European Banking Authority Issues Guidelines For Assessing And Managing Security And Operational Risks In Payment Services

On December 12, 2017, the European Banking Authority published finalized guidelines to assist payment services providers to conduct appropriate risk assessment and risk management of operational and security risks. The finalized guidelines contain some changes from the draft guidelines on which the EBA launched a consultation in May 2017.

The revised Payment Services Directive, which will take effect from January 13, 2018, will require EU payment service providers to establish a risk management framework comprising appropriate mitigation measures and control mechanisms to manage the operational and security risks that arise from the payment services they provide. PSPs must also provide their national regulator annually (or more frequently as required) with an updated and comprehensive assessment of the operational and security risks relating to the payment services they provide and on the adequacy of the mitigation measures implemented in response to those risks.