Council Directive (EU) 2020/284 (“the Directive”) alongside Council Regulation (EU) 2020/283 introduced new recording and reporting obligations for Payment Service Providers (PSPs) providing payment services within the EU, applicable as of 1 January 2024. In Cyprus, it is expected that an implementing legislation will be enacted in the coming weeks.
The new regulations are designed to tackle VAT fraud, enabling national authorities of each Member State to perform investigations. The information collected by different Member States will then be exchanged between them and centralized in a European database: Central Electronic System of Payment information (CESOP). This data exchange will enable tax authorities to detect potential VAT fraud, by identifying sellers behind websites or marketplaces.
Who is in scope of the CESOP obligations?
Payment Service Providers (PSPs) operating in an EU Member State, must comply with CESOP and these include:
- Credit institutions, which include banks established in Europe and European branches of credit institutions headquartered outside the EU.
- E-money institutions, which can cover a wide range of PSPs providing electronic payment services such as electronic wallet providers and electronic voucher/card providers.
- Payment institutions encompass a wide spectrum of businesses that offer payment services, such as credit and debit card issuance, payment acquisition, payment processing, payment initiation, and more.
- Post office giro institutions, which provide payment services.
PSPs providing payment services within the EU must report payments on a quarterly basis when all the following criteria are met:
- The PSP provides payment services in a Member State of the European Union.
- A payment is made, which is an in-scope payment type. Broadly all payments covered by PSD2 are in scope, such as credit transfers, direct debits, credit cards, e-money and remittances.
- The payer is located in the European Union. Their location is typically determined by the country identifier, their IBAN or another relevant identifier if an IBAN is not involved.
- The payment is a cross-border transaction, either between two Member States or involving a third country.
- If over 25 cross-border payments are made to the same payee within a calendar quarter – the payments can come from anyone and go to the payee. If the payee has many accounts, the PSP must aggregate them.
In terms of reporting obligations, the CESOP report filing will have to be filed separately in every EU Member State where the PSP provides payment services (the host state). The report must be submitted electronically to the respective tax authorities in an XML format. The first reporting is due on the 30 April 2024.
Get ready for the ‘’go-live’’ period
PSPs had time to address a number of compliance tasks, which included the identification of all relevant data and the mapping of all relevant payment methods and payment channels within their organizations. Data adequacy and data quality issues arose during the process that needed to be handled with agility and efficiency from complying organizations.
In addition, PSPs needed to ascertain the ‘’cross-border’’ status of their payments, which often involved a number of other counterparties which complicated the overall exercise.
Furthermore, the aggregation rules proved to be challenging, given the state of readiness of relevant systems and procedures.
All of the above, will essentially need to be translated to an end-to-end reporting process whereby the extracted data will need to be converted into a prescribed XML file.
The CESOP report filing must be completed separately in each EU Member State where the PSPs have an establishment and where they provide their services (so-called home and host Member States). Therefore, numerous PSPs other than banks may have to make reports in various jurisdictions. In some instances, they might have to file distinct reports in all 27 Member States.
How can we help?
Considering the short time remaining before the CESOP regime is fully functional and the varying penalties imposed by the EU Member States for tardy or inaccurate reporting, it is important not only to define a target operating model but also to ensure that any compliance initiatives undertaken are in-line with the rules.
Innovative target operating models include full or partial outsourcing of the data processing and reporting. This includes identifying and filtering transactions, ensuring data quality, creating various reports, submitting to individual or multiple authorities, and more.
Relevant validations and quality assurance as part of the implementation phase of the CESOP compliance is of the essence as to reduce the risk of future penalties and minimize the costs of retrospective corrective action being required.
We may support you through validating your procedures through sampled extractions of the payment transactions as compared to generated reports and providing an independent review of scoping performed and of different reporting elements.
Consequences of non-compliance
Penalties and sanctions are left to the discretion of Member States. Some Member States have already announced severe penalties for non-compliance that can be multiple hundreds of thousands of euros per quarterly period. Non-compliance with the obligations under CESOP will become expensive due to the obligation to submit CESOP returns in each Member State.
Non-compliance with CESOP obligations can have consequences beyond financial penalties. Reputational damage and the risks associated with the incorrect reporting of personal data may also arise.
CESOP goes into full effect 1 January 2024, in all 27 Member States, including Cyprus. PSPs must establish a compliant target operating model and be in a position to file a return for the Q1 2024 in-scope payments before 30 April 2024. Time is limited, so seeking the aid of experts and considering the outsourcing of compliance tasks can be a valuable asset.
Please feel free to reach out to us in order to discuss in further detail the work performed to date and on tailor-made assistance with the above or other phased that your organisation may need help with.
Contacts:
Panayiotis Tziongouros
Partner | International Tax and Transaction Services
Phone: +357 22 209 740
Panayiotis.Tziongouros@cy.ey.com
Georgios Mavroyiakoumos
Assistant Manager | Indirect Tax Services
Phone: +357 22 209 980
Georgios.Mavroyiakoumos@cy.ey.com