Get ready with the first CESOP reporting

In detail

CESOP was designed to enable the European Commission and Member States in identifying payment recipients, such as suppliers and service providers, who may have inadequately fulfilled their VAT obligations. By enhancing transparency and accountability in cross-border payment transactions, CESOP aims to mitigate instances of fraud within the digital marketplace.

The new rules are aimed at the below four categories of Payment Service Providers (“PSPs”) as defined under Directive (EU) 2015/2366 (“PSD2 Directive”) that are active in the EU, including certain small PSPs that are subject to lighter PSD2 requirements. These include:

• Fully licenced banks and other credit institutions;
• Payment institutions;
• Electronic money institutions; and
• Post office giro institutions.

The scope of CESOP reporting focuses exclusively on cross-border payments originating within the EU, excluding domestic transactions and payments originating from third countries. Notably, reporting obligations are only triggered when a payee receives more than 25 payments per quarter, requiring PSPs to adhere to aggregation rules for threshold determination. 

The application of location and aggregation rules presents practical complexities, obliging PSPs further, to establish clearly defined business rules. In determining the cross-border nature of payments, the primary rule relies on the IBAN or other unambiguous identifiers of the payer/payee, with a fallback to the BIC or equivalent identifier in the absence of an IBAN. Aggregation follows similar identifiers as location rules, with additional measures to identify linked payment accounts using available information such as payee details and identifiers. Ensuring consistency and proper documentation of these automated processes is essential for effective compliance.

The reporting obligation falls on the PSPs that are part of the payment chain. 

For intra-EU transactions (where both the payer and the payee are located in different EU Member States), the reporting obligation will generally fall on the PSP of the payee. For extra-EU transactions (where the payer is located in the EU, and the payee is located in a third country), the reporting obligation will generally fall on the PSP of the payer.

The basic rule is that reportable payments need to be reported in the Member State where the payment services have been provided. This could be the Member State where the PSP is established (i.e., home country) but also the Member States where the PSP provides payment services (i.e., host country). Depending on the set-up of the PSP and in absence of a ‘one-stop shop’-approach, this may result in reporting obligations in multiple Member States for individual PSPs.

This cross-border reporting obligation has a significant impact on how to handle, structure and collate the payments data for reporting purposes. The EU has published an XSD schema for delivering the data. The general schema contains more than 70 data fields and includes information for each reportable transaction about the payee, the payee’s PSP, the payer’s PSP and transactional information.

The takeaway

CESOP can bring significant operational and challenges to PSPs. PSPs should reflect on the following questions:  

• Will we be ready for the first submission period?
• Do we have the right parties on board to kick-start the implementation project (e.g. tax, IT, operations, others)? 
• Have we registered in the relevant jurisdictions?
• Do we need external support from CESOP specialists?