EBA GL/2019/04

1. 2026-11-06 Low
   EBA outlines next steps on supervisory reporting simplification and extends implementation timelines

   The EBA has published its position on supervisory reporting simplification and extended implementation timelines based on feedback from the consultation on ITS Final Q&As 2026_7830 (geographical …

   Guidance

1. 2026-05-19 EBA publishes the consolidated version of the guidelines as amended
2. 2025-05-20 Amended guidelines apply; deadline for competent authorities to notify the EBA whether they comply with EBA/GL/2025/02
3. 2025-02-11 EBA publishes guidelines narrowing EBA/GL/2019/04 in the context of DORA
4. 2025-01-17 DORA's harmonised ICT risk management requirements start to apply

1. 2025-02-11
   EBA/GL/2019/04 as amended by EBA/GL/2025/02 AmendmentCurrent text

   Because DORA applies from 17 January 2025, the amending guidelines delete Sections 3.1 to 3.7 and the definitions, keeping only Guideline 3.8 on payment service user relationship management; they apply at the latest from 20 May 2025. source

   More

   • The PSD2 security and operational risk requirements continue to apply to payment service providers outside DORA, such as post office giro institutions and credit unions.
   • The EBA published a consolidated version on 19 May 2026.
2. 2019-11-27
   EBA/GL/2019/04 Major version

   Guidelines on ICT and security risk management for credit institutions, investment firms and payment service providers, based on Article 74 CRD and Article 95(3) PSD2; they applied from 30 June 2020 and replaced EBA/GL/2017/17. source

What remains applies to payment service providers under PSD2 and covers only how they support payment service users on security; DORA governs ICT risk management.

Addressees

Competent authorities and payment service providers under Article 1(1)(a), (b) and (d) PSD2, including exempted payment and e-money institutions. source

What remains

Guideline 3.8 on payment service user relationship management; Sections 3.1 to 3.7 (governance, risk framework, information security, ICT operations, change management and business continuity) are deleted. source

Entities outside DORA

Competent authorities or Member States that want to keep the guidelines' former approach for payment service providers outside DORA can do so under national law or supervisory measures. source

Payment service providers apply the remaining guideline themselves; competent authorities notify the EBA whether they comply.

User awareness

Payment service providers should help users understand security risks, let them disable specific payment functions where possible, adjust agreed spending limits and receive alerts on initiated or failed payment attempts (Guideline 3.8). source

Comply or explain

Competent authorities and financial institutions must make every effort to comply, and authorities had to notify the EBA by 20 May 2025 whether they comply or intend to. source

The EBA does not enforce the guidelines on firms; national competent authorities apply them through their legal frameworks or supervisory processes.

National supervisors

Competent authorities to whom the guidelines apply comply by incorporating them into their practices, for example by amending their legal framework or supervisory processes. source

Non-compliance notices

Authorities that do not notify by the deadline are considered non-compliant, and the notifications are published on the EBA website. source

1. Guidance Guidelines on ICT and security risk management - EBA page with versions and compliance table
2. Guidance Consolidated version of EBA/GL/2019/04 as amended (19 May 2026)
3. Guidance Final report - Guidelines EBA/GL/2025/02 amending EBA/GL/2019/04

1. DORA

   The EU regulation whose ICT risk management rules replaced most of these guidelines from 17 January 2025.

2. PSD2 SCA

   The PSD2 rules on strong customer authentication; these guidelines rest on PSD2 Article 95(3) on operational and security risks.

3. Germany BAIT

   BaFin's national IT requirements for German banks, also being repealed in favour of DORA.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to EBA GL/2019/04 (RSS)