3.1 Guidelines on fraud data reporting applicable to Payment Service Providers

1.1. For the purposes of reporting statistical data on fraud in accordance with these Guidelines, the payment service provider should report for each reporting period:

• a. unauthorised payment transactions made, including as a result of the loss, theft or misappropriation of sensitive payment data or a payment instrument, whether detectable or not to the payer prior to a payment and whether or not caused by gross negligence of the payer or executed in the absence of consent by the payer (‘unauthorised payment transactions’); and
• b. payment transactions made as a result of the payer being manipulated by the fraudster to issue a payment order, or to give the instruction to do so to the payment service provider, in good-faith, to a payment account it believes belongs to a legitimate payee (‘manipulation of the payer’).

1.2. For the purposes of Guideline 1.1, the payment service provider (including the payment instrument issuer where applicable) should report only payment transactions that have been initiated and executed (including acquired where applicable). The payment service provider should not report data on payment transactions that, however linked to any of the circumstances referred to in Guideline 1.1, have not been executed and have not resulted in a transfer of funds in accordance with PSD2 provisions.

1.3. In the case of money remittance services where funds were transferred from a payer’s payment service provider to a payer’s money remitter payment service provider (as part of a money remittance payment transaction), it is the payer’s payment service provider, rather than the money remitter payment service provider, who should report the payment transactions from the payer’s payment service provider to the money remitter. Such transactions should not be reported by the payment service provider of the beneficiary of the money remittance payment transaction.

1.4. Transactions and fraudulent transactions where funds have been transferred by a money remitter payment service provider from its accounts to a beneficiary account, including through arrangements offsetting the value of multiple transactions (netting arrangements), should be reported by the money remitter payment service provider in accordance with Data Breakdown G in Annex 2.

16 1.5. Transactions and fraudulent transactions where e-money has been transferred by an e-money provider to a beneficiary account, including where the payer's payment service provider is identical to the payee's payment service provider, should be reported by the e-money provider in accordance with Data Breakdown F in Annex 2. Where the payment service providers are different, payment is only reported by the payer’s payment service provider to avoid double counting.

1.6. Payment service providers should report all payment transactions and fraudulent payment transactions in accordance with the following:

• a. ‘Total fraudulent payment transactions’ refer to all transactions mentioned in Guideline 1.1, regardless of whether the amount of the fraudulent payment transaction has been recovered.
• b. ‘Losses due to fraud per liability bearer‘ refers to the losses by the reporting payment service provider, its payment service user or others, reflecting the actual impact of fraud on a cash flow basis. Since the registering of financial losses borne may be disassociated time-wise from the actual fraudulent transactions and in order to avoid revisions of reported data purely due to this immanent time lag, the final fraud losses should be reported in the period when they are recorded in the payment service provider’s books. The final fraud loss figures should not take into account refunds by insurance agencies because they are not related to fraud prevention for the purposes of PSD2.
• c. ‘Modification of a payment order by the fraudster’ is a type of unauthorised transaction as defined in Guideline 1.1(a) and refers to a situation where the fraudster intercepts and modifies a legitimate payment order at some point during the electronic communication between the payer’s device and the payment service provider (for instance through malware or attacks allowing attackers to eavesdrop on the communication between two legitimately communicating hosts (man-in-the middle attacks)) or modifies the payment instruction in the payment service provider’s system before the payment order is cleared and settled.
• d. ‘Issuance of a payment order by the fraudster’ is a type of unauthorised transaction as defined in Guideline 1.1(a) and refers to a situation where a fake payment order is issued by the fraudster after having obtained the payer/payee's sensitive payment data through fraudulent means.

2.1. The payment service provider should report statistical information on:

• a. total payment transactions in line with the different breakdowns in Annex 2 and in accordance with Guideline 1; and

• b. total fraudulent payment transactions in line with the different breakdowns in Annex 2 and as defined in Guideline 1.6(a).

2.2. The payment service provider should report the statistical information specified in Guideline 2.1 in terms of both volume (i.e. number of transactions or fraudulent transactions) and value (i.e. amount of transactions or fraudulent transactions). They should report volumes and values in actual units, with two decimals for values.

2.3. A payment service provider authorised, or a branch established, in a Member State of the euro area should report the values in euro currency, whereas a payment service provider authorised, or a branch established, in a Member State not participating in the euro area should report in the currency of that Member State. The reporting payment service providers should convert data for values of transactions or fraudulent transactions denominated in a currency other than the euro currency or the relevant Member State’s official currency into the currency they should report in, using the relevant exchange rates applied to these transactions or the average ECB reference exchange rate for the applicable reporting period.

2.4. The payment service provider should report only payment transactions that have been executed, including those transactions that have been initiated by a payment initiation service provider. Prevented fraudulent transactions that are blocked before they are executed due to suspicion of fraud should not be included.

2.5. The payment service provider should report the statistical information with a breakdown in accordance with the breakdowns specified in Guideline 7 and compiled in Annex 2.

2.6. The payment service provider should identify the applicable data breakdown(s), depending on the payment service(s) and payment instrument(s) provided, and submit the applicable data to the competent authority.

2.7. The payment service provider should ensure that all data reported to the competent authority can be cross-referenced in accordance with Annex 2.

2.8. The payment service provider should allocate each transaction to only one sub-category for each row of each data breakdown.

2.9. In the case of a series of payment transactions being executed, or fraudulent payment transactions being executed, the payment service provider should consider each payment transaction or fraudulent payment transaction in the series to count as one.

2.10. The payment service provider can report zero (‘0’) where there were no transactions or fraudulent transactions taking place for a particular indicator in the reporting period established. Where the payment service provider cannot report data for a specific breakdown because that particular data breakdown is not applicable to that PSP, the data should be reported as ‘NA’.

2.11. For the purpose of avoiding double-counting, the payer’s payment service provider should submit data in its issuing (or initiating) capacity. As an exception, data for card payments should be reported both by the payer’s payment service provider and by the payee’s

payment service provider acquiring the payment transaction. The two perspectives should be reported separately, with different breakdowns as detailed in Annex 2. In the event that there is more than one acquiring payment service provider involved, the provider that has the contractual relationship with the payee should report. In addition, for direct debits, transactions must be reported by the payee’s payment service provider only, given that these transactions are initiated by the payee.

2.12. In order to avoid double counting when calculating the total transactions and fraudulent transactions across all payment instruments, the payment service provider that executes credit transfers initiated by a payment initiation service provider should indicate the breakdown for the volume and value of the total transactions and fraudulent payment transactions that have been initiated via a payment initiation service provider when reporting under Data Breakdown A.

3.1. The payment service provider should report data every six months based on the applicable data breakdown(s) in Annex 2.

3.2. The payment service provider that benefit from an exemption under Article 32 PSD2 and e-money institutions that benefit from the exemption under Article 9 Directive 2009/110/EC on the taking up, pursuit and prudential supervision of the business of electronic money institutions should only report the set of data requested under the applicable form(s) in Annex 2 on an annual basis with data broken down in two periods of six months.

3.3. The payment service provider should submit their data within the timelines set by the respective competent authorities.

4.1 The payment service provider should report data for transactions that are domestic, cross border within the European Economic Area (EEA), and cross-border outside the EEA.

4.2 For non-card based payment transactions, and remote card based payment transactions, ‘domestic payment transactions’ refer to payment transactions initiated by a payer, or by or through a payee, where the payer’s payment service provider and the payee’s payment service provider are located in the same Member State.

4.3 For non-remote card-based payment transactions, ‘domestic payment transactions’ refer to payment transactions where the payer’s payment service provider (issuer), the payee’s payment service provider (acquirer) and the point of sale (POS) or automated teller machine (ATM) used are located in the same Member State.

4.4 For EEA branches, domestic payment transactions refer to the payment transactions where both the payer’s and the payee’s payment service providers are in the host Member State where the branch is established.

19 4.5 For non-card based payment transactions and remote card based payment transactions, ‘cross-border payment transaction within the EEA’ refers to a payment transaction initiated by a payer, or by or through a payee, where the payer’s payment service provider and the payee’s payment service provider are located in different Member States.

4.6 For non-remote card-based payment transactions, ‘cross-border payment transactions within the EEA’ refer to payment transactions where the payer’s payment service provider (issuer) and the payee’s payment service provider (acquirer) are in different member states or the payer’s payment service provider (issuer) is located in a Member State different from that of the POS or ATM.

4.7 ‘Cross-border payment transactions outside the EEA’ refer to payment transactions initiated by a payer, or by or through a payee, where either the payer’s or the payee’s payment service provider is located outside the EEA while the other is located within the EEA.

4.8 A payment service provider offering payment initiation services should report the executed payment transactions it initiated and the executed fraudulent transactions it initiated in accordance with the following:

• a. ‘Domestic payment transactions’ refer to payment transactions, where the payment initiation service provider and the account servicing payment service provider are located in the same Member State;
• b. ‘Cross-border payment transactions within the EEA’ refer to payment transactions, where the payment initiation service provider and the account servicing payment service provider are located in different Member States;
• c. ‘Cross-border payment transactions outside the EEA’ refer to payment transactions, where the payment initiation service provider is within the EEA and the account servicing payment service provider is located outside the EEA.

5.1. The payment service provider shall report to the competent authority of the home Member State.

5.2. The payment service provider should record data from all its agents, providing payment services in the EEA and aggregate these data with the rest of the data before reporting to the home competent authority. When doing so, the location of the agent is irrelevant for determining the geographical perspective.

5.3. Within the framework of the monitoring and reporting set out in Article 29(2) PSD2 and in Article 40 of Directive 2013/36/EU of the European Parliament and of the Council on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms, an established branch of an EEA’s payment service provider should report to the competent authority of the host Member State where it is established, separately from the reporting data of the payment service provider in the home Member State.

20 5.4. When reporting data to the corresponding competent authority, a payment service provider should mention the identification details mentioned in Annex 1.

6.1 The date to be considered by payment service providers for recording payment transactions and fraudulent payment transactions for the purpose of this statistical reporting is the day the transaction has been executed in accordance with PSD2. In the case of a series of transactions, the date recorded should be the date when each individual payment transaction was executed.

6.2 The payment service provider should report all fraudulent payment transactions from the time fraud has been detected, such as through a customer complaint or other means, regardless of whether or not the case related to the fraudulent payment transaction has been closed by the time the data are reported.

6.3 The payment service provider should report all adjustments to the data referring to any past reporting period at least up to one year old during the next reporting window after the information necessitating the adjustments is discovered. It should indicate that the data reported are revised figures applicable to the past period and should report this revision according to the methodology established by the relevant competent authority.

7.1 For e-money payment transactions as defined in Directive 2009/110/EC, the payment service provider should provide data in accordance with Data Breakdown F in Annex 2.

7.2 When providing data on e-money transactions, the payment service provider should include e-money payment transactions

• a. where the payer’s PSP is identical to the payee’s PSP, or
• b. where a card with an e-money functionality is used.

7.3 The payment service provider for the purpose of e-money payment transactions should report data on volumes and values of all payment transactions, as well as volumes and values of fraudulent payment transactions, with the following breakdowns:

• a. geographical perspective,
• b. payment channel,
• c. authentication method,
• d. reason for not applying strong customer authentication (referring to the exemptions to strong customer authentication detailed in chapter 3 of the Regulatory technical standards on strong customer authentication and common and secure communication, Commission Delegated Regulation (EU) 2018/389 ► A1,

or to either of the categories “Merchant initiated transactions” and “Other”, where applicable), and

• e. fraud types.

7.4 For money remittance services, the payment service provider should provide data in accordance with Data Breakdown G in Annex 2 and as specified in Guideline 1.3. The payment service provider offering these services should report data on volumes and values of all payment transactions and fraudulent payment transactions in Guideline 2.1 with the geographical perspective.

7.5 When providing provides payment initiation services, the payment service provider should provide data in accordance with Data Breakdown H in Annex 2. The payment service provider should report the executed payment transactions it initiated and the executed fraudulent transactions it initiated, both by volume and value.

7.6 For those payment transactions that qualify for Data Breakdown H in Annex 2, the payment service provider offering payment initiation services should record and report data on volumes and values with the following breakdowns:

• a. geographical perspective,
• b. payment instrument,
• c. payment channel, and
• d. authentication method.

7.7 A payment service provider that does not manage the account of the payment service user but issues and executes card-based payments (a card-based payment instrument issuer) should provide data on volumes and values, in accordance with Data Breakdown C and/or E in Annex 2. When such data are provided, the account service payment service provider should ensure that no double-reporting of such transactions occur.

7.8 The payment service provider offering credit transfer and card based payment services should provide data in accordance with Data Breakdowns A, C and/or D in Annex 2, depending on the payment instrument used for a given payment transaction and on the role of the payment service provider. The data include:

• a. geographical perspective,
• b. payment channel,
• c. authentication method,
• d. reason for not applying strong customer authentication (referring to exemptions to strong customer authentication detailed in chapter 3 of the RTS on SCA and CSC, ► A1 or to either of the categories “Merchant initiated transactions” and “Other”, where applicable),

• e. fraud types,
• f. card function for Data Breakdowns C and D, and
• g. payment transactions initiated via a payment initiation service provider for Data Breakdown A.

7.9 The payment service provider should provide data in accordance with Data Breakdown A in Annex 2 for all payment transactions and fraudulent payment transactions executed using credit transfers.

7.10 The payment service provider should provide data in accordance with Data Breakdown B in Annex 2 for all payment transactions and fraudulent payment transactions executed using direct debits. The data include:

• a. geographical perspective,
• b. channel used for the consent to be given, and
• c. fraud types.

7.11 The payment service provider should provide data in accordance with Data Breakdown C in Annex 2 for all payment transactions and fraudulent payment transactions on the issuer side where a payment card was used and the payment service provider was the payer’s payment service provider.

7.12 The payment service provider should provide data in accordance with Data Breakdown D in Annex 2 for all payment transactions and fraudulent payment transactions on the acquiring side where a payment card was used and the payment service provider is the payee’s payment service provider.

7.13 The payment service provider providing data in accordance with Data Breakdowns A to F in Annex 2 should report all losses due to fraud per liability bearer during the reporting period.

7.14 The payment service provider reporting card payment transactions in accordance with Data Breakdowns C and D in Annex 2 should exclude cash withdrawals and cash deposits.

7.15 The payment service provider (issuer) should provide data in accordance with Data Breakdown E in Annex 2 for all cash withdrawals and fraudulent cash withdrawals ► A1 at ATMs (including via apps), at bank counters and through retailers (‘cash back’) using a card.