Meet EBA/GL/2019/04 payment security duties with less effort

EBA/GL/2019/04 are the European Banking Authority's Guidelines on ICT and security risk management. Published in November 2019 and applicable from 30 June 2020, they set out how credit institutions, investment firms and payment service providers should manage ICT and security risks, covering governance, information security, ICT operations, project and change management, business continuity and relationships with payment service users. They replaced the earlier EBA/GL/2017/17 guidelines on security measures for payment services.

Only partly. Because DORA has applied harmonised ICT risk management rules since 17 January 2025, the EBA issued amending Guidelines EBA/GL/2025/02, applying from 20 May 2025 at the latest. They deleted paragraphs 1 to 91, covering Sections 3.1 to 3.7, and kept Section 3.8 on payment service user relationship management. Broader ICT governance, security, incident and continuity requirements for in-scope firms now come from DORA and its technical standards.

The amended guidelines are addressed to national competent authorities and to payment service providers under PSD2, including credit institutions, payment institutions, e-money institutions, account information service providers, and exempted payment and e-money institutions. In practice this means firms offering payment services to customers in the EU must apply the Section 3.8 measures on customer security awareness, alerts, spending limits and support, as implemented by their national supervisor.

Section 3.8 requires payment service providers to help customers understand payment security risks. Firms should provide security assistance and guidance and update it for new threats, let customers disable specific payment functions where possible, allow agreed spending limits to be adjusted, offer alerts on initiated or failed payment attempts, inform customers of security procedure changes, and provide support for security questions and anomaly reports, explaining how to obtain that help.

The guidelines do not set fines themselves. Under the EBA Regulation, competent authorities and firms must make every effort to comply, and national supervisors apply them through their own rules and supervisory processes. Shortcomings can therefore lead to supervisory findings or enforcement under national law implementing PSD2. Sanctions depend on the Member State and the supervisor involved, so check your local regulator's approach.

DORA now covers the ICT risk management, incident, testing and third party topics that Sections 3.1 to 3.7 of EBA/GL/2019/04 used to address, so in-scope firms follow DORA for those areas. ISO 27001 is a voluntary, certifiable information security standard that can support both, as many of its controls overlap. Neither replaces Section 3.8, which deals specifically with security measures for payment service users.

Start by confirming whether your national supervisor applies EBA/GL/2019/04 as amended and to which of your services. Then document processes for customer security guidance, payment function controls, spending limit adjustments, transaction alerts, security notices and customer support. Assign owners, keep the guidance current as threats change, and retain evidence that each measure operates, so you can show your supervisor the guidelines are applied.

EBA/GL/2019/04 is mapped in OneClickComply's control library and is available on request rather than as a live framework today. Once enabled, you can manage the Section 3.8 measures with automated evidence collection, AutoComplete policies and continuous monitoring, and reuse that work across other frameworks. Our in-house audit team can also help you interpret how the guidelines fit with DORA.