Line4

In forcePayment and e-money institutions: operational risk (national)Last checked 11 November 2026

Operational and security risk assessment return

A regulatory return listed by the Central Bank of Ireland (CBI), Ireland.

An annual assessment of the operational and security risks of the payment services a provider offers and of how adequate its controls are, with its top five risks. PSD2 requires the assessment; the template is the Central Bank's own. Source

Official title: Operational and Security Risk Assessment return

The facts

Who files
Payment service providers, including payment institutions and e-money institutions (Regulation 118 of the Payment Services Regulations 2018). Source
How often
On an annual basis; the Central Bank can require it more often for a sector or a firm. Source
Deadline
Not stated on the pages checked; the template's control sheet says 'Reporting due: Annual'. Source
Format
Excel. Locked Excel template submitted through the Central Bank Portal. Source
How it is filed
Filing routes recorded for the CBI: Central Bank of Ireland Portal (formerly the Online Reporting System, ONR); MiFIR transaction reporting Machine to Machine channel; Online Reporting System (ONR), now linked as 'Credit Union Auditor Reporting'; Email to the Central Bank. See how firms file with the CBI.
Status
In force
Legal basis
Group
Payment and e-money institutions: operational risk (national)

Templates (4)

The tables and forms inside the return. Plain name first, the CBI's code in brackets.

  • Overview and PSP details (Overview and PSP details)
  • Assessment (Assessment)
  • Top 5 risks (Top 5 risks)
  • Article 17 (Article 17)

Input sheets of the template, after the cover sheet; the Validation and Control sheets check the return. Source

Validation rules

12 rules, as counted from the CBI's published material. Software can run them exactly as published. Source

How they are written: Excel formulas built into the template; a return must show no validation errors before submission.

The rules, on centralbank.ie

How they were counted

Rule rows on the 'Validation' sheet of the reporting template (mandatory fields and Article 17 consistency checks).

Counts are in the CBI's own unit, so they are not comparable with other regulators' counts.

Public data

No published data from this return was found. No published data from this return was found on the Central Bank pages checked. Source

Official documents (4)

The CBI's own files, with the size and SHA-256 fingerprint of each as downloaded on 11 November 2026, so anyone can tell whether a copy is the same version.

Sources

Every page and document this return's facts were read from.

Knowing exactly what is collected, in what format and under which rules is the first step to real-time supervision. Line4 builds SupTech software for financial regulators that runs checks like these as each return arrives.

Line4's text and records here are free to reuse under CC BY 4.0. Please credit: “Source: Line4 regulatory submissions library (CC BY 4.0), https://www.line4.ai”. The regulators' documents, forms, taxonomies, rules and data belong to them: see CBI's reuse terms. This describes what regulators publish. It is not legal or regulatory advice: always rely on the regulator's own text.

Contains Irish Public Sector Information from the Central Bank of Ireland (https://www.centralbank.ie), copyright Central Bank of Ireland, re-used under the Bank's licence for re-use of public sector information (https://www.centralbank.ie/fns/re-use-of-public-sector-information). This library summarises it in plain English and links the originals; the Central Bank of Ireland does not endorse this library.

Last checked 11 November 2026.