger, the payment service providers

shall provide the information referred to in those Articles by way of a reasoned estimation,

as soon as possible, and in any case prior to the authorisation of the payment transaction by

the payer.

2. The requirements in Articles 41 and 42 for account servicing payment service providers

regarding payment initiation services and account information services, shall not apply as

regards payment transactions with electronic money tokens.

3. Articles 51 and 58 shall not apply to payment service providers as regards payment

transactions with electronic money tokens.

4. The Commission is empowered to adopt delegated acts in accordance with Article 115 to

amend this Regulation by adjusting the derogations and requirements set out in

paragraphs 1, 2 and 3 of this Article as regards payment transactions with electronic money

tokens to take into account developments after the adoption of this Regulation and the

specificities of the use of distributed ledger technology or similar technology for such

transactions.

8543/1/26 REV 1 280

EN

SECTION 2

EXECUTION TIME AND VALUE DATE

Article 72

Scope

1. This Section applies to:

(a) payment transactions in euro;

(b) national payment transactions in currencies of Member States whose currency is not

the euro;

(c) payment transactions involving only one currency conversion between the euro and

the currency of a Member State whose currency is not the euro, provided that the

required currency conversion is carried out in the Member State concerned whose

currency is not the euro and, in the case of cross-border payment transactions, the

cross-border transfer takes place in euro.

8543/1/26 REV 1 281

EN

2. This Section applies to payment transactions not referred to in paragraph 1 of this Article,

unless otherwise agreed between the payment service user and the payment service

provider, with the exception of Article 77, which is not at the disposal of the parties.

However, if the payment service user and the payment service provider agree on a longer

period than that set in Article 73, for intra-Union payment transactions, that longer period

shall not exceed five business days following the time of receipt as referred to in

Article 67.

Article 73

Payment transactions to a payment account

1. Without prejudice to relevant Union or national law in the field of anti-money laundering

and countering the financing of terrorism, the payer’s payment service provider shall

ensure that after the time of receipt as referred to in Article 67, the amount of the payment

transaction will be credited to the payee’s payment service provider’s account by the end

of the following business day. That time limit may be extended by a further business day

for paper-initiated payment transactions.

2. Without prejudice to relevant Union or national law in the field of anti-money laundering

and countering the financing of terrorism, the payee’s payment service provider shall value

date and make available the amount of the payment transaction to the payee’s payment

account after the payment service provider has received the funds in accordance with

Article 77.

8543/1/26 REV 1 282

EN

3. By way of derogation from paragraph 2 of this Article, if, based on the transaction

monitoring conducted in accordance with Article 87, or on any relevant information

available to the payee’s payment service provider, but not solely on the outcome of the

service ensuring the verification of the payee, the payee’s payment service provider has

objectively justified reasons to suspect that a payment transaction credited or to be credited

to its account is fraudulent, that payment service provider may, in compliance with its

obligation to refrain from carrying out suspicious transactions under Article 71 of

Regulation (EU) 2024/1624, decide to not make the funds available on the payee’s

payment account and return the funds to the payer’s payment service provider, provided

that that decision takes place within the timeline set out in Article 77 of this Regulation.

Where the reasons to suspect that a payment transaction credited or to be credited to the

payee’s account is fraudulent are clear and incontrovertible, the payee’s payment service

provider shall not make the funds available on the payee’s payment account and shall

return the funds to the payer’s payment service provider.

Where the payee’s payment service provider does not comply with the obligation set out in

the second subparagraph, the payer shall not bear any financial losses, except if the payer

has acted fraudulently.

The first and second subparagraphs of this paragraph shall be without prejudice to the

obligation of the payee’s payment service provider to report suspicious transactions set out

in Article 69 of Regulation (EU) 2024/1624.

8543/1/26 REV 1 283

EN

For the purposes of this Article, the fact that a payment transaction is unusual shall not by

itself constitute objectively justified reasons to suspect fraud.

The burden of proving that there was no breach of the second subparagraph shall be on the

payee’s payment service provider.

4. Where the payee’s payment service provider returns the funds to the payer’s payment

service provider pursuant to paragraph 3, first or second subparagraph, the payee’s

payment service provider shall:

(a) immediately notify the payer’s payment service provider of the return of the funds,

and of the reasons for the refusal to make the funds available on the payee’s payment

account, in accordance with the rules on prohibition of disclosure set out in

Article 73(5) of Regulation (EU) 2024/1624; and

(b) ensure that the amount of the payment transaction is credited to the payer’s payment

service provider within the timeline set out in paragraph 1 of this Article.

8543/1/26 REV 1 284

EN

5. Upon receiving the notification pursuant to paragraph 4, point (a), of this Article the

payer’s payment service provider shall, immediately and free of charge, inform the payer,

and, where applicable, make the information available to the payment initiation service

provider, that the funds have not been made available on the payee’s payment account due

to measures aimed at fraud prevention, without prejudice to Article 73 of Regulation

(EU) 2024/1624. The payer’s payment service provider shall also inform the payer of the

return of the funds and the timeline for making the amount of the payment transaction

available on the payer’s payment account. The payer’s payment service provider shall

value date and make available the amount of the payment transaction credited to its

account pursuant to paragraph 4, point (b), of this Article to the payer’s payment account

in accordance with Article 77 of this Regulation.

6. In the case of an instant credit transfer, where the payee’s payment service provider returns

the funds to the payer’s payment service provider pursuant to paragraph 3, first or second

subparagraph, the payee’s payment service provider shall:

(a) within 10 seconds of the time of receipt of the payment order for an instant credit

transfer by the payer’s payment service provider, notify the payer’s payment service

provider of the return of the funds and of the reasons for the refusal to make the

funds available on the payee’s payment account, in accordance with the rules on

prohibition of disclosure set out in Article 73(5) of Regulation (EU) 2024/1624; and

(b) where the amount of the transaction has been credited to its account, ensure that

those funds are credited immediately to the payer’s payment service provider.

8543/1/26 REV 1 285

EN

7. Immediately upon receiving the notification referred to in paragraph 6, point (a), the

payer’s payment service provider shall:

(a) restore the payment account of the payer to the state in which it would have been had

the transaction not taken place; and

(b) free of charge, inform the payer, and, where applicable, make the information

available to the payment initiation service provider, of the return of the funds, and,

without prejudice to Article 73 of Regulation (EU) 2024/1624, that the funds have

not been made available on the payee’s payment account due to measures aimed at

fraud prevention.

8. The payee’s payment service provider shall transmit a payment order placed by or through

the payee to the payer’s payment service provider within the time limits agreed between

the payee and the payment service provider, enabling settlement on the agreed due date.

Paragraph 3 shall apply accordingly.

Article 74

Absence of payee’s payment account with the payment service provider

Where the payee does not have a payment account with the payment service provider, the payment

service provider who receives the funds for the payee shall make the funds available to the payee

within the time limit laid down in Article 73(1).

8543/1/26 REV 1 286

EN

In the case of payment transactions with electronic money tokens from a custodial wallet to a self-

hosted address, the payer’s payment service provider shall transfer the funds to the self-hosted

address of the payee within the time limit laid down in Article 73(1).

Article 75

Cash placed on a payment account

Where a consumer places cash on a payment account with that payment service provider in the

currency of that payment account, the payment service provider shall ensure that the amount is

made available and value dated immediately after receipt of the funds. Where the payment service

user is not a consumer, the amount shall be made available and value dated at the latest on the

following business day after receipt of the funds.

Article 76

National payment transactions

For national payment transactions, Member States may provide for shorter maximum execution

times than those provided for in this Section.

By … [21 months from the date of entry into force of this Regulation], Member States shall notify

to the Commission the provisions of the law they adopt pursuant to the first subparagraph. They

shall notify the Commission without undue delay of any subsequent amendments thereto and of any

provisions of the law which they adopt pursuant to the first subparagraph at a later date.

8543/1/26 REV 1 287

EN

Article 77

Value date and availability of funds

1. The credit value date for the payee’s payment account shall be no later than the business

day on which the amount of the payment transaction is credited to the payee’s payment

service provider’s account.

2. The payee’s payment service provider shall ensure that the amount of the payment

transaction is at the payee’s disposal immediately after that amount is credited to the

payee’s payment service provider’s account where, on the part of the payee’s payment

service provider, either of the following applies:

(a) no currency conversion takes place;

(b) a currency conversion takes place between the euro and a Member State currency or

between two Member State currencies.

The obligation laid down in this paragraph shall also apply to payments within one

payment service provider.

3. The debit value date for the payer’s payment account shall be no earlier than the time at

which the amount of the payment transaction is debited to that payment account.

8543/1/26 REV 1 288

EN

Article 78

Incorrect unique identifiers

1. If a payment transaction is executed in accordance with the unique identifier, the payment

transaction shall be deemed to have been executed correctly with regard to the payee

specified by the unique identifier.

2. If the unique identifier provided by the payment service user is incorrect, the payment

service provider shall not be liable under Article 79 for non-execution or defective

execution of the payment transaction.

However, the payer’s payment service provider shall make reasonable efforts to recover

the funds involved in the payment transaction. The payee’s payment service provider shall

cooperate in those efforts also by communicating to the payer’s payment service provider

all relevant information for the collection of funds.

Where the collection of funds under the second subparagraph is not possible, the payer’s

payment service provider shall provide to the payer, upon written request, all information

available to the payer’s payment service provider and relevant to the payer in order for the

payer to file a legal claim to recover the funds.

3. Where agreed in the framework contract, the payment service provider may charge the

payment service user for recovery. Such charge shall be reasonable and proportionate to

the costs incurred.

8543/1/26 REV 1 289

EN

4. If the payment service user provides information in addition to the information referred to

in Article 13(1), point (a), or Article 20(2), point (b), the payment service provider shall be

liable only for the execution of payment transactions in accordance with the unique

identifier provided by the payment service user.

5. Where the unique identifier provided by the payment initiation service provider is

incorrect, payment service providers shall be liable in accordance with Article 80.

Article 79

Payment service providers’ liability for non-execution, defective

or late execution of payment transactions

1. Where a payment order is placed directly by the payer, the payer’s payment service

provider shall, without prejudice to Article 55, Article 78(2), and Article 83, be liable to

the payer for correct execution of the payment transaction, unless it can prove to the payer

and, where relevant, to the payee’s payment service provider that the payee’s payment

service provider received the amount of the payment transaction in accordance with

Article 73(1). In that case, the payee’s payment service provider shall be liable to the payee

for the correct execution of the payment transaction.

Where the payer’s payment service provider is liable under the first subparagraph, it shall

immediately refund to the payer the amount of the non-executed or defective payment

transaction, and, where applicable, restore the debited payment account to the state in

which it would have been had the defective payment transaction not taken place.

8543/1/26 REV 1 290

EN

The credit value date for the payer’s payment account shall be no later than the date on

which the amount was debited.

Where the payee’s payment service provider is liable under the first subparagraph, it shall

immediately place the amount of the payment transaction at the payee’s disposal and,

where applicable, credit the corresponding amount to the payee’s payment account.

The credit value date for the payee’s payment account shall be no later than the date on

which the amount would have been value dated, had the transaction been correctly

executed in accordance with Article 77.

Where a payment transaction is executed late, the payee’s payment service provider shall

ensure, upon the request of the payer’s payment service provider acting on behalf of the

payer, that the credit value date for the payee’s payment account is no later than the date

the amount would have been value dated had the transaction been correctly executed.

In the case of a non-executed or defectively executed payment transaction where the

payment order is placed by the payer, the payer’s payment service provider shall,

regardless of liability under this paragraph, on request and without charging the payer,

make immediate efforts to trace the payment transaction and notify the payer of the

outcome.

8543/1/26 REV 1 291

EN

2. Where a payment order is placed by or through the payee, the payee’s payment service

provider shall, without prejudice to Article 55, Article 78(2), and Article 83, be liable to

the payee for correct transmission of the payment order to the payer’s payment service

provider in accordance with Article 73(8). Where the payee’s payment service provider is

liable under this subparagraph, it shall immediately re-transmit the payment order in

question to the payer’s payment service provider.

In the case of a late transmission of the payment order, the amount shall be value dated on

the payee’s payment account no later than the date the amount would have been value

dated had the transaction been correctly executed.

Without prejudice to Article 55, Article 78(2), and Article 83, the payee’s payment service

provider shall be liable to the payee for handling the payment transaction in accordance

with its obligations under Article 77. Where the payee’s payment service provider is liable

under this subparagraph, it shall ensure that the amount of the payment transaction is at the

payee’s disposal immediately after that amount is credited to the payee’s payment service

provider’s account. The amount shall be value dated on the payee’s payment account no

later than the date the amount would have been value dated had the transaction been

correctly executed.

8543/1/26 REV 1 292

EN

In the case of a non-executed or defectively executed payment transaction for which the

payee’s payment service provider is not liable under the first and third subparagraphs, the

payer’s payment service provider shall be liable to the payer. Where the payer’s payment

service provider is so liable it shall, as appropriate and without undue delay, refund to the

payer the amount of the non-executed or defective payment transaction and restore the

debited payment account to the state in which it would have been had the defective

payment transaction not taken place. The credit value date for the payer’s payment account

shall be no later than the date the amount was debited.

The obligation under the fourth subparagraph shall not apply to the payer’s payment

service provider where the payer’s payment service provider proves that the payee’s

payment service provider has received the amount of the payment transaction, even if

execution of payment transaction is merely delayed. If so, the payee’s payment service

provider shall value date t the amount on the payee’s payment account no later than the

date the amount would have been value dated had it been executed correctly.

In the case of a non-executed or defectively executed payment transaction where the

payment order is placed by or through the payee, the payee’s payment service provider

shall, regardless of liability under this paragraph, on request and without charging the

payer, make immediate efforts to trace the payment transaction and notify the payee of the

outcome.

8543/1/26 REV 1 293

EN

3. Payment service providers shall be liable to their respective payment service users for any

charges for which they are responsible, and for any interest to which the payment service

user is subject as a consequence of non-execution or defective, including late, execution of

the payment transaction.

Article 80

Liability in the case of payment initiation services for non-execution, defective

or late execution of payment transactions

1. Where a payment order is placed by the payer or by the payee through a payment initiation

service provider, the account servicing payment service provider shall, without prejudice to

Article 55 and Article 78(2), refund to the payer the amount of the non-executed or

defective payment transaction and, where applicable, restore the debited payment account

to the state in which it would have been had the defective payment transaction not taken

place.

The burden shall be on the payment initiation service provider to prove that the payment

order was received by the payer’s account servicing payment service provider in

accordance with Article 67 and that within its sphere of competence the payment

transaction was authenticated, accurately recorded and not affected by a technical

breakdown or other deficiency linked to the non-execution, defective or late execution of

the transaction.

8543/1/26 REV 1 294

EN

2. If the payment initiation service provider is liable for the non-execution, defective or late

execution of the payment transaction, it shall immediately compensate the account

servicing payment service provider at its request for the losses incurred or sums paid as a

result of the refund to the payer.

Article 81

Additional financial compensation

Any financial compensation additional to that provided for under this Section may be determined in

accordance with the law applicable to the contract concluded between the payment service user and

the payment service provider.

Article 82

Right of recourse

1. Where the liability of a payment service provider under Articles 57, 58, 60, 68(2), 73(3),

79, 80 and 87 is attributable to another payment service provider or to an intermediary, that

payment service provider or intermediary shall compensate the first payment service

provider for any losses incurred or sums paid under Articles 57, 58, 60, 68(2), 73(3), 79, 80

and 87. That shall include compensation where any of the payment service providers fail to

apply strong customer authentication.

8543/1/26 REV 1 295

EN

2. Where a provider of hosting services does not meet the conditions set out in Article 6(1),

points (a) and (b), of Regulation (EU) 2022/2065, in respect of the storage of illegal

content within the meaning of Article 3, point (h), of that Regulation and where such

content gives rise to one or a series of unauthorised payment transactions as referred to in

Article 57 of this Regulation, or to one or a series of fraudulent authorised payment

transactions as referred to in Article 60 of this Regulation, that provider shall compensate

the payment service provider for any losses incurred or sums paid under Articles 57 and 60

of this Regulation.

3. Further financial compensation may be determined in accordance with agreements between

payment service providers or intermediaries and the law applicable to the agreement

concluded between them.

Article 83

Abnormal and unforeseeable circumstances

No liability shall arise under Chapter 4 or this Chapter in cases of abnormal and unforeseeable

circumstances beyond the control of the party pleading for the application of those circumstances,

the consequences of which would have been unavoidable despite all efforts to the contrary, or

where a payment service provider is bound by other legal obligations covered by Union or national

law.

8543/1/26 REV 1 296

EN

Chapter 6

Data protection

Article 84

Data protection

Payment systems, payment schemes, processing entities and payment service providers shall be

allowed to process the special categories of personal data referred to in Article 9(1) of Regulation

(EU) 2016/679 and Article 10(1) of Regulation (EU) 2018/1725 to the extent necessary for the

provision of payment services and for compliance with obligations under this Regulation, in the

public interest of a well-functioning internal market for payment services, subject to appropriate

safeguards for the fundamental rights and freedoms of natural persons, including the following:

(a) technical measures to ensure compliance with the principles of purpose limitation, data

minimisation and storage limitation, as laid down in Regulation (EU) 2016/679, including

technical limitations on the re-use of data and the use of state-of-the-art security and

privacy-preserving measures, including pseudonymisation, or encryption;

(b) organisational measures, including training on the processing of special categories of data,

limiting access to special categories of data and recording such access.

8543/1/26 REV 1 297

EN

Chapter 7

Operational and security risks and authentication

Article 85

Management of operational and security risks

1. Payment service providers shall establish a framework with appropriate mitigation

measures and control mechanisms to manage operational and security risks relating to the

payment services they provide. As part of that framework, payment service providers shall

establish and maintain effective incident management procedures, including for the

detection and classification of major operational and security incidents.

The first subparagraph shall be without prejudice to the application of Chapter II of

Regulation (EU) 2022/2554 to:

(a) payment service providers referred to in Article 2(1), points (a), (b) and (d), of this

Regulation;

(b) account information service providers referred to in Article 35(1) of Directive

(EU) 2026/…+; and

(c) payment institutions exempted pursuant to Article 33(1) of Directive (EU) 2026/…+.

+ OJ: please insert the number of the Directive contained in document ST 8535/26

(2023/0209 (COD)).

8543/1/26 REV 1 298

EN

2. EBA shall promote cooperation, including the sharing of information, in the area of

operational and security risks associated with payment services among the competent

authorities, between the competent authorities and the ECB and, where relevant, ENISA

(the European Union Agency for Cybersecurity).

Article 86

Fraud reporting

1. Payment service providers shall provide their competent authorities, on at least an annual

basis, with statistical data on fraud relating to different means of payment. Those

competent authorities shall provide EBA and the ECB with such data in an aggregated

form.

Statistical data on fraud shall include the number and value of refunded fraudulent

payment transactions and of payment transactions where a refund has been refused in

accordance with this Regulation, together with the reason for that refusal, such as stating

that the consumer has acted fraudulently or with gross negligence.

2. Competent authorities may allow payment service providers to fulfil the obligation in

paragraph 1 by reporting fraud data under another data reporting requirement, if that

requirement is not less extensive than the reporting requirement under this Article and if

arrangements have been made under which EBA and the ECB will receive the data that is

due under this Article.

8543/1/26 REV 1 299

EN

3. EBA and the ECB shall publish in an annual joint report the statistical data in aggregated

form and an analysis of the trends observed on the basis of those data.

4. EBA shall, in close cooperation with the ECB, develop draft regulatory technical standards

specifying the statistical data on fraud to be provided in accordance with paragraph 1.

EBA shall submit the draft regulatory technical standards referred to in the first

subparagraph to the Commission by … [12 months from the date of entry into force of this

Regulation].

Power is delegated to the Commission to adopt those regulatory technical standards in

accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

5. EBA shall develop draft implementing technical standards establishing the standard forms

and templates for the submission of the payment fraud data by competent authorities to

EBA, as referred to in paragraph 1. Those implementing technical standards shall not be

applicable if the competent authority makes use of the option referred to in paragraph 2.

EBA shall submit the implementing technical standards referred to in the first

subparagraph to the Commission by … [12 months from the date of entry into force of this

Regulation].

Power is conferred on the Commission to adopt those implementing technical standards in

accordance with Article 15 of Regulation (EU) No 1093/2010.

8543/1/26 REV 1 300

EN

Article 87

Transaction monitoring mechanisms

1. Payment service providers shall have transaction monitoring mechanisms in place to:

(a) support the application of strong customer authentication in accordance with

Article 91;

(b) exempt the application of strong customer authentication based on the criteria set out

in Article 91(9), subject to specified and limited conditions based on the level of risk

involved, the types and details of the data assessed by the payment service provider;

(c) prevent and detect potentially fraudulent payment transactions, including transactions

involving payment initiation services.

The transaction monitoring mechanisms shall be based on the analysis of previous payment

transactions and access to payment accounts online.

2. Payment service providers shall ensure that their transaction monitoring mechanisms take

into account, at a minimum, each of the following risk-based factors:

(a) lists of compromised or stolen authentication elements;

(b) the amount of each payment transaction;

(c) known fraud scenarios in the provision of payment services;

8543/1/26 REV 1 301

EN

(d) signs of malware infection in any sessions of the authentication procedure;

(e) in cases where the access device or the software is provided by the payment service

provider, a log of the use of the access device or the software provided to the

payment service user and the abnormal use of the access device or the software.

3. The payer’s payment service provider shall carry out the transaction monitoring provided

for in paragraph 1 prior to the execution of a payment transaction.

The payee’s payment service provider shall carry out the transaction monitoring provided

for in paragraph 1 of this Article before the funds are made available to the payee in

accordance with Article 73(2).

Where a payment service provider does not carry out the transaction monitoring in

accordance with this Article with respect to a transaction and the payer incurs financial

damage, that payment service provider shall be liable to the payer for that financial

damage.

Where the payer’s payment service provider does not provide evidence to the payer that

the transaction monitoring has been carried out by both providers, it shall refund the payer

the amount of the transaction.

The payer shall not bear any financial consequences from that transaction, except where

the payer has acted fraudulently.

The burden of proving that there was no breach of this paragraph shall lie with the payment

service provider concerned.

8543/1/26 REV 1 302

EN

4. Processing by the payer’s payment service provider shall be limited to the following data,

in so far as that is necessary to achieve the purposes referred to in paragraph 1:

(a) information on the payer, including the environmental and behavioural

characteristics which are typical of the payer in the circumstances of a normal use of

the personalised security credentials;

(b) information on the payment account, including the payment transaction history;

(c) transaction information, including the transaction amount, payment instrument,

currency, date and time of execution, as well as the unique identifier of the payee;

(d) session data, including the internet protocol address-range of the device from which

the payment account was accessed and from which the transaction was initiated;

(e) device data, including identifiers of the device from which the transaction was

initiated;

(f) information on the payee, including the unique identifier of the payee;

(g) information received through the information sharing arrangements.

5. Processing by the payee’s payment service provider shall be limited to the following data,

in so far as that is necessary to achieve the purposes referred to in paragraph 1:

(a) information on the payee;

(b) information received through the information sharing arrangements;

8543/1/26 REV 1 303

EN

(c) information on the payment account of the payee, including the payment transaction

history;

(d) transaction information, including the transaction amount, payment instrument,

currency, date and time of execution, as well as the name of the payer.

6. Payment service providers shall not store data referred to in paragraphs 4 and 5 longer than

necessary for the purposes referred to in paragraph 1, and, in any event, no longer than five

years after the termination of the customer relationship.

Article 88

Fraud information sharing

1. Payment service providers shall participate in information sharing arrangements with other

payment service providers as referred to in paragraph 4 and shall exchange data to the

extent necessary to comply with their obligations in Article 87(1), first subparagraph,

point (c), of this Regulation where the payment service provider has objectively justified

reasons to suspect fraudulent behaviour by a payment service user. The categories of data

to be shared shall be limited to the data listed in Article 87(4), points (a) to (f), and (5),

points (a), (c) and (d) of this Regulation, to the payment service provider’s objectively

justified reasons that gave rise to the suspicion of fraudulent behaviour on basis of that

data, and to notifications made by the payment service provider to a provider of hosting

services in accordance with Article 16 of Regulation (EU) 2022/2065. Information on the

environmental and behavioural characteristics which are typical of the payer in the

circumstances of a normal use of the personalised security credentials shall be excluded

from information sharing under this Article.

8543/1/26 REV 1 304

EN

2. Payment service providers shall implement appropriate technical and organisational

measures, including measures to allow pseudonymisation, to ensure a level of security and

confidentiality proportionate to the nature and extent of the information exchanged.

3. Payment service providers shall not store data obtained following the information

exchange referred to in paragraph 1 of this Article longer than necessary for the purposes

laid down in Article 87(1), first subparagraph, point (c), and, in any event, no longer than

five years after the suspected fraudulent transaction has taken place.

4. The information sharing arrangements shall specify the details of participation and the

details of operational elements, including the use of dedicated IT platforms. Before

concluding such arrangements, payment service providers shall jointly carry out a data

protection impact assessment in accordance with Article 35 of Regulation (EU) 2016/679

and, where applicable, prior consultation of the supervisory authority in accordance with

Article 36 of that Regulation.

5. Payment service providers shall not draw conclusions or take decisions that have an impact

on a business relationship with the payment service user, such as terminating the

contractual relationship with the user or affecting their future onboarding, solely on the

basis of information received from other payment service providers who are subject to an

information sharing arrangement without having assessed that information.

8543/1/26 REV 1 305

EN

Article 89

Platform on combatting fraud

1. The Commission shall establish a platform on combatting fraud in the area of payment

services in the Union. The platform on combatting fraud shall be composed of a broad and

balanced mix of representatives and experts, from both the public and private sectors, who

have proven knowledge and experience in the field of payment services fraud.

2. The platform on combatting fraud shall:

(a) advise the Commission on developing and monitoring the implementation of legal

acts aimed at combatting fraud in the area of payment services;

(b) issue recommendations to the Commission and the European Board of Digital

Services for the purpose of the drawing up of the voluntary code of conduct referred

to in Article 61(5);

(c) share information on and analyse trends in fraud in the area of payment services;

(d) share information on measures to combat fraud in the area of payment services,

including mitigation measures;

(e) share information on ways to improve cross-border and cross-sectoral cooperation on

the means of combatting fraud in the area of payment services.

8543/1/26 REV 1 306

EN

3. The platform on combatting fraud shall be chaired by a representative of the Commission

and constituted in accordance with the horizontal rules on the creation and operation of

Commission expert groups.

4. The platform on combatting fraud shall report annually on its activities to the European

Parliament and the Council.

Article 90

Payment fraud risks and trends

1. Payment service providers shall alert their customers via all appropriate means and media

when new forms of payment fraud emerge, taking into account the needs of their most

vulnerable groups of customers. Payment service providers shall give their customers clear

guidance on how to identify attempted fraud and advise them of the necessary actions and

precautions to be taken to avoid falling victim of fraudulent activity targeting them.

Payment service providers shall inform their customers of where they can report fraudulent

activity and rapidly obtain fraud-related information.

2. Member States shall have in place adequate measures, with appropriate funding, to raise

awareness among the public about the trends and new forms of payment fraud, the

procedures to be followed in order to identify attempted fraud and the rights and

obligations conferred by this Regulation relating to fraud. The communication measures

shall be sufficient and well-targeted, in particular reaching out to the most vulnerable

consumer groups, including younger and older persons and those with limited digital skills.

Member States shall inform the Commission of the measures taken.

8543/1/26 REV 1 307

EN

3. Payment service providers, providers of very large online platforms and of very large

online search engines and providers of interpersonal communications services shall

cooperate free of charge with the Member States in the measures referred to in

paragraph 2.

4. Payment service providers shall organise at least annually training programmes on

payment fraud risks and trends for their employees that are active in designing,

maintaining or offering payment services, and shall ensure that their employees are

properly trained to carry out their tasks and responsibilities in accordance with the relevant

security policies and procedures to mitigate and manage payment fraud risks.

Article 91

Strong customer authentication

1. A payment service provider shall apply strong customer authentication where the payer:

(a) accesses its payment account online;

(b) places a payment order for an electronic payment transaction;

(c) carries out any other action through a remote channel which might imply a risk of

payment fraud or other abuses, including ordering the creation or replacement of a

tokenised payment instrument via a remote channel, increasing its spending limits

according to Article 52, changing its password online or changing its contact

information online.

8543/1/26 REV 1 308

EN

2. Payment transactions that are initiated by the payee shall not be subject to strong customer

authentication to the extent that those transactions are initiated without any interaction or

involvement of the payer. Refunds that are initiated by the original payee in favour of the

original payer against such transactions shall not be subject to strong customer

authentication.

3. Where the mandate of the payer to the payee to place payment orders for merchant-

initiated transactions is provided through a remote channel with the involvement of the

payment service provider, the setting up of such a mandate shall be subject to strong

customer authentication.

4. For direct debits, where the mandate given by the payer to the payee to initiate one or

several direct debit transactions is provided through a remote channel with the direct

involvement of the payer’s payment service provider, the setting up of such a mandate

shall be subject to strong customer authentication.

5. Mail order or telephone order transactions shall not be subject to strong customer

authentication, provided that security requirements and checks are carried out by the

payer’s payment service provider allowing a form of authentication of the payment

transaction.

6. For the remote placement of a payment order as referred to in paragraph 1, point (b),

payment service providers shall apply strong customer authentication that includes

elements which dynamically link the transaction to a specific amount and a specific payee.

8543/1/26 REV 1 309

EN

7. For the placement of a payment order as referred to in paragraph 1, point (b), through a

payer’s device using proximity technology for the exchange of information with the

payee’s infrastructure, the authentication of which requires the use of internet on the

payer’s device, payment service providers shall apply strong customer authentication that

includes elements which dynamically link the transaction to a specific amount and a

specific payee or harmonised security measures of identical effect, which ensure the

confidentiality, authenticity and integrity of the amount of the transaction and the payee

throughout all of the phases of initiation.

8. For the purposes of paragraph 1, payment service providers shall have in place adequate

security measures to protect the confidentiality and integrity of payment service users’

personalised security credentials.

9. Any exemptions from the application of strong customer authentication designed by EBA

under Article 97 shall be based on one or more of the following criteria:

(a) the level of fraud risk involved in the service provided, in particular based on the

transaction monitoring mechanism as set out in Article 87;

(b) the amount, the recurrence of the transaction, or both;

(c) the payment channel used for the execution of the transaction,

(d) whether or not the payer is a consumer.

8543/1/26 REV 1 310

EN

Exemptions from the application of strong customer authentication shall not be mandatory.

A payment service provider implementing an exemption always retains the right to decide

that under the circumstances and based on a risk assessment, strong customer

authentication is necessary.

10. The two or more elements referred to in Article 3, point (60), on which strong customer

authentication is based, shall belong to different categories.

By way of derogation from the first subparagraph of this paragraph, a payment service

provider may implement strong customer authentication using two elements only from the

category inherence if it demonstrates to the national competent authority that the

independence of the two elements is at all times fully preserved and the authentication

procedure ensures at all times a high level of security.

EBA shall develop guidelines by … [18 months from the date of entry into force of this

Regulation] in accordance with Article 16 of Regulation (EU) No 1093/2010 on how to

assess that the independence of the two inherence elements is fully preserved.

8543/1/26 REV 1 311

EN

Article 92

Strong customer authentication in respect of certain credit transfers

1. By way of derogation from Article 91(1), point (b), in the context of one or several

recurring credit transfers initiated by the payer’s payment service provider in accordance

with this Article, the obligation to apply strong customer authentication shall not apply

where all of the following conditions are met:

(a) the credit transfers are initiated by the payer’s payment service provider following a

request from the payee;

(b) the payee’s request is based on an agreement between the payer and the payee in

which the payment conditions regarding frequency and amounts to be paid are set

out, including whether the amounts can vary and the circumstances in which the

amounts can vary;

(c) the payer agrees that its payment service provider executes the respective credit

transfers in line with the agreement referred to in point (b) of this paragraph and the

setting up of such an agreement is subject to strong customer authentication;

(d) no additional action is required from the payer to initiate the respective credit

transfers.

2. Where paragraph 1 applies, Articles 64, 65 and 66 shall apply mutatis mutandis, with the

exception of Article 65(1), fourth subparagraph, and of Article 66(2), second

subparagraph.

8543/1/26 REV 1 312

EN

Article 93

Strong customer authentication in respect of payment initiation

and account information services

1. Article 91(6), (7) and (10) shall apply where payment transactions are initiated through a

payment initiation service provider. Article 91(8) shall also apply where payments are

initiated through a payment initiation service provider and when the information is

requested through an account information service provider.

2. Account servicing payment service providers shall allow payment initiation service

providers and account information service providers to rely on the authentication

procedures provided by the account servicing payment service provider to the payment

service user in accordance with Article 91(1) and (8) and, where the payment initiation

service provider is involved, in accordance with Article 91(1), (6), (7), (8) and (10).

3. Without prejudice to paragraph 2, where payment account data is accessed by an account

information service provider, the account servicing payment service provider shall only

apply strong customer authentication for the first access to payment account data by a

given account information service provider, but not for the subsequent access to that

payment account by that account information service provider unless the account servicing

payment service provider has reasonable grounds to suspect fraud.

8543/1/26 REV 1 313

EN

4. Account information service providers shall apply strong customer authentication when the

payment service user accesses the payment account data using that account information

service provider at least 180 days after strong customer authentication was last applied.

Account information service providers may apply their own or the account servicing

payment service provider’s strong customer authentication.

Article 94

Outsourcing agreements for the application of strong customer authentication

The payer’s payment service provider shall enter into an outsourcing agreement with the technical

service provider in cases where that technical service provider is providing and verifying the

elements of strong customer authentication.

Article 95

Accessibility requirements regarding strong customer authentication

1. Without prejudice to the accessibility requirements laid down in Directive (EU) 2019/882,

payment service providers shall ensure that their customers, including persons with

disabilities, older persons, persons with limited digital skills and those without access to

digital channels or payment instruments, have at their disposal at least one means, adapted

to their specific situation, which enables them to perform strong customer authentication

free of charge. In cases where the payment service user requests help or is in need of

assistance, the payment service provider shall ensure that support is provided. That

requirement shall not extend to providing devices to the payment service user. Payment

service providers shall ensure that payment service users are adequately informed about the

different means available to them to perform strong customer authentication.

8543/1/26 REV 1 314

EN

2. Payment service providers shall not make the performance of strong customer

authentication conditional on the exclusive use of a single means of authentication and

shall not make the performance of strong customer authentication conditional, explicitly or

implicitly, on the possession of a smartphone or another smart device, unless the payment

service user has agreed to the provision of services exclusively through mobile applications

on such a device. Payment service providers shall develop more than one means for the

application of strong customer authentication to cater for the specific situation of their

customers including those referred to in paragraph 1.

Article 96

Fair, reasonable and non-discriminatory access to mobile devices

1. Without prejudice to Article 6(7) of Regulation (EU) 2022/1925, original equipment

manufacturers of mobile devices and providers of electronic communications services shall

grant payment service providers and technical service providers acting on their behalf

effective interoperability with, and access for the purposes of interoperability to, the

technical features, such as hardware features and software features, that are necessary to

processing and executing securely payment transactions, on fair, reasonable and

non-discriminatory terms.

8543/1/26 REV 1 315

EN

2. Original equipment manufacturers of mobile devices and providers of electronic

communications services shall not be prevented from taking strictly necessary and

proportionate measures to ensure that interoperability does not compromise the integrity of

the hardware and software features concerned by the interoperability obligation provided

that such measures are duly justified.

3. For the purposes of applying fair, reasonable and non-discriminatory conditions of

effective interoperability and access pursuant to paragraph 1, original equipment

manufacturers of mobile devices and providers of electronic communications services shall

publish the general conditions applying to such effective interoperability and access.

Article 97

Regulatory technical standards on authentication, communication

and transaction monitoring mechanisms

1. EBA shall develop draft regulatory technical standards which shall specify:

(a) the requirements of strong customer authentication as referred to in Article 91;

(b) the exemptions from the application of Article 91(1), (6) and (7), based on the

criteria laid down in Article 91(9);

(c) the requirements with which security measures have to comply, in accordance with

Article 91(8) in order to protect the confidentiality and the integrity of the payment

service users’ personalised security credentials;

8543/1/26 REV 1 316

EN

(d) the requirements applicable, in accordance with Article 94, to the outsourcing

agreements between the payers’ payments service providers and technical service

providers concerning the provision and verification of the elements of strong

customer authentication by technical service providers;

(e) the requirements under Title III, Chapter 3 for common and secure open standards of

communication for the purposes of identification, authentication, notification, and

information, as well as for the implementation of security measures, between account

servicing payment service providers, payment initiation service providers, account

information service providers, payers, payees and other payment service providers;

(f) supplementary provisions on secure open standards of communication using

dedicated interfaces;

(g) the technical requirements for transaction monitoring mechanisms referred to in

Article 87.

For the purposes of the first subparagraph, point (b), as regards the exemption from the

application of strong customer authentication for payment transactions, based on

transaction risk analysis, the draft regulatory technical standards shall specify, among

others:

(a) the conditions that have to be met for a remote electronic payment transaction to be

considered as posing a low level of risk;

8543/1/26 REV 1 317

EN

(b) the methodologies and models to implement transaction risk analysis;

(c) the criteria for the calculation of fraud rates, including on the allocation of fraud rates

between payment service providers providing services of issuing of payment

instruments and services of acquiring payment transactions, or within payment

service providers providing services of issuing of payment instruments and services

of acquiring payment transactions through a single legal entity;

(d) detailed and proportionate reporting and audit requirements.

2. When developing the draft regulatory technical standards referred to in paragraph 1, EBA

shall take into account:

(a) the need to ensure an appropriate level of security for payment service users and

payment service providers, through the adoption of effective and risk-based

requirements;

(b) the need to ensure the safety of payment service users’ funds and personal data;

(c) the need to secure and maintain fair competition among all payment service

providers;

(d) the need to ensure technology and business-model neutrality;

(e) the need to allow for the development of user-friendly, accessible and innovative

means of payment;

8543/1/26 REV 1 318

EN

(f) the need to balance fraud risk in a service or economic activity concerned with the

consumer experience, in particular with regard to low-value transactions;

(g) whether or not the payers in the transactions are consumers.

EBA shall submit the draft regulatory technical standards referred to in paragraph 1 to the

Commission by … [12 months from the date of entry into force of this Regulation].

Power is delegated to the Commission to adopt those regulatory technical standards in

accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

3. In accordance with Article 10 of Regulation (EU) No 1093/2010, EBA shall review the

regulatory technical standards and, if appropriate, develop draft updated regulatory

technical standards on a regular basis in order, among others, to take account of innovation

and technological developments, and the provisions of Chapter II of Regulation

(EU) 2022/2554, and the European Digital Identity Wallets implemented under Regulation

(EU) No 910/2014.

8543/1/26 REV 1 319

EN

Chapter 8

Enforcement procedures, competent authorities and penalties

SECTION 1

ENFORCEMENT IN RELATION TO VERY LARGE ONLINE PLATFORMS

AND VERY LARGE ONLINE SEARCH ENGINES

Article 98

Enforcement of provisions related to very large online platforms

and very large online search engines

The Commission shall have exclusive powers to supervise and enforce Article 61(4), third

subparagraph, point (c), and Article 62, where the obligations in those provisions apply to providers

of very large online platforms and of very large online search engines.

Chapter IV of Regulation (EU) 2022/2065 shall apply for the purposes of that supervision and

enforcement. Any references therein to compliance with the relevant provisions of Regulation

(EU) 2022/2065 shall be deemed to include Article 61(4), third subparagraph, point (c), and

Article 62 of this Regulation, where the obligations in those provisions apply to providers of very

large online platforms and of very large online search engines.

8543/1/26 REV 1 320

EN

To the extent that powers are conferred upon the Commission under Chapter IV of Regulation

(EU) 2022/2065, those powers shall also cover the application of Article 61(4), third subparagraph,

point (c), and Article 62 of this Regulation, where those obligations apply to providers of very large

online platforms and of very large online search engines.

SECTION 2

PROHIBITION FROM PROVIDING PAYMENT SERVICES

Article 99

Prohibition of persons other than payment service providers

from providing payment services

Natural or legal persons that are neither payment service providers nor excluded from the scope of

this Regulation as a result of application of Article 2(3) shall not provide payment services.

8543/1/26 REV 1 321

EN

SECTION 3

COMPLAINT PROCEDURES AND INVESTIGATORY POWERS

Article 100

Complaints

1. Member States shall establish procedures which allow payment service users and other

interested parties including consumer associations, to submit complaints to the competent

authorities referred to in Article 101 with regard to payment service providers’ alleged

infringements of this Regulation.

2. Where appropriate and without prejudice to the right to bring proceedings before a court in

accordance with national procedural law, the reply from the competent authorities to the

complaints referred to in paragraph 1 of this Article shall inform the complainant of the

existence of the ADR procedures set up in accordance with Article 105.

3. By … [21 months from the date of entry into force of this Regulation], EBA shall issue

guidelines in accordance with Article 16 of Regulation (EU) No 1093/2010, on procedures

referred to in paragraph 1, including the channels for submission of complaints, the

information requested from complainants, and the disclosure of the aggregate analysis of

complaints.

8543/1/26 REV 1 322

EN

Article 101

Competent authorities and supervisory and investigatory powers

1. Member States shall designate the competent authorities responsible for carrying out the

functions and duties provided for in this Regulation. Member States shall notify those

competent authorities to EBA and the Commission.

Competent authorities shall be either:

(a) public authorities; or

(b) bodies recognised by national law or by public authorities expressly empowered for

that purpose by national law, including national central banks.

Competent authorities shall be independent from economic bodies and avoid conflicts of

interest. Without prejudice to the second subparagraph, point (b), payment institutions,

credit institutions and post office giro institutions shall not be designated as competent

authorities.

2. Where Member States designate more than one competent authority pursuant to

paragraph 1, they shall determine their respective tasks and designate one competent

authority as the single point of contact for cross-border administrative cooperation between