The rule in plain words

Card payments initiated remotely without strong customer authentication must equal these seven added up:

Low value (Article 16 of the RTS)
Trusted beneficiary (Article 13 of the RTS)
Recurring transaction (Article 14 of the RTS)
Use of secure corporate payment processes or protocols (Article 17 of the RTS)
Transaction risk analysis (Article 18 of the RTS)
Merchant initiated transactions
Other

EBA checks it for two columns: payment transactions and fraudulent payment transactions. And on six sheets: domestic amount of payment, domestic number of transactions, cross-border within the EEA amount of payments, cross-border within the EEA number of transactions, cross-border outside the EEA amount of payments and cross-border outside the EEA number of transactions. That makes twelve checks. A failure names the one that failed.

How the Line4 Check report words itShow

The first of its checks, word for word as the report shows it when it fails. The others read the same, with their own column, row or sheet.

Payment transactions: Low value (Art.16 RTS), Cross-border within the EEA amount of payments + Trusted beneficiary (Art.13 RTS), Cross-border within the EEA amount of payments + Recurring transaction (Art.14 RTS), Cross-border within the EEA amount of payments + Use of secure corporate payment processes or protocols (Art. 17 RTS), Cross-border within the EEA amount of payments + Transaction risk analysis (Art.18 RTS), Cross-border within the EEA amount of payments + Merchant initiated transactions, Cross-border within the EEA amount of payments + Other, Cross-border within the EEA amount of payments = Of which Authenticated via non-strong customer authentication, Cross-border within the EEA amount of payments

What to do if your filing fails it

01Open the template below and find the cells the rule reads.
02Add up the parts in your file and compare the result with the total.
03If they differ, a part is missing, a value sits in the wrong cell, or the total is out of date.
04EBA allows a small rounding difference, worked out from the decimals each value is reported with.
05It runs only when your filing indicators mark Y 03.01 as reported.
06This is a warning. It does not stop the filing on its own, but your authority may ask you to explain it.

The cells it reads

Card-based payment transactions reported by the issuing payment service provider (Y 03.01)

Rows

0180Of which Authenticated via non-strong customer authentication
0290Low value (Art.16 RTS)
0300Trusted beneficiary (Art.13 RTS)
0310Recurring transaction (Art.14 RTS)
0320Use of secure corporate payment processes or protocols (Art. 17 RTS)
0330Transaction risk analysis (Art.18 RTS)
0340Merchant initiated transactions
0350Other

Columns

0010Payment transactions
0020Fraudulent payment transactions

Sheets

0010Domestic amount of payment
0020Domestic number of transactions
0030Cross-border within the EEA amount of payments
0040Cross-border within the EEA number of transactions
0050Cross-border outside the EEA amount of payments
0060Cross-border outside the EEA number of transactions

A worked example

The first of its checks, with simple numbers.

Illustrative values

Low value (Article 16 of the RTS)1,200

Trusted beneficiary (Article 13 of the RTS)800

Recurring transaction (Article 14 of the RTS)450

Use of secure corporate payment processes or protocols (Article 17 of the RTS)300

Transaction risk analysis (Article 18 of the RTS)150

Merchant initiated transactions100

Other60

Together3,060

What the rule then expects

Card payments initiated remotely without strong customer authentication must then be 3,060.

3,060Passes

3,160Fails

A file that reports 3,060 passes. One that reports 3,160 fails, by 100.

The numbers are illustrative, reported to the unit, so the rounding tolerance does not change the result.

Show the rule as writtenShow

EBA's formula, as written out for the first of its checks. Cells are written as {template, row, column, sheet}.

{Y_03.01,r0290,c0010,s0030} + {Y_03.01,r0300,c0010,s0030} + {Y_03.01,r0310,c0010,s0030} + {Y_03.01,r0320,c0010,s0030} + {Y_03.01,r0330,c0010,s0030} + {Y_03.01,r0340,c0010,s0030} + {Y_03.01,r0350,c0010,s0030} = {Y_03.01,r0180,c0010,s0030}

The next five:

{Y_03.01,r0290,c0020,s0050} + {Y_03.01,r0300,c0020,s0050} + {Y_03.01,r0310,c0020,s0050} + {Y_03.01,r0320,c0020,s0050} + {Y_03.01,r0330,c0020,s0050} + {Y_03.01,r0340,c0020,s0050} + {Y_03.01,r0350,c0020,s0050} = {Y_03.01,r0180,c0020,s0050}

{Y_03.01,r0290,c0010,s0050} + {Y_03.01,r0300,c0010,s0050} + {Y_03.01,r0310,c0010,s0050} + {Y_03.01,r0320,c0010,s0050} + {Y_03.01,r0330,c0010,s0050} + {Y_03.01,r0340,c0010,s0050} + {Y_03.01,r0350,c0010,s0050} = {Y_03.01,r0180,c0010,s0050}

{Y_03.01,r0290,c0020,s0010} + {Y_03.01,r0300,c0020,s0010} + {Y_03.01,r0310,c0020,s0010} + {Y_03.01,r0320,c0020,s0010} + {Y_03.01,r0330,c0020,s0010} + {Y_03.01,r0340,c0020,s0010} + {Y_03.01,r0350,c0020,s0010} = {Y_03.01,r0180,c0020,s0010}

{Y_03.01,r0290,c0020,s0030} + {Y_03.01,r0300,c0020,s0030} + {Y_03.01,r0310,c0020,s0030} + {Y_03.01,r0320,c0020,s0030} + {Y_03.01,r0330,c0020,s0030} + {Y_03.01,r0340,c0020,s0030} + {Y_03.01,r0350,c0020,s0030} = {Y_03.01,r0180,c0020,s0030}

{Y_03.01,r0290,c0010,s0020} + {Y_03.01,r0300,c0010,s0020} + {Y_03.01,r0310,c0010,s0020} + {Y_03.01,r0320,c0010,s0020} + {Y_03.01,r0330,c0010,s0020} + {Y_03.01,r0340,c0010,s0020} + {Y_03.01,r0350,c0010,s0020} = {Y_03.01,r0180,c0010,s0020}

And 6 more, the same formula for the other cells it covers.

Every PSD2 fraud reporting rule, by template

Checks like this one, run at the point of submission, are the first step to real-time supervision.

Card payments initiated remotely without strong customer authentication must equal the sum of its seven parts (EBA rule v09143_m)

The rule in plain words

What to do if your filing fails it

The cells it reads

A worked example

Other rules on Y 03.01