Eba guidelines on reporting obligations under the PSD 2 in Luxembourg

The CSSF has adopted on December 17th 2018 the guidelines of the European Banking Authority on the notification of major operational or security incidents (EBA/GL/2017/10) (the “EBA Guidelines”). CSSF Circular 18/704 (the “CSSF Circular”) adopting the EBA Guidelines (attached as its Annex 1) is applicable immediately upon issue. The EBA Guidelines provide the criteria, thresholds and methodology to be used by payment service providers (the “PSP”) as well as contain templates to be used by the PSP in its reporting of “major operational or security incidents” to the national authorities. Adoption of the EBA Guidelines by the Luxembourg regulator is an important step in the transposition of Directive (EU) 2015/2366 on payment services (“PSD2”) into the Luxembourg regulatory regime on payment services after the law of July 25th 2018 transposed PSD2 by amending the Luxembourg law of November 10th 2009 on payment services (the “PSL”).

We refer you to our January 2018 Newsletter where we discussed the transposition of PSD2 in Luxembourg and related guidelines of the EBA on the information to be provided by the payment institutions to the competent national authorities.

Not only has the Luxembourg regulator formally adopted the EBA Guidelines in Luxembourg but also provided further details in respect of the reporting obligation under Article 105-2 paragraph 1 of the PSL which provides that “payment service providers shall report major operational or security incidents to the CSSF without undue delay”.

The CSSF confirms the scope of the obligation to report a “major operational or security incident” by stating that it shall extend to both external and internal events that could be either malicious or accidental. The CSSF Circular further provides the relevant deadlines for each type of the report to be submitted by the PSP to the CSSF. For instance, once a PSP detects a “major operational or security incident”, it has a maximum of 4 hours to report it to the CSSF in the form of an “initial report”. Furthermore, if there is any relevant status update after the “initial report” has been submitted to the CSSF, the PSP should also report it to the CSSF in the form of an “intermediate report”. The PSP also needs to submit its “final report” within a maximum of 2 weeks after business is deemed back to normal. Finally, although such possibility is not excluded under the EBA Guidelines, the CSSF confirms that no delegation of the reporting obligation of the PSP can be made to any third party.

Voir aussi : Bonn Steichen & Partners

[+ http://www.bsp.lu]

Click here to see the ad(s)
Tous les articles Droit bancaire

Derniers articles Droit bancaire

FCA communication to Luxembourg-based entities about the UK temporary permissions regime

On 19 November 2020 the Luxembourg supervisory authority for the financial sector, the CSSF, issued press release 20/...

Read more

ELTIF Reform European Commission publishes consultation

On 19 October 2020, the European Commission published a public consultation on the review of the European long-term invest...

Read more

New Luxembourg Draft Law Transposing CRD V and BRRD II

The purpose of the draft law 7638, submitted to the Luxembourg Parliament (Chambre des Députés) on 27 July 2...

New Luxembourg Draft Law Transposing CRD V and BRRD II Read more

CSSF: ESMA guidelines on liquidity stress testing in UCITS and AIFs

In the midst of the COVID-19 crisis, liquidity risk management is certainly a topical question, as it is meant to prepare ...

Read more

LexGO Network