The European Banking Authority (EBA) has updated its guidelines on ICT and security risk management, strengthening requirements for how payment service providers across the EU handle cybersecurity and operational risks.

The framework, aligned with broader EU regulations including PSD2 and the Digital Operational Resilience Act (DORA), sets expectations for both financial institutions and national supervisors to ensure consistent risk management practices across the sector.

Stronger focus on user protection and fraud prevention

A key part of the updated guidelines focuses on how payment service providers interact with customers and reduce security risks for users of digital payment services.

Banks and payment providers are expected to actively inform users about security threats, provide clear guidance on safe usage, and continuously update this information as new cyber risks emerge.

Users should also be given more control over their accounts, including the ability to disable certain payment functions where possible and adjust spending limits up to agreed thresholds.

Providers are also encouraged to offer real-time alerts for initiated or failed payment transactions, helping customers detect potential fraud or unauthorized activity more quickly.

Better communication and support obligations

The guidelines require payment service providers to keep customers informed about changes in security procedures and ensure accessible support channels for reporting issues, anomalies, or suspected fraud.

Clear guidance must be provided on how users can request assistance, while providers are expected to respond to security-related concerns in a timely and structured way.

Objective: stronger resilience in digital payments

Overall, the EBA’s updated framework aims to improve cybersecurity resilience in the EU financial system by combining stricter operational standards for institutions with stronger protections and transparency for payment service users.