{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2019-07-19","gaps":[],"covered":["EBA Q&A 2018_4231 — Q&A — Responsibility for comprehensive assessment according [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4231-responsibility-for-comprehensive-assessment-according-to","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4231-responsibility-for-comprehensive-assessment-according-to","title":"EBA Q&A 2018_4231 — Q&A — Responsibility for comprehensive assessment according [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4231-responsibility-for-comprehensive-assessment-according-to","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 19 July 2019","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4231","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"b3f0d3fc8ede4712","change_date":null,"nearest_versions":["2019-07-19"],"first_text_date":null,"correction_applies":false,"versions":["2019-07-19"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4231-responsibility-for-comprehensive-assessment-according-to/versions/2019-07-19","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4231-responsibility-for-comprehensive-assessment-according-to/versions/2019-07-19/rev/b3f0d3fc8ede4712","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4231-responsibility-for-comprehensive-assessment-according-to/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4231-responsibility-for-comprehensive-assessment-according-to/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 19 Jul 2019 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2019-07-19","question_submitted_on":"2018-09-06","locators":{"published_on":"EBA Q&A register entry 2018_4231, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4231, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4231","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4231-responsibility-for-comprehensive-assessment-according-to.md","body_sha256":"af62778bc077a539f933b9fc403dc049e76f7e622faad10c8b9ac9067c455740"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2018_4231 — Q&A — Responsibility for comprehensive assessment according [Final Q&A]\"\nshortTitle: \"EBA Q&A 2018_4231 — Q&A — Responsibility for comprehensive assessment according [Final Q&A]\"\nanswer_id: EBA_QA_2018_4231\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 95(2) PSD2\"\ndate: 19 July 2019\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4231\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 19 July 2019\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4231\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2018_4231, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2019-07-19\"\n  question_submitted_on: \"2018-09-06\"\n  locators:\n    published_on: \"EBA Q&A register entry 2018_4231, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2018_4231, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 19 Jul 2019 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 19 July 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4231)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2018_4231 — Q&A — Responsibility for comprehensive assessment according \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2018_4231 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 19 July 2019; question submitted 6 September 2018 |\n| **Legal basis** | Article 95(2) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Responsibility for comprehensive assessment according to Article 95(2) PSD2**\n\n### Question\n\nIt is not clear, whether comprehensive assessment of the operational and security risks relating to the payment services has to be carried out by the payment service providers (PSP), or it can be delegated / outsourced to a third entity (e.g. external audit firm). In case this is a responsibility of the PSP, it is not clear, whether it has to be carried by the independent internal audit department, or it has to be carried out by the department responsible for the risk function in the PSP.\n\n### Background\n\nFrom the PSD2 Directive is not clear whether PSP has to carry out “Comprehensive assessment of the operational and security risks relating to the payment services“ by itself, or this can be delegated to third party (audit firm, independent valuator / consultancy firm).\n\nIn PSD2, there is only responsibility for providing mentioned (and we do not argue with that) - PSP will be responsible for providing this to authorities, but it is not clear, whether the performance of this assessment / report can be outsourced to relevant third party.\n\nWe do not have internal capacities to carry out “Comprehensive assessment of the operational and security risks relating to the payment services“, and we are seeking for possibilities to outsource this, but it is not clear, whether we can.\n\n***\n\n### Answer\n\nThe EBA Guidelines on security measures for operational and security risks of payments services under PSD2 (EBA/GL/2017/17) do not list the operational functions that can be outsourced. Instead, they state the following principles to follow when outsourcing: (i) the need to ensure the effectiveness of the security measures set for the referred outsourced operational functions and (ii) the need to ensure that measures and performance targets are built into contracts and service-level agreements with the providers to whom they have outsourced such functions (Guidelines 2.7 and 2.8 of these EBA Guidelines). Furthermore, payment service providers (PSPs) should have regard to the general principles of outsourcing as specified under PSD2 and/or CRD IV (depending on the type of license), in particular, that PSPs retain full responsibility when outsourcing and therefore should comply with all the regulatory requirements.\n\nAccordingly, the risk assessment referred to in Article 95 of PSD2 could be outsourced, provided such outsourcing complies with the afore-mentioned principles and provisions in PSD2 and in the Guidelines.\n\nFinally, it should be noted that outsourcing of the risk assessment should also be done in accordance with the EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02). The Guidelines on outsourcing arrangements are addressed to all PSPs and are in line and should be read in conjunction with the requirements of PSD2 and the Guidelines on security measures for operational and security risks of payments services.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4231)\n\n## Related Level 1 articles\n\n- [Article 95 — Management of operational and security risks](../../../articles/95.md)\n"}