Member States must ensure payment service providers establish a framework of mitigation measures and control mechanisms to manage operational and security risks for the payment services they provide, including effective incident management procedures for detection and classification of major operational and security incidents. The first subparagraph is without prejudice to the application of Chapter II of Regulation (EU) 2022/2554 to: (a) payment service providers referred to in points (a), (b) and (d) of Article 1(1) of this Directive; (b) account information service providers referred to in Article 33(1); (c) payment institutions exempted pursuant to Article 32(1); and (d) electronic money institutions benefitting from a waiver as referred to in Article 9(1) of Directive 2009/110/EC. Member States shall ensure providers supply the competent authority, annually or at shorter intervals as determined, an updated and comprehensive assessment of operational and security risks and the adequacy of mitigation measures and controls.

By 13 July 2017, the EBA, in close cooperation with the ECB and after consulting relevant stakeholders, is to issue guidelines under Article 16 of Regulation (EU) No 1093/2010 on establishment, implementation and monitoring of security measures, including certification processes; the EBA must review those guidelines regularly and at least every two years. Taking account of experience, the EBA shall, where requested by the Commission, develop draft regulatory technical standards on criteria and conditions for establishment and monitoring of security measures, with power delegated to the Commission to adopt those RTS under Articles 10 to 14 of Regulation (EU) No 1093/2010. The EBA shall promote cooperation and information sharing on operational and security risks among competent authorities and between competent authorities and the ECB and, where relevant, the European Union Agency for Network and Information Security.