meta_id 3165773

On May 19, 2026, the European Banking Authority (EBA) published a consolidated version of its Guidelines on Information and Communications Technology (ICT) and Security Risk Management (EBA/GL/2019/04). The consolidated version incorporates amendments made by EBA/GL/2025/02, which the EBA adopted on May 20, 2025. The guidelines establish requirements for payment service providers to implement security measures and manage operational and security risks in accordance with Article 95(1) of Directive (EU) 2015/2366 (Payment Services Directive 2). The guidelines complement risk management measures under the Digital Operational Resilience Act (DORA) and apply to competent authorities and financial institutions that are payment service providers, including those benefiting from exemptions under Articles 32 and 33 of Directive (EU) 2015/2366 and Article 9 of Directive 2009/110/EC. The consolidated guidelines address payment service user relationship management, requiring payment service providers to establish processes enhancing users' awareness of security risks through assistance and guidance. Key requirements include: allowing users to disable specific payment functionalities where product functionality permits; providing options to adjust spending limits on payment instruments up to agreed maximums; offering alerts on initiated and failed payment transaction attempts; keeping users informed about security procedure updates; and providing assistance on security-related questions and anomalies. Payment service providers must update guidance in response to new threats and vulnerabilities and communicate changes to users. Competent authorities must notify the EBA of their compliance status with the guidelines by May 20, 2025, using the form available on the EBA website with reference 'EBA/GL/2025/02'. Authorities failing to notify by this deadline are considered non-compliant. The guidelines apply from May 20, 2025, at the latest. The EBA will publish all compliance notifications on its website.