AI Summary of Article 96 Incident reporting
Payment service providers must notify, without undue delay, the competent authority in their home Member State of any major operational or security incident and must inform affected payment service users without undue delay when users’ financial interests are or may be affected, including measures to mitigate harm. The competent authority shall promptly provide incident details to the EBA and the ECB, assess relevance for domestic authorities and notify them; EBA and the ECB, with the competent authority, shall assess and notify other Union and national authorities, and the ECB shall inform members of the European System of Central Banks. Competent authorities shall take necessary measures to protect the immediate safety of the financial system.
By 13 January 2018 EBA, with the ECB and after stakeholder consultation, shall issue guidelines to (i) payment service providers on classification of major incidents, notification content, format, templates and procedures; and (ii) competent authorities on criteria to assess relevance and report details to share. EBA and the ECB shall review the guidelines at least every two years and take account of ENISA standards. Member States must ensure providers supply annual statistical fraud data to competent authorities, who shall provide aggregated data to the EBA and the ECB. Paragraphs 1–5 do not apply to specified exempt categories under the Directive and Directive 2009/110/EC.
Article 96 Incident reporting
1. In the case of a major operational or security incident, payment service providers shall, without undue delay, notify the competent authority in the home Member State of the payment service provider.
Where the incident has or may have an impact on the financial interests of its payment service users, the payment service provider shall, without undue delay, inform its payment service users of the incident and of all measures that they can take to mitigate the adverse effects of the incident.
2. Upon receipt of the notification referred to in paragraph 1, the competent authority of the home Member State shall, without undue delay, provide the relevant details of the incident to EBA and to the ECB. That competent authority shall, after assessing the relevance of the incident to relevant authorities of that Member State, notify them accordingly.
EBA and the ECB shall, in cooperation with the competent authority of the home Member State, assess the relevance of the incident to other relevant Union and national authorities and shall notify them accordingly. The ECB shall notify the members of the European System of Central Banks on issues relevant to the payment system.
On the basis of that notification, the competent authorities shall, where appropriate, take all of the necessary measures to protect the immediate safety of the financial system.