3.2 Guidelines on aggregate fraud data reporting by competent authorities to the EBA and the ECB

1.1. For the purposes of reporting statistical data on fraud to the EBA and the ECB in accordance with these Guidelines and with Article 96(6) PSD2, the competent authority should report for each reporting period:

• a. unauthorised payment transactions made, including as a result of the loss, theft or misappropriation of sensitive payment data or a payment instrument, whether detectable or not to the payer prior to a payment and whether or not caused by gross negligence of the payer or executed in the absence of consent by the payer (‘unauthorised payment transaction’); and
• b. payment transactions made as a result of the payer being manipulated by the fraudster to issue a payment order, or to give the instruction to do so to the payment service provider, in good-faith, to a payment account it believes belongs to a legitimate payee (‘manipulation of the payer’).

1.2. For the purposes of Guideline 1.1, the competent authority should report only payment transactions that have been initiated and executed (including acquired where applicable) by payment service providers (including card based payment instrument issuers where applicable). The competent authority should not report data on payment transactions that, however linked to any of the circumstances referred to in Guideline 1.1, have not been executed and have not resulted in a transfer of funds in accordance with PSD2 provisions.

1.3. The competent authority should report all payment transactions and fraudulent payment transactions in accordance with the following:

• a. For non-card based payment transactions and remote card based payment transactions, ‘domestic payment transactions’ refer to payment transactions initiated by a payer, or by or through a payee, where the payer’s payment service provider and the payee’s payment service provider are located in the same Member State,
• b. For EEA branches, domestic payment transactions refer to the payment transactions where both the payer’s and the payee’s payment service providers are in the host Member State where the branch is established.

• c. For non-card based payment transactions and remote card based payment transactions, ‘cross-border payment transactions within the EEA’ refer to payment transactions initiated by a payer, or by or through a payee, where the payer’s payment service provider and the payee’s payment service provider are located in different Member States.
• d. For non-remote card-based payment transactions, ‘domestic payment transactions’ refer to payment transactions where the payer’s payment service provider (issuer), the payee’s payment service provider (acquirer) and the POS or ATM used are located in the same Member State. If the payer’s payment service provider and the payee’s payment service provider are in different Member States or the payer’s payment service provider (issuer) is located in a Member State different from that of the POS or ATM, the transaction is a ‘cross-border payment transaction within the EEA’.
• e. ‘Cross-border payment transactions outside the EEA’ refer to payment transactions initiated by a payer, or by or through a payee, where either the payer’s or the payee’s payment service provider is located outside the EEA while the other is located within the EEA.
• f. ‘Total fraudulent payment transactions’ refer to all the transactions mentioned in Guideline 1.1, regardless of whether the amount of the fraudulent payment transaction has been recovered.
• g. ‘Modification of a payment order by the fraudster’ is a type of unauthorised transaction as defined in Guideline 1.1(a) and refers to a situation where the fraudster intercepts and modifies a legitimate payment order at some point during the electronic communication between the payer’s device and the payment service provider (for instance through malware or man-in-the middle attacks) or modifies the payment instruction in the payment service provider’s system before the payment order is cleared and settled.
• h. ‘Issuance of a payment order by the fraudster’ is a type of unauthorised transaction as defined in Guideline 1.1(a) and refers to a situation where a fake payment order is issued by the fraudster after having obtained the payer’s/payee's sensitive payment data through fraudulent means.

1.4. Competent authorities should report data from payment service providers offering payment initiation services in accordance with the following:

• a. ‘Domestic payment transactions’ refer to payment transactions, where the payment initiation service provider and the account servicing payment service provider are located in the same Member State.
• b. ‘Cross-border payment transactions within the EEA’ refer to payment transactions, where the payment initiation service provider and the account servicing payment service provider are located in different Member States.

• c. ‘Cross-border payment transactions outside the EEA’ refer to payment transactions, where the payment initiation service provider is located within the EEA and the account servicing payment service provider is located outside the EEA.

2.1. The competent authority should report statistical information on:

• a. total payment transactions in line with the different breakdowns in Annex 2 and in accordance with Guideline 1.2; and
• b. total fraudulent payment transactions in line with the different breakdowns in Annex 2 and as defined under Guideline 1.3(f).

2.2. The competent authority should report the statistical information in Guideline 2.1 both in volume (i.e. number of transactions or fraudulent transactions) and value (i.e. amount of transactions or fraudulent transactions). It should report volumes and values in actual units, with two decimals for values.

2.3. The competent authority should report the values in euro currency. It should convert data for values of transactions or fraudulent transactions denominated in a currency other than the euro, using the relevant exchange rates applied to these transactions or the average ECB reference exchange rate for the applicable reporting period.

2.4. The competent authority can report zero (‘0’) where there were no transactions or fraudulent transactions taking place for a particular indicator in the reporting period established.

2.5. The competent authority should aggregate the data collected within its Member State from the addressees of this Guidelines by summing the figures reported for each individual payment service provider in line with the data breakdowns in Annex 2.

2.6. The competent authority should define the secure communication procedures and the format for the reporting of the data by payment service providers. The competent authority should also ensure that an appropriate deadline is given to payment service providers to ensure the quality of the data and to account for the potential delay in reporting fraudulent payment transactions.

2.7. The competent authority should ensure that the data reported under these Guidelines can be cross-referenced and used by the EBA and the ECB in accordance with the data breakdowns in Annex 2.

3.1. The competent authority should report the volumes and values of payment transactions and fraudulent payment transactions in line with Guidelines 2.1 and 2.2. To avoid double counting, data should not be aggregated across the different data breakdowns in Annex 2.

26 3.2. The competent authority should report adjustments to data on any payment transaction and fraudulent payment transaction reported in any past reporting period during the next reporting window after the information necessitating the adjustments is obtained from given payment service provider(s) and up to 13 months after the transaction was executed (and/or acquired) to enable the payment service user to exercise its right to notify the payment service provider no later than 13 months after the transaction was executed in accordance with Article 71 PSD2.

3.3. The competent authority should at all times ensure the confidentiality and integrity of the information stored and exchanged and the proper identification when submitting data to the ECB and the EBA.

3.4. The competent authority should send the aggregated data to the ECB and the EBA within six months from the day after the end of the reporting period.

3.5. The competent authority should agree with the ECB and the EBA the secure communication procedures and the specific format in which the competent authority should report the data.

4.1. Where there is more than one competent authority in a Member State under PSD2, the competent authorities should co-ordinate the data collection to ensure that only one set of data is reported for that Member State to the ECB and the EBA.

4.2. Upon request by the competent authority in a home Member State, the competent authority in a host Member State should make available information and data that established branches have reported to them.

27