The European Banking Authority (EBA) has launched a consultation on its draft guidelines for PSD2, the revised Payment Services Directive.

The guidelines set out the criteria, thresholds and methodology to be used by payment service providers in order to determine whether an operational or security incident should be considered as major and, therefore, be notified to the Competent Authorities (CAs). Specifically, they set out:

• the criteria for classifying operational or security incidents as major;
• the template to be used by payment service providers when notifying them to the CAs; and
• the indicators CAs need to use when assessing the relevance of such incidents.

Responses to the consultation should be received by 7 March 2017.

EBA under pressure from PSD2

However, the EBA is currently struggling to cope with the volume of responses to its consultations, according to a report by Finextra. The EBA is responsible for preparing 11 mandates for the payments industry and it has so far issued consultation papers on four, with two in preparation for early next year. Problems facing the EBA include a lack of resources for processing the volume of work and the high number of replies it has received so far to its consultations. The proposal of a €10 threshold for additional authentication processes during online checkout has generated a large number of hostile responses from the payments industry, for example.

Andrea Enria, EBA chair, said in a statement: “There is considerable uncertainty as to whether we are able to maintain this speed until the transposition date of the PSD2 on 13 January 2018, given that the EBA has been allocated no additional resources to develop the PSD2 mandates.”