SUP 16.13 Reporting under the Payment Services Regulations

1This section applies to a payment service provider as set out in this section3 (see SUP 16.1.1A D).

The purpose of this section is to: 3

1. (1)

   give directions to authorised payment institutions, small payment institutions and registered account information service providers under regulation 109(1) (Reporting requirements) of the Payment Services Regulations in relation to:3

   1212
   1. (a)

      the information in respect of their provision of payment services and their compliance with requirements imposed by or under Parts 2 to 7 of the Payment Services Regulations that they must provide to the FCA; and3

   2. (b)

      the time at which and the form in which they must provide that information and the manner in which it must be verified;3

2. (2)

   give directions to payment service providers under regulation 109(5) (Reporting requirements) of the Payment Services Regulations in relation to the form of the statistical data on fraud relating to different means of payment that must be provided to the FCA under regulation 109(4) of the Payment Services Regulations at least once per year;3

3. (3)

   give directions to payment service providers under regulation 98(3) (Management of operational and security risks) of the Payment Services Regulations in relation to:3

   1. (a)

      the information that must be contained in the assessment of operational and security risks and the adequacy of mitigation measures and control mechanisms that must be provided to the FCA;3

   2. (b)

      the intervals at which that assessment must be provided to the FCA (if the assessment is required to be provided more frequently than once a year); and3

   3. (c)

      the form and manner in which that assessment must be provided; and3

4. (4)

   [deleted]6

   3
5. (5)

   10give directions to payment service providers referred to at SUP 16.13.3-BD under regulation 109(1) (Reporting requirements) of the Payment Services Regulations in relation to annual financial crime reporting to the FCA.

3The purpose for which this section requires information to be provided to the FCA under regulation 109 of the Payment Services Regulations is to assist the FCA in the discharge of its functions under regulation 106 (Functions of the FCA), regulation 108 (Monitoring and enforcement) and regulation 109(6) (Reporting requirements) of the Payment Services Regulations.

2The purpose of this section is also to set out the rules applicable to payment service providers3 in relation to complete and timely reporting and failure to submit reports.

3Authorised payment institutions and small payment institutions should refer to the transitional provisions in SUP TP 1.11 (Payment services and electronic money returns).

3Authorised payment institutions, small payment institutions and registered account information service providers are reminded that they should give the FCA reasonable advance notice of changes to their accounting reference date (among other things) under regulation 37 of the Payment Services Regulations. The accounting reference date is important because many frequencies and due dates for reporting to the FCA are linked to the accounting reference date.

3Regulation 109(4) of the Payment Services Regulations requires payment service providers to provide to the FCA statistical data on fraud relating to different means of payment.

3This requirement applies to:

1. (1)

   authorised payment institutions;

2. (2)

   small payment institutions;

3. (3)

   registered account information service providers;

4. (4)

   electronic money institutions;

5. (5)

   credit institutions with permission to accept deposits under Part 4a of FSMA8.

The9 return in SUP 16 Annex 27ED reflects9 the EBA’s Guidelines on fraud reporting under the Payment Services Directive 2 (PSD2), published on 18 July 2018 (EBA/GL/2018/05)9. The return also includes fraud reporting for registered account information service providers, as required by regulation 109 of the Payment Services Regulations. 9

4Regulation 98(1) of the Payment Services Regulations provides that each payment service provider must establish a framework with appropriate mitigation measures and control mechanisms to manage the operational and security risks relating to the payment services it provides.

4Regulation 98(2) of the Payment Services Regulations provides that each payment service provider must provide to the FCA an updated and comprehensive assessment:

1. (1)

   of the operational and security risks relating to the payment services it provides; and

2. (2)

   on the adequacy of the mitigation measures and control mechanisms implemented in response to those risks.

The purpose of SUP 16.13.11G to 16.13.17G is to direct the form and manner of the assessment and the information that the assessment must contain.

4The EBA issued Guidelines on 12 December 2017 on the security measures for operational and security risks of payment services under the Payment Services Directive (EBA/GL/2017/17)6. The Guidelines specify requirements for the establishment, implementation and monitoring of the security measures that payment service providers must take to manage operational and security risks relating to the payment services they provide.

[Note: see EBA guidelines: Guidelines on the security measures for operational and security risks of payment services, 12 December 2017/EBA/GL/2017/17.6]

4Payment service providers (except payment service providers mentioned in paragraph (1) (c) and (ca) of the Glossary definition of payment service provider and paragraph (1)(c) of the Glossary definition of electronic money issuer)7 should submit the form and the assessments to the FCA in accordance with SUP 16.13.13D(2) as soon as practicable after the assessments have been completed. In the case of credit institutions, this paragraph applies only to those with permission to accept deposits under Part 4a of FSMA.8

4Payment service providers (except payment service providers mentioned in paragraphs (1) (c) and (ca) of the Glossary definition of payment service provider and paragraph (1)(c) of the Glossary definition of electronic money issuer)7 may provide operational and security risk assessments to the FCA on a more frequent basis than once every calendar year if they so wish. Payment service providers (except payment service providers mentioned in paragraph (1) (c) and (ca) of the Glossary definition of payment service provider and paragraph (1)(c) of the Glossary definition of electronic money issuer)7 should not, however, submit such assessments more frequently than once every quarter. In the case of credit institutions, this paragraph applies only to those with permission to accept deposits under Part 4a of FSMA.8

4Subject to the requirements in SUP 16.13.13D, payment service providers (except payment service providers mentioned in paragraph (1) (c) and (ca) of the Glossary definition of payment service provider and paragraph (1)(c) of the Glossary definition of electronic money issuer)7 should submit a nil return for each quarter in which they do not make a submission to the FCA. In the case of credit institutions, this paragraph applies only to those with permission to accept deposits under Part 4a of FSMA.8

11SYSC 15A (Operational resilience) sets out further provisions which are relevant to a payment service provider’s Operational and Security Risk assessment.

5Article 17 of the SCA RTS permits payment service providers not to apply strong customer authentication in respect of legal persons initiating electronic payment transactions through the use of dedicated payment processes or protocols that are only made available to payers who are not consumers, where the FCA is satisfied that those processes and protocols guarantee at least equivalent levels of security to those provided for by the Payment Services Regulations9.

5Payment service providers that follow the guidance in paragraphs 20.55 to 20.60 of the FCA’s Approach Document and comply with SUP 16.13.19D and 16.13.20D may make use of the article 17 exemption on the basis that the FCA is satisfied with the levels of security of their processes and protocols, unless informed otherwise by the FCA.

[Note: see https://www.fca.org.uk/publication/finalised-guidance/fca-approach-payment-services-electronic-money-2017.pdf.]

5Article 32(4) of the SCA RTS requires account servicing payment service providers that opt to provide a dedicated interface under article 31 of the SCA RTS to monitor the availability and performance of that interface. They must also publish on their website quarterly statistics on the availability and performance of the dedicated interface and of the interface used by its payment services users.

5The quarterly statistics should cover the periods January to March, April to June, July to September and October to December.

An account servicing payment service provider becoming subject to the obligation in SUP 16.13.23D part way through a quarter should submit the first statistics only in relation to the part of the quarter when this obligation applied.

Guidance notes for completing the form set out in SUP 16 Annex 46AD are in SUP 16 Annex 46BG.