Line4

2 min readWarningEBA reporting framework 4.2Updated 10 November 2026

Card payments initiated non-remotely without strong customer authentication must equal the sum of its five parts (EBA rule v09144_m)

A warning in the payment fraud return (PSD2 fraud reporting), on template Y 03.01, card-based payment transactions reported by the issuing payment service provider.

Check your file against this ruleWhat to do if it fails

The rule in plain words

Card payments initiated non-remotely without strong customer authentication must equal these five added up:

  • Trusted beneficiary (Article 13 of the RTS)
  • Recurring transaction (Article 14 of the RTS)
  • Contactless low value (Article 11 of the RTS)
  • Unattended terminal for transport or parking fares (Article 12 of the RTS)
  • Other

EBA checks it for two columns: payment transactions and fraudulent payment transactions. And on six sheets: domestic amount of payment, domestic number of transactions, cross-border within the EEA amount of payments, cross-border within the EEA number of transactions, cross-border outside the EEA amount of payments and cross-border outside the EEA number of transactions. That makes twelve checks. A failure names the one that failed.

How the Line4 Check report words itShow

The first of its checks, word for word as the report shows it when it fails. The others read the same, with their own column, row or sheet.

Fraudulent payment transactions: Trusted beneficiary (Art.13 RTS), Domestic amount of payment + Recurring transaction (Art.14 RTS), Domestic amount of payment + Contactless low value (Art.11 RTS), Domestic amount of payment + Unattended terminal for transport or parking fares (Art.12 RTS), Domestic amount of payment + Other, Domestic amount of payment = Of which authenticated via non-strong customer authentication, Domestic amount of payment

What to do if your filing fails it

  1. 01Open the template below and find the cells the rule reads.
  2. 02Add up the parts in your file and compare the result with the total.
  3. 03If they differ, a part is missing, a value sits in the wrong cell, or the total is out of date.
  4. 04EBA allows a small rounding difference, worked out from the decimals each value is reported with.
  5. 05It runs only when your filing indicators mark Y 03.01 as reported.
  6. 06This is a warning. It does not stop the filing on its own, but your authority may ask you to explain it.

The cells it reads

Card-based payment transactions reported by the issuing payment service provider (Y 03.01)

Rows

  • 0490Of which authenticated via non-strong customer authentication
  • 0590Trusted beneficiary (Art.13 RTS)
  • 0600Recurring transaction (Art.14 RTS)
  • 0610Contactless low value (Art.11 RTS)
  • 0620Unattended terminal for transport or parking fares (Art.12 RTS)
  • 0630Other

Columns

  • 0010Payment transactions
  • 0020Fraudulent payment transactions

Sheets

  • 0010Domestic amount of payment
  • 0020Domestic number of transactions
  • 0030Cross-border within the EEA amount of payments
  • 0040Cross-border within the EEA number of transactions
  • 0050Cross-border outside the EEA amount of payments
  • 0060Cross-border outside the EEA number of transactions

A worked example

The first of its checks, with simple numbers.

Illustrative values
Trusted beneficiary (Article 13 of the RTS)1,200
Recurring transaction (Article 14 of the RTS)800
Contactless low value (Article 11 of the RTS)450
Unattended terminal for transport or parking fares (Article 12 of the RTS)300
Other150
Together2,900
What the rule then expects

Card payments initiated non-remotely without strong customer authentication must then be 2,900.

2,900Passes
3,000Fails

A file that reports 2,900 passes. One that reports 3,000 fails, by 100.

The numbers are illustrative, reported to the unit, so the rounding tolerance does not change the result.

Show the rule as writtenShow

EBA's formula, as written out for the first of its checks. Cells are written as {template, row, column, sheet}.

{Y_03.01,r0590,c0020,s0010} + {Y_03.01,r0600,c0020,s0010} + {Y_03.01,r0610,c0020,s0010} + {Y_03.01,r0620,c0020,s0010} + {Y_03.01,r0630,c0020,s0010} = {Y_03.01,r0490,c0020,s0010}

The next five:

{Y_03.01,r0590,c0020,s0030} + {Y_03.01,r0600,c0020,s0030} + {Y_03.01,r0610,c0020,s0030} + {Y_03.01,r0620,c0020,s0030} + {Y_03.01,r0630,c0020,s0030} = {Y_03.01,r0490,c0020,s0030}{Y_03.01,r0590,c0020,s0040} + {Y_03.01,r0600,c0020,s0040} + {Y_03.01,r0610,c0020,s0040} + {Y_03.01,r0620,c0020,s0040} + {Y_03.01,r0630,c0020,s0040} = {Y_03.01,r0490,c0020,s0040}{Y_03.01,r0590,c0010,s0020} + {Y_03.01,r0600,c0010,s0020} + {Y_03.01,r0610,c0010,s0020} + {Y_03.01,r0620,c0010,s0020} + {Y_03.01,r0630,c0010,s0020} = {Y_03.01,r0490,c0010,s0020}{Y_03.01,r0590,c0020,s0060} + {Y_03.01,r0600,c0020,s0060} + {Y_03.01,r0610,c0020,s0060} + {Y_03.01,r0620,c0020,s0060} + {Y_03.01,r0630,c0020,s0060} = {Y_03.01,r0490,c0020,s0060}{Y_03.01,r0590,c0020,s0020} + {Y_03.01,r0600,c0020,s0020} + {Y_03.01,r0610,c0020,s0020} + {Y_03.01,r0620,c0020,s0020} + {Y_03.01,r0630,c0020,s0020} = {Y_03.01,r0490,c0020,s0020}

And 6 more, the same formula for the other cells it covers.

Every PSD2 fraud reporting rule, by template

Checks like this one, run at the point of submission, are the first step to real-time supervision.