{"text_format":"1","workbook":"xlsx","n_sheets":7,"sheets":["General","A-Initial report","B-Intermediate report","Menus (sheet to hide)","Cell links","C-Final report","Explanatory notes"],"not_rendered":{"charts":0,"images":0,"macros":1,"external_links":0,"defined_names":29,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"General","index":0,"n_rows":18,"n_cols":7,"rows_kept":18,"cut":false,"hidden":false,"merged":[[1,0,2,12],[13,4,13,5],[16,4,16,5],[7,1,8,12],[14,4,15,5],[16,6,16,12],[14,6,15,12],[7,0,8,0],[4,2,5,12],[17,6,17,12],[12,4,12,5],[12,6,12,12],[13,6,13,12],[13,0,13,1]]}
[]
["Major Incident Report - INSTRUCTIONS TO FILL OUT THE TEMPLATE"]
[]
[]
["0.",null,"Please enable VBA macros to ensure the correct functioning of the tool: File -> Options -> Trust Center -> Trust Center Settings -> Enable all macros -> OK. You may need to close Excel and open the file again."]
[]
[]
["1.","Payment service providers should fill out the relevant section of the template, depending on the reporting phase they are in: section A for the initial report, section B for intermediate reports and section C for the final report. Payment service providers should use the same file when submitting the initial, intermediate and final reports related to the same incident. All fields are mandatory, unless it is clearly specified otherwise."]
[]
[]
["2.","Please, select the type of report:"]
[]
[null,null,"Type of report submitted","Report that is being submitted","Deadlines",null,"Explanatory notes"]
[null,null,"Initial report ",null,"within 4 hours after classification",null,"The initial report is the first notification that the PSP submits to the competent authority in the home Member State."]
[null,null,"Intermediate report",null,"maximum of 3 working days from the submission of the initial report",null,"The intermediate report provides a more detailed description of the incident and its consequences. It is an update of the initial report (and where applicable to a previous intermediate report) on the same incident. It informs the competent authority in the home Member State that regular activities have been recovered and business is back to normal."]
[]
[null,null,"Final report",null,"within 20 working days after the submission of the intermediate report",null,"The final report is the last report the PSP will send on the incident since, i) a root cause analysis has already been carried out and estimations can be replaced with real figures or ii) the incident is not considered major anymore and need to be reclassified."]
[null,null,"Incident reclassified as non-major",null,null,null,"An incident reclassified as non-major refers when it does not longer fulfil the criteria to be considered major and is not expected to fulfil them before it is solved. PSPs should explain the reasons for this reclassification."]

{"sheet":"A-Initial report","index":1,"n_rows":41,"n_cols":16,"rows_kept":41,"cut":false,"hidden":false,"merged":[[1,0,2,11],[4,2,4,3],[6,2,6,3],[10,1,10,11],[11,1,11,11],[6,7,6,8],[7,2,7,3],[23,2,23,11],[14,1,14,11],[15,2,15,11],[16,2,16,11],[17,2,17,11],[18,2,18,11],[19,2,19,3],[19,5,19,8],[19,10,19,11],[20,2,20,3],[20,5,20,8],[20,10,20,11],[21,1,21,11],[22,2,22,11],[35,2,35,11],[28,2,28,11],[24,2,24,3],[24,5,24,8],[24,10,24,11],[25,2,25,3],[25,5,25,8],[25,10,25,11],[42,2,42,3],[43,2,43,3],[44,2,44,3],[41,2,41,3],[26,1,26,11],[29,4,29,7],[29,8,29,11],[32,2,32,11],[37,0,37,4],[40,2,40,3],[31,2,31,11],[34,4,34,7],[34,8,34,11],[27,2,27,11],[33,2,33,11],[39,1,39,3],[60,2,60,3],[61,2,61,3],[57,2,57,3],[58,2,58,3],[59,2,59,3],[56,2,56,3],[48,2,48,3],[49,2,49,3],[50,2,50,3],[45,2,45,3],[51,2,51,3],[52,2,52,3],[53,2,53,3],[54,2,54,3],[55,2,55,3],[46,2,46,3],[47,2,47,3]]}
[]
["Major Incident Report"]
[]
[]
[null,"Initial report ","within 4 hours after classification of the incident as major",null,null,null,null,null,"Initial report"]
[]
[null,"Report date (DD/MM/YYYY)",null,null,null,"Time (HH:MM)"]
[null,"Incident reference code"]
[null,null,null,null,null,null,null,null,null,null,null,null,true]
[]
[null,"A - Initial report"]
[null,"A 1 - GENERAL DETAILS"]
[null,"Type of report"]
[null,"Type of report"]
[null,"Affected payment service provider (PSP)"]
[null,"PSP name"]
[null,"PSP national identification number"]
[null,"Head of group, if applicable"]
[null,"Country / countries affected by the incident"]
[null,"Primary contact person",null,null,"Email",null,null,null,null,"Telephone"]
[null,"Secondary contact person",null,null,"Email",null,null,null,null,"Telephone"]
[null,"Reporting entity (complete this section if the reporting entity is not the affected PSP in case of delegated reporting)",null,null,null,null,null,null,null,null,null,null,null,null,null," "]
[null,"Name of the reporting entity"]
[null,"National identification number"]
[null,"Primary contact person",null,null,"Email",null,null,null,null,"Telephone"]
[null,"Secondary contact person",null,null,"Email",null,null,null,null,"Telephone"]
[null,"A 2 - INCIDENT DETECTION and CLASSIFICATION"]
[null,"Date and time of detection of the incident (DD/MM/YYYY HH:MM)"]
[null,"Date and time of classification of the incident (DD/MM/YYYY HH:MM)"]
[null,"The incident was detected by",null,null,"If 'Other', please specify:",null,null,null,null,null,null,null,null,"payment service user"]
[null,"Type of Incident"]
[null,"Criteria triggering the major incident report"]
[null,"A short and general description of the incident"]
[null,"Impact in other EU Member States, if applicable"]
[null,"Reporting to other authorities",null,null,"If 'Yes', please specify:"]
[null,"Reasons for late submission of the initial report"]
[]
["In case the reporting is done on a consolidated basis, please complete the following table:"]
[]
[null,"CONSOLIDATED REPORT - LIST OF PSPs"]
[null,"PSP Name","PSP Unique Identification Number"]

{"sheet":"B-Intermediate report","index":2,"n_rows":81,"n_cols":14,"rows_kept":81,"cut":false,"hidden":false,"merged":[[21,7,21,11],[1,0,2,11],[4,2,4,3],[6,2,6,3],[7,2,7,3],[11,1,11,11],[12,1,12,11],[6,7,6,8],[13,1,13,11],[18,7,18,11],[17,2,17,11],[14,2,14,11],[15,2,15,11],[16,2,16,11],[19,7,19,11],[20,7,20,11],[22,2,22,4],[22,5,22,11],[23,2,23,4],[23,5,23,11],[26,2,26,11],[25,7,25,11],[27,1,27,11],[28,1,33,1],[29,4,29,7],[30,4,30,7],[31,4,31,7],[33,3,33,11],[34,1,36,1],[35,4,35,7],[35,10,35,11],[36,4,36,7],[36,10,36,11],[37,1,39,1],[38,2,39,5],[38,7,39,11],[40,1,41,1],[41,10,41,11],[40,2,40,3],[41,2,41,3],[42,1,44,1],[43,4,43,7],[43,10,43,11],[44,4,44,7],[44,10,44,11],[42,2,42,3],[45,1,47,1],[46,2,47,5],[46,7,47,11],[48,1,50,1],[49,2,50,5],[49,7,50,11],[45,2,45,3],[65,1,65,11],[66,1,67,1],[66,4,66,5],[67,4,67,6],[51,1,53,1],[52,2,53,5],[52,7,53,11],[54,1,54,11],[56,1,63,1],[57,7,57,11],[58,7,58,11],[60,7,60,11],[64,4,64,6],[64,7,64,11],[61,7,63,11],[71,2,71,3],[71,4,71,11],[76,1,76,11],[77,2,77,11],[80,2,80,11],[79,2,79,11]]}
[]
["Major Incident Report"]
[]
[]
[null,"Intermediate report","maximum of 3 working days from the submission of the initial report",null,null,null,null,null,"Intermediate report"]
[]
[null,"Report date (DD/MM/YYYY)",null,null,null,"Time (HH:MM)"]
[null,"Incident reference code"]
[]
[]
[]
[null,"B - Intermediate report"]
[null,"B 1 - GENERAL DETAILS"]
[null,"More detailed description of the incident:"]
[null,"What is the specific issue?"]
[null,"How did the incident start?"]
[null,"How did it evolve? "]
[null,"What are the consequences (in particular for payment service users)?"]
[null,"Was the incident communicated to payment service users?",null,null,"If 'Yes', please specify:"]
[null,"Was it related to a previous incident/s?",null,null,"If 'Yes', please specify:"]
[null,"Were other service providers/third parties affected or involved?",null,null,"If 'Yes', please specify:"]
[null,"Was crisis management started (internal and/or external)?",null,null,"If 'Yes', please specify:"]
[null,"Date and time of beginning of the incident \n(if already identified) (DD/MM/YYYY HH:MM)"]
[null,"Date and time when the incident was restored or is expected to be restored (DD/MM/YYYY HH:MM)"]
[null,"Functional areas affected"]
[null,null,null,null,null,"If 'Other', please specify:"]
[null,"Changes made to previous reports"]
[null,"B 2 - INCIDENT CLASSIFICATION / INFORMATION ON THE INCIDENT"]
[null,"Transactions affected (2) ","Impact level",null,null,null,null,null,null,null,null,null,null,"> 10 % of regular level of transactions and > EUR100,000"]
[null,null,"Number of transactions affected",null,null,null,null,null,null,null,null,null,null,"> 25 % of regular level of transactions or > EUR5M"]
[null,null,"As a % of regular number of transactions",null,null,null,null,null,null,null,null,null,null,"none of the above"]
[null,null,"Value of transactions affected in EUR"]
[null,null,"Duration of the incident (only applicable to operational incidents)"]
[null,null,"Comments:"]
[null,"Payment service users affected (3)","Impact level",null,null,null,null,null,null,null,null,null,null,"> 5,000 and > 10 % payment service users"]
[null,null,"Number of payment service users affected",null,null,null,null,null,null,null,null,null,null,"\n> 50,000 or > 25 % payment service users"]
[null,null,"As a % of total payment service users",null,null,null,null,null,null,null,null,null,null,"none of the above"]
[null,"Breach of security of network or information systems"]
[null,null,"Describe how the network or information systems have been affected"]
[]
[null,"Service downtime",null,null,"Days:",null,"Hours: ",null,"Minutes:",null,null,null,null,"> 2 hours"]
[null,null,"Total service downtime:",null,null,null,null,null,null,null,null,null,null,"< 2 hours"]
[null,"Economic impact","Impact level",null,null,null,null,null,null,null,null,null,null,"> Max (0,1 % Tier-1 capital, EUR200,000) or > EUR5,000,000"]
[null,null,"Direct costs in EUR ",null,null,null,null,null,null,null,null,null,null,"none of the above"]
[null,null,"Indirect costs in EUR "]
[null,"High level of internal escalation"]
[null,null,"Describe the level of internal escalation of the incident,\nindicating if it has triggered or is likely to trigger a crisis mode (or equivalent) and if so, please describe"]
[]
[null,"Other PSPs or relevant infrastructures potentially affected"]
[null,null,"Describe how this incident could affect other PSPs\nand/or infrastructures"]
[]
[null,"Reputational impact",null,"                        "]
[null,null,"Describe how the incident could affect the reputation of the PSP (e.g. media coverage, publication of legal actions or infringements of law...)"]
[]
[null,"B 3 - INCIDENT DESCRIPTION"]
[null,"Type of Incident"]
[null,"Cause of incident"]
[]
[]
[]
[]
[]
[null,null,null,null,"If 'Other', please specify:"]
[]
[null,"Was the incident affecting you directly, or indirectly through a service provider?",null,null,"If 'Indirectly', please provide the service provider's name:"]
[null,"B 4 - INCIDENT IMPACT"]
[null,"Overall impact"]
[]
[null,"Commercial channels affected"]
[]
[]
[null,null,"If 'Other', please specify:"]
[null,"Payment services affected"]
[]
[]
[]
[null,"B 5 - INCIDENT MITIGATION"]
[null,"Which actions/measures have been taken so far or are planned to recover from the incident?"]
[null,"Have the Business Continuity Plan and/or Disaster Recovery Plan been activated?"]
[null,"If so, when? (DD/MM/YYYY HH:MM)"]
[null,"If so, please describe "]

{"sheet":"Menus (sheet to hide)","index":3,"n_rows":30,"n_cols":30,"rows_kept":30,"cut":false,"hidden":true,"merged":[]}
["Individual","Payment service user","Operational","AT","Actual figure","Directly","Yes","Transactions affected","Yes","Yes","Malicious action","Process failure","System failure","Human error","External event","Other","< 1 hour","Direct costs",null,"Yes",null,null,null,"< 2 hours","Highly effective",null,"Final report","Lower impact level (>10% of the regular level of transactions or >EUR 500,000)","Lower impact level (>5000 or >10% payment service users)",">Max (0.1% Tier-1 capital, EUR 200,000)"]
["Consolidated","Internal organisation","Security","BE","Estimation","Indirectly","No","Payment service users affected","No","No","Malicious code","Deficient monitoring and control","Hardware failure","Unintended","Failure of a supplier/technical service provider",null,">= 1 hour","Indirect costs",null,"Yes, and crisis mode (or equivalent) is likely to be called upon",null,null,null,">= 2 hours","Moderately effective",null,"Incident reclassified as non-major ","Higher impact level (>25% of regular level of transactions or >EUR 15,000,000)","Higher impact level (>50,000 or >25% payment service users)",">EUR 5,000,000"]
[null,"External organisation","Not yet known","BG","Not yet available",null,"High level of internal escalation","Service downtime",null,"Original controls were not cancelled or weakened at any time during the incident","Information gathering","Communication issues","Network failure","Inaction","Force majeure",null,null,null,null,"No",null,null,null,null,"Not effective",null,null,"None of the above","None of the above","None of the above"]
[null,"Other",null,"CY",null,null,null,"Breach of security measures",null,null,"Intrusions","Operations","Database issues","Insufficient resources","Others (please specify) ",null,null,null,null,null,null,null,null,null,"Not yet available"]
[null,null,null,"CZ",null,null,null,"Economic impact",null,null,"Distributed/Denial of service attack (D/DoS)","Change management","Software/application failure","Others (please specify) "]
[null,null,null,"DE",null,null,null,"High level of internal escalation",null,null,"Deliberate internal actions","Inadequacy of internal procedures and documentation","Physical damage"]
[null,null,null,"DK",null,null,null,"Other PSPs or relevant infrastructures potentially affected",null,null,"Deliberate external physical damage","Recovery","Others (please specify) "]
[null,null,null,"EE",null,null,null,"Reputational impact",null,null,"Information context security","Others (please specify) "]
[null,null,null,"ES",null,null,null,null,null,null,"Fraud"]
[null,null,null,"FI",null,null,null,null,null,null,"Others (please specify) "]
[null,null,null,"FR"]
[null,null,null,"GB",null,null,null,null,null,null,"Malicious action","malic"]
[null,null,null,"GR",null,null,null,null,null,null,"Process failure","p_failure"]
[null,null,null,"HR",null,null,null,null,null,null,"System failure","syst_fail"]
[null,null,null,"HU",null,null,null,null,null,null,"Human error","human"]
[null,null,null,"IE",null,null,null,null,null,null,"External event","external"]
[null,null,null,"IS",null,null,null,null,null,null,"Others (please specify) "]
[null,null,null,"IT"]
[null,null,null,"LT"]
[null,null,null,"LU"]
[null,null,null,"LV"]
[null,null,null,"MT"]
[null,null,null,"NL"]
[null,null,null,"NO"]
[null,null,null,"PL"]
[null,null,null,"PT"]
[null,null,null,"RO"]
[null,null,null,"SE"]
[null,null,null,"SI"]
[null,null,null,"SK"]

{"sheet":"Cell links","index":4,"n_rows":146,"n_cols":5,"rows_kept":146,"cut":false,"hidden":true,"merged":[]}
["Sheet","Cell","Option","Value","Type"]
["Start","Initial report"]
["Start","Intermediate report"]
["Start","Final report"]
["Initial report","Criteria tiggering main event","Transaction affected"]
["Initial report","Criteria tiggering main event","Payment service users affected"]
["Initial report","Criteria tiggering main event","Service downtime"]
["Initial report","Criteria tiggering main event","Breach of security measures"]
["Initial report","Criteria tiggering main event","Economic impact"]
["Initial report","Criteria tiggering main event","High level of internal escalation"]
["Initial report","Criteria tiggering main event","Other PSPs or relevant infrastructures potentially affected"]
["Initial report","Criteria tiggering main event","Reputational impact"]
["Initial report","Type of report",null,null,"dropdown"]
["Initial report","Country affected","AT"]
["Initial report","Country affected","BE"]
["Initial report","Country affected","BG"]
["Initial report","Country affected","CY"]
["Initial report","Country affected","CZ"]
["Initial report","Country affected","DE"]
["Initial report","Country affected","DK"]
["Initial report","Country affected","EE"]
["Initial report","Country affected","ES"]
["Initial report","Country affected","FI"]
["Initial report","Country affected","FR"]
["Initial report","Country affected","LI"]
["Initial report","Country affected","GR"]
["Initial report","Country affected","HR"]
["Initial report","Country affected","HU"]
["Initial report","Country affected","IE"]
["Initial report","Country affected","IS"]
["Initial report","Country affected","IT"]
["Initial report","Country affected","LT"]
["Initial report","Country affected","LU"]
["Initial report","Country affected","LV"]
["Initial report","Country affected","MT"]
["Initial report","Country affected","NL"]
["Initial report","Country affected","NO"]
["Initial report","Country affected","PL"]
["Initial report","Country affected","PT"]
["Initial report","Country affected","RO"]
["Initial report","Country affected","SE"]
["Initial report","Country affected","SI"]
["Initial report","Country affected","SK"]
["Initial report","Incident detected by",null,null,"dropdown"]
["Initial report","Type of incident",null,null,"dropdown"]
["Initial report","Reporting to other authorities",null,null,"dropdown"]
["Intermediate report","Communicated to ps users",null,null,"dropdown"]
["Intermediate report","Previous incident",null,null,"dropdown"]
["Intermediate report","Other service providers",null,null,"dropdown"]
["Intermediate report","Crisis management started",null,null,"dropdown"]
["Intermediate report","Functional areas affected","Authentication/Authorisation"]
["Intermediate report","Functional areas affected","Clearing"]
["Intermediate report","Functional areas affected","Indirect settlement"]
["Intermediate report","Functional areas affected","Communicaton"]
["Intermediate report","Functional areas affected","Direct settlement"]
["Intermediate report","Functional areas affected","Other"]
["Intermediate report","Transaction affected",null,null,"dropdown"]
["Intermediate report","As a perc of regular number",null,null,"dropdown"]
["Intermediate report","Value of transactions",null,null,"dropdown"]
["Intermediate report","Duration value",null,null,"dropdown"]
["Intermediate report","Duration",null,null,"dropdown"]
["Intermediate report","Number of users affected",null,null,"dropdown"]
["Intermediate report","As a perc of total users",null,null,"dropdown"]
["Intermediate report","Total service downtime",null,null,"dropdown"]
["Intermediate report","Direct costs",null,null,"dropdown"]
["Intermediate report","Indirect costs",null,null,"dropdown"]
["Intermediate report","Breach security measures",null,null,"dropdown"]
["Intermediate report","Service dowtime",null,null,"dropdown"]
["Intermediate report","Economic impact",null,null,"dropdown"]
["Intermediate report","High level of internal escalation",null,null,"dropdown"]
["Intermediate report","Other psps",null,null,"dropdown"]
["Intermediate report","Reputational impact",null,null,"dropdown"]
["Intermediate report","Type of incident",null,null,"dropdown"]
["Intermediate report","Cause of incident","Under investigation"]
["Intermediate report","Cause of incident","Malicious actions",false]
["Intermediate report","Cause of incident","Process failure",false]
["Intermediate report","Cause of incident","System failure"]
["Intermediate report","Cause of incident","Human error"]
["Intermediate report","Cause of incident","External events"]
["Intermediate report","Cause of incident","Other"]
["Intermediate report","Incident affecting directly",null,null,"dropdown"]
["Intermediate report","Overall impact","Integrity"]
["Intermediate report","Overall impact","Availability"]
["Intermediate report","Overall impact","Confidentiality"]
["Intermediate report","Overall impact","Authenticity"]
["Intermediate report","Commercial channels affected","Branches"]
["Intermediate report","Commercial channels affected","E-banking"]
["Intermediate report","Commercial channels affected","E-commerce"]
["Intermediate report","Commercial channels affected","Telephone banking"]
["Intermediate report","Commercial channels affected","Mobile banking"]
["Intermediate report","Commercial channels affected","ATMs"]
["Intermediate report","Commercial channels affected","Point of sale"]
["Intermediate report","Commercial channels affected","Other"]
["Intermediate report","Payment services affected","Cash placement on a payment account"]
["Intermediate report","Payment services affected","Cash withdrawal from a payment account"]
["Intermediate report","Payment services affected","Operations required for operating a payment account"]
["Intermediate report","Payment services affected","Acquiring of payment instruments"]
["Intermediate report","Payment services affected","Credit transfers"]
["Intermediate report","Payment services affected","Direct debits"]
["Intermediate report","Payment services affected","Card payments"]
["Intermediate report","Payment services affected","Issuing of payment instruments"]
["Intermediate report","Payment services affected","Money remittance"]
["Intermediate report","Payment services affected","Payment initiation services"]
["Intermediate report","Payment services affected","Account information services"]
["Intermediate report","BCP activated",null,null,"dropdown"]
["Final report","Original controls back",null,null,"dropdown"]
["Final report","Info shared with other psps",null,null,"dropdown"]
["Final report","Legal actions taken",null,null,"dropdown"]
["Final report","Effectiveness actions",null,null,"dropdown"]
["Final report","Options Malicious action"]
["Final report","Options Process failure"]
["Final report","Options System failure"]
["Final report","Options Human error"]
["Final report","Options External event"]
["Final report","Options Malicious","Malicious code",{"$error":"#N/A"}]
["Final report","Options Malicious","Information gathering",{"$error":"#N/A"}]
["Final report","Options Malicious","Intrusions",{"$error":"#N/A"}]
["Final report","Options Malicious","Distributed/Denial of service attack (D/DoS)",{"$error":"#N/A"}]
["Final report","Options Malicious","Deliberate internal actions",{"$error":"#N/A"}]
["Final report","Options Malicious","Deliberate external physical damage",{"$error":"#N/A"}]
["Final report","Options Malicious","Information content security",{"$error":"#N/A"}]
["Final report","Options Malicious","Fraud",{"$error":"#N/A"}]
["Final report","Options Malicious","Other",{"$error":"#N/A"}]
["Final report","Options Process failure","Deficient monitoring and control",{"$error":"#N/A"}]
["Final report","Options Process failure","Communication issues",{"$error":"#N/A"}]
["Final report","Options Process failure","Improper Operations",{"$error":"#N/A"}]
["Final report","Options Process failure","Inadequate Change management",{"$error":"#N/A"}]
["Final report","Options Process failure","Inadequacy of internal procedures and documentation",{"$error":"#N/A"}]
["Final report","Options Process failure","Recovery issues",{"$error":"#N/A"}]
["Final report","Options Process failure","Other",{"$error":"#N/A"}]
["Final report","Options System failure","Hardware failure",{"$error":"#N/A"}]
["Final report","Options System failure","Network failure",{"$error":"#N/A"}]
["Final report","Options System failure","Database issues",{"$error":"#N/A"}]
["Final report","Options System failure","Software/application failure",{"$error":"#N/A"}]
["Final report","Options System failure","Physical damage",{"$error":"#N/A"}]
["Final report","Options System failure","Other",{"$error":"#N/A"}]
["Final report","Options Human error","Unintended",{"$error":"#N/A"}]
["Final report","Options Human error","Inaction",{"$error":"#N/A"}]
["Final report","Options Human error","Insufficient resources",{"$error":"#N/A"}]
["Final report","Options Human error","Other",{"$error":"#N/A"}]
["Final report","Options External event","Failure of a supplier/technical service provider",{"$error":"#N/A"}]
["Final report","Options External event","Force majeure",{"$error":"#N/A"}]
["Final report","Options External event","Other",{"$error":"#N/A"}]
["Final report","Type of report",null,null,"dropdown"]
["Intermediate report","Transaction affected thresholds",null,null,"dropdown"]
["Intermediate report","PSU affected thresholds",null,null,"dropdown"]

{"sheet":"C-Final report","index":5,"n_rows":37,"n_cols":9,"rows_kept":37,"cut":false,"hidden":false,"merged":[[25,2,25,11],[27,2,27,3],[27,4,27,11],[24,8,24,11],[16,1,16,11],[17,1,17,11],[22,2,22,11],[23,1,23,11],[18,1,18,11],[19,2,19,11],[20,2,20,11],[1,0,2,11],[4,2,4,3],[10,2,10,3],[11,2,11,3],[15,1,15,11],[10,7,10,8],[5,2,7,3],[28,2,28,11],[32,4,32,11],[32,2,32,3],[36,2,36,3],[36,4,36,11],[29,2,29,11],[30,1,30,11],[35,1,36,1],[34,4,34,11],[34,2,34,3]]}
[]
["Major Incident Report"]
[]
[]
[null,"Please select the type of report:","within 20 working days after the submission of the intermediate report",null,null,null,null,null,"Final report"]
[null,"Please describe:"]
[null,"(applicable for incidents reclassified as non-major)"]
[]
[]
[]
[null,"Report date (DD/MM/YYYY)",null,null,null,"Time (HH:MM)"]
[null,"Incident reference code "]
[]
[]
[]
[null,"C - Final report"]
[null,"If no intermediate report has been sent, please complete also section B"]
[null,"C 1 - GENERAL DETAILS"]
[null,"Update of the information from the initial report and the intermediate report(s)"]
[null,"Changes made to previous reports"]
[null,"Any other relevant information"]
[null,"Are all original controls in place?"]
[null,"If “No”, specify which controls and the additional period required for \ntheir restoration"]
[null,"C 2 - ROOT CAUSE ANALYSIS AND FOLLOW UP"]
[null,"What was the root cause (if already known)?",null,{"$f":"IFERROR((VLOOKUP(C25,'Menus (sheet to hide)'!$K$12:$L$17,2,0)),\"\")","v":""}]
[]
[null,"Please specify:"]
[null,null,"If 'Other', please specify:"]
[null,"Other relevant information on the root cause"]
[null,"Main corrective actions/measures taken or planned to prevent the incident from happening again in the future, if already known"]
[null,"C 3 - ADDITIONAL INFORMATON"]
[null,"Has the incident been shared with other PSPs for information purposes?"]
[null,null,"If 'Yes', please provide details:"]
[null,"Has any legal action been taken against the PSP?"]
[null,null,"If 'Yes', please provide details:"]
[null,"Assessment of the effectiveness of the action taken"]
[null,null,"Please provide details:"]

{"sheet":"Explanatory notes","index":6,"n_rows":163,"n_cols":1,"rows_kept":163,"cut":false,"hidden":false,"merged":[[1,0,2,11],[3,0,3,11],[4,0,4,11],[5,0,5,11],[6,0,6,11],[7,0,7,11],[14,0,14,11],[15,0,15,11],[16,0,16,11],[17,0,17,11],[18,0,18,11],[19,0,19,11],[8,0,8,11],[9,0,9,11],[10,0,10,11],[11,0,11,11],[12,0,12,11],[13,0,13,11],[26,0,26,11],[27,0,27,11],[28,0,28,11],[29,0,29,11],[30,0,30,11],[31,0,31,11],[20,0,20,11],[21,0,21,11],[22,0,22,11],[23,0,23,11],[24,0,24,11],[25,0,25,11],[38,0,38,11],[39,0,39,11],[40,0,40,11],[41,0,41,11],[42,0,42,11],[43,0,43,11],[32,0,32,11],[33,0,33,11],[34,0,34,11],[35,0,35,11],[36,0,36,11],[37,0,37,11],[50,0,50,11],[51,0,51,11],[52,0,52,11],[53,0,53,11],[54,0,54,11],[55,0,55,11],[44,0,44,11],[45,0,45,11],[46,0,46,11],[47,0,47,11],[48,0,48,11],[49,0,49,11],[62,0,62,11],[63,0,63,11],[64,0,64,11],[65,0,65,11],[66,0,66,11],[67,0,67,11],[56,0,56,11],[57,0,57,11],[58,0,58,11],[59,0,59,11],[60,0,60,11],[61,0,61,11],[74,0,74,11],[75,0,75,11],[76,0,76,11],[77,0,77,11],[78,0,78,11],[79,0,79,11],[68,0,68,11],[69,0,69,11],[70,0,70,11],[71,0,71,11],[72,0,72,11],[73,0,73,11],[86,0,86,11],[87,0,87,11],[88,0,88,11],[89,0,89,11],[90,0,90,11],[91,0,91,11],[80,0,80,11],[81,0,81,11],[82,0,82,11],[83,0,83,11],[84,0,84,11],[85,0,85,11],[98,0,98,11],[99,0,99,11],[100,0,100,11],[101,0,101,11],[102,0,102,11],[103,0,103,11],[92,0,92,11],[93,0,93,11],[94,0,94,11],[95,0,95,11],[96,0,96,11],[97,0,97,11],[110,0,110,11],[111,0,111,11],[112,0,112,11],[113,0,113,11],[114,0,114,11],[115,0,115,11],[104,0,104,11],[105,0,105,11],[106,0,106,11],[107,0,107,11],[108,0,108,11],[109,0,109,11],[122,0,122,11],[123,0,123,11],[124,0,124,11],[125,0,125,11],[126,0,126,11],[127,0,127,11],[116,0,116,11],[117,0,117,11],[118,0,118,11],[119,0,119,11],[120,0,120,11],[121,0,121,11],[134,0,134,11],[135,0,135,11],[136,0,136,11],[137,0,137,11],[138,0,138,11],[139,0,139,11],[128,0,128,11],[129,0,129,11],[130,0,130,11],[131,0,131,11],[132,0,132,11],[133,0,133,11],[146,0,146,11],[147,0,147,11],[148,0,148,11],[149,0,149,11],[150,0,150,11],[151,0,151,11],[140,0,140,11],[141,0,141,11],[142,0,142,11],[143,0,143,11],[144,0,144,11],[145,0,145,11],[158,0,158,11],[159,0,159,11],[160,0,160,11],[161,0,161,11],[162,0,162,11],[152,0,152,11],[153,0,153,11],[154,0,154,11],[155,0,155,11],[156,0,156,11],[157,0,157,11]]}
[]
["Major Incident Report - EXPLANATORY NOTES"]
[]
["Headline"]
["Initial report: it is the first notification that the PSP submits to the competent authority in the home Member State"]
["Intermediate report: contains a more detailed description of the incident and its consequences. It is an update of the initial report (and where applicable to a previous intermediate report) on the same incident."]
["Final report: it is the last report the PSP will send on the incident since, i) a root cause analysis has already been carried out and estimations can be replaced with real figures or ii) the incident is not considered major anymore and need to be reclassified."]
["Incident reclassified as non-major: the incident no longer fulfils the criteria to be considered major and is not expected to fulfil them before it is solved. PSPs should explain the reasons for this reclassification."]
["Report date and time: exact date and time of submission of the report to the competent authority."]
["Incident reference code (applicable for intermediate and final reports, as well as for updates on the initial report): the reference code issued by the competent authority at the time of the initial report to unequivocally identify the incident. Each CA should include as prefix the 2-digit ISO code  of their respective Member State. "]
["A - Initial report"]
["A 1 - GENERAL DETAILS"]
["Type of report"]
["Individual: the report refers to a single PSP."]
["Consolidated: the report refers to several PSPs within the same Member State that are affected by the same major operational or security incident, which make use of the consolidated reporting. The fields under ’Affected PSP’ should be left blank (with the exception of the field ’Country/Countries affected by the incident’) and a list of the PSPs included in the report should be provided filling in the corresponding table (Consolidated report – List of PSPs)."]
["Affected payment service provider (PSP)"]
["This section refers to the PSP that is experiencing the incident."]
["PSP name: full name of the PSP subject to the reporting procedure as it appears in the applicable official national PSP registry.  "]
["PSP national identification number: the unique national identification number used by the competent authority of the home Member State in its national register to identify the PSP unequivocally."]
["Head of group: in case of groups of entities as defined in article 4(40) of Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) 1093/2010 and repealing Directive 2007/64/EC, please indicate the name of the head entity."]
["Country/countries affected by the incident: country or countries where the impact of the incident has materialised (e.g. several branches of a PSP located in different countries are affected), irrespective of the severity of the incident in the other country/countries. It may or may not be the same as the home Member State."]
["Primary contact person: name and surname of the person responsible for reporting the incident or, in the case that a third service provider reports on behalf of the affected PSP, name and surname of the person in charge of the incident management/risk department or similar area, at the affected PSP"]
["Email: email address to which any requests for further clarifications could be addressed, if needed. It can be either a personal or a corporate email."]
["Telephone: telephone number through which any requests for further clarifications could be addressed, if needed. It can be either a personal or a corporate phone number."]
["Secondary contact person: name and surname of an alternate person that could be contacted by the competent authority to inquiry about an incident when the primary contact person is not available. In case a third service provider reports on behalf of the affected PSP, name and surname of an alternate person in the incident management/risk department or similar area, at the affected PSP."]
["Email: email address of the alternate contact person to which any requests for further clarifications could be addressed, if needed. It can be either a personal or a corporate email address."]
["Telephone: telephone number through which any requests for further clarifications could be addressed, if needed. It can be either a personal or a corporate phone number."]
["Reporting entity (complete this section if the reporting entity is not the affected PSP in case of delegated reporting)"]
["This section should be completed in case that a third party fulfils the reporting obligations on behalf of the affected PSP."]
["Name of the reporting entity: full name of the entity that reports the incident, as it appears in the applicable official national business registry. "]
["National identification number: the unique national identification number used in the country where the third party is located to identify the entity that is reporting the incident unequivocally. In case the reporting third party is a PSP, the national identification number should be the unique national identification number of the PSP used by the competent authority of the home Member State in its national register."]
["Primary contact person: name and surname of the person responsible for reporting the incident."]
["Email: email address to which any requests for further clarifications could be addressed, if needed. It can be either a personal or a corporate email."]
["Telephone: telephone number through which any requests for further clarifications could be addressed, if needed. It can be either a personal or a corporate phone number."]
["Secondary contact person: name and surname of an alternate person in the entity that is reporting the incident that could be contacted by the competent authority when the primary contact person is not available. "]
["Email: email address of the alternate contact person to which any requests for further clarifications could be addressed, if needed. It can be either a personal or a corporate email address."]
["Telephone: telephone number of the alternate contact person through which any requests for further clarifications could be addressed, if needed. It can be either a personal or a corporate phone number"]
["A 2 - INCIDENT DETECTION and INITIAL CLASSIFICATION"]
["Date and time of detection of the incident: date and time at which the incident was first identified."]
["Date and time of classification of the incident: date and time at which the security or operational incident has been classified as major."]
["Incident detected by: indicate whether the incident was detected by a payment service user, within the PSP (e.g. internal audit function) or another external party (e.g. service provider). If it was none of those, please provide an explanation in the corresponding field."]
["Type of Incident: indicate whether, to the best of your knowledge and if the information is available, it is an operational or a security incident."]
["Operational: incident stemming from inadequate or failed processes, people and systems or events of force majeure that affect the integrity, availability, confidentiality and/or authenticity of payment-related services."]
["Security: unauthorised access, use, disclosure, disruption, modification, or destruction of the PSP’s assets that affect the integrity, availability, confidentiality and/or authenticity of payment-related services. This may happen, among other things, when the PSP experiences a breach of security of network or information systems."]
["Criteria triggering the major incident report: please indicate which of the criteria have triggered the major incident report. Multiple choices may be selected between the criteria: transactions affected, payment service users affected, service downtime, breach of security of network or information systems, economic impact, high level of internal escalation, other PSPs or relevant infrastructures potentially affected, and/or reputational impact."]
["A short and general description of the incident: please explain briefly the most relevant issues of the incident, covering possible causes, immediate impacts, etc."]
["Impact in other EU Member States, if applicable: please explain briefly the impact the incident had in another EU Member State (e.g. on payment service users, payment service providers and/or payment infrastructures). If feasible within the applicable reporting deadlines, please provide a translation in English."]
["Reporting to other authorities: please indicate whether the incident has been/will be reported to other authorities under separate incident reporting frameworks, if known at the time of reporting. If so, please specify the respective authorities."]
["Reasons for late submission of the initial report: please explain the reasons why you required longer time than 24 hours to classify the incident."]
["B - Intermediate report"]
["B 1 - GENERAL DETAILS"]
["More detailed description of the incident: please, describe the main features of the incident, covering at least the information on the specific issue and the related background, the description of how the incident started and evolved, and the consequences, especially for payment service users, etc. Please also provide information about the communication with payment service users, if applicable."]
["Incident related to previous incidents – please indicate whether or not the incident is related to previous incidents, in case this information is available. If the incident has been related to previous incidents, please specify which ones."]
["Incident affecting other service providers/third parties – please indicate whether or not the incident has affected or involved other service providers/third parties, in case this information is available. If the incident has affected or involved other service providers/third parties, please list them and provide more information."]
["Crisis management started – please indicate whether or not crisis management (internal and/or external) has started. If crisis management has started, please provide more information."]
["Date and time of beginning of the incident: date and time at which the incident started, if known."]
["Date and time when the incident was restored or is expected to be restored: indicate the date and time when the incident was or is expected to be under control and business was or is expected to be back to normal."]
["Functional areas affected: indicate the step or steps of the payment process that have been impacted by the incident, such as authentication/authorisation, communication, clearing, direct settlement, indirect settlement and others."]
["Authentication/authorisation: procedures which allow the PSP to verify the identity of a payment service user or the validity of the use of a specific payment instrument, including the use of the user’s personalised security credentials, and the payment service user (or a third party acting on behalf of that user) giving his/her consent in order to transfer funds."]
["Communication: flow of information for the purpose of identification, authentication, notification and information between account servicing PSP and payment initiation service providers, account information service providers, payers, payees and other PSPs."]
["Clearing: a process of transmitting, reconciling and, in some cases, confirming transfer orders prior to settlement, potentially including the netting of orders and the establishment of final positions for settlement."]
["Direct settlement: the completion of a transaction or of processing with the aim of discharging participants’ obligations through the transfer of funds, when this action is carried out by the affected PSP itself."]
["Indirect settlement: the completion of a transaction or of processing with the aim of discharging participants’ obligations through the transfer of funds, when this action is carried out by another PSP on behalf of the affected PSP."]
["Other: the functional area affected is none of the above. Further details should be provided in the free text field."]
["Changes made to previous reports: please indicate the changes made to the information provided with previous reports related to the same incident (e.g. the initial or, where applicable, an intermediate report)."]
["B 2 - INCIDENT CLASSIFICATION / INFORMATION ON THE INCIDENT"]
["Transactions affected: PSPs should indicate which thresholds are or will likely be reached by the incident, if any, and the related figures: number of transactions affected, percentage of transactions affected in relation to the number of payment transactions carried out with the same payment services that have been affected by the incident and total value of the transactions. PSPs should provide concrete values for these variables, which may be either actual figures or estimations. As a general rule, PSPs should understand as ‘transactions affected’ all domestic and cross-border transactions that have been or will likely be directly or indirectly impacted by the incident and, in particular, those transactions that could not be initiated or processed, those for which the content of the payment message was altered, and those that were fraudulently ordered (have the funds been recovered or not). Furthermore, PSPs should understand the regular level of payment transactions to be the daily annual average of domestic and cross-border payment transactions carried out with the same payment services that have been affected by the incident, taking the previous year as the reference period for calculations. In case PSPs do not consider this figure to be representative (e.g. due to seasonality), they should use another more representative metric instead and convey to the competent authority the underlying rationale for this approach in the field ‘Comments’. In the cases where payment transactions in non-Euro currencies are affected by the incident, when calculating the thresholds and reporting the value of the transactions affected, PSPs should convert the amount of the transactions in non-Euro currency to Euro by using the ECB daily reference exchange rate for the day preceding the submission of the incident report."]
["Payment service users affected: PSPs should indicate which thresholds are or will likely be reached by the incident, if any, and the related figures: total number of payment service users that have been impacted and percentage of payment service users affected in relation to the total number of payment service users. PSPs should provide concrete values for these variables, which may be either actual figures or estimations. PSPs should understand as ‘payment service users affected’ all customers (either domestic or from abroad, consumers or corporates) that have a contract with the affected payment service provider that grants them access to the affected payment service, and that have suffered or will likely suffer the consequences of the incident. PSPs should recur to estimations based on past activity in order to determine the number of payment service users that may have been using the payment service during the lifetime of the incident. In the case of groups, each PSP should only consider their own payment service users. In the case of a PSP offering operational services to others, that PSP should only consider its own payment service users (if any), and the PSPs receiving those operational services should also assess the incident in relation to their own payment service users. Furthermore, PSPs should take as the total number of payment service users the aggregated figure of domestic and cross-border payment service users contractually bound with them at the time of the incident (or, alternatively, the most recent figure available) and with access to the affected payment service, regardless of their size or whether they are considered active or passive payment service users.  "]
["Breach of security of network or information systems:  PSPs should determine whether any malicious action has compromised the availability, authenticity, integrity or confidentiality of network or information systems (including data) related to the provision of payment services."]
["Service downtime: PSPs should indicate whether the threshold is or will likely be reached by the incident and the related figure: total service downtime. PSPs should provide concrete values for this variable, which may be either actual figures or estimations. PSPs should consider the period of time that any task, process or channel related to the provision of payment services is or will likely be down and, thus, prevents i) the initiation and/or execution of a payment service and/or, ii) access to a payments account. PSPs should count the service downtime from the moment the downtime starts, and they should consider both the time intervals when they are open for business as required for the execution of payment services as well as the closing hours and maintenance periods, where relevant and applicable. If payment service providers are unable to determine when the service downtime started, they should exceptionally count the service downtime from the moment the downtime is detected."]
["Economic impact: PSPs should indicate whether the threshold is or will likely be reached by the incident and the related figures: direct costs and indirect costs. PSPs should provide concrete values for these variables, which may be either actual figures or estimations. PSPs should consider both the costs that can be connected to the incident directly and those which are indirectly related to the incident. Among other things, PSPs should take into account expropriated funds or assets, replacement costs of hardware or software, other forensic or remediation costs, fees due to non-compliance of contractual obligations, sanctions, external liabilities and lost revenues. As regards the indirect costs, PSPs should only consider those that are already known or very likely to materialise. In the cases where the costs are in non-Euro currencies, when calculating the threshold and reporting the value of the economic impact, PSPs should convert the amount of the costs in non-Euro currency to Euro by using the ECB daily reference exchange rate for the day preceding the submission of the incident report."]
["Direct costs: amount of money (euro) directly caused by the incident, including those needed for the correction of the incident (e.g. expropriated funds or assets, replacement costs of hard‐ and software, fees due to non‐compliance to contractual obligations)."]
["Indirect costs: amount of money (euro) indirectly caused by the incident (e.g. customer redress/compensation costs, potential legal costs)."]
["High level of internal escalation: Payment service providers should consider whether, as a result of its impact on payment-related services, the management body as defined by EBA Guidelines on ICT and security risk management has been or will likely be informed, in line with Guideline 60(d) of the EBA Guidelines on ICT and security risk management, about the incident outside any periodical notification procedure and on a continuous basis throughout the lifetime of the incident. Furthermore, payment service providers should consider whether, as a result of the impact of the incident on payment-related services, a crisis mode has been or is likely to be triggered. "]
["Other PSPs or relevant infrastructures potentially affected: payment service providers should assess the impact of the incident on the financial market, understood as the financial market infrastructures and/or payment schemes that support it and the rest of PSPs. In particular, PSPs should assess whether the incident has been or will likely be replicated at other PSPs, whether it has affected or will likely affect the smooth functioning of financial market infrastructures or whether it has compromised or will likely compromise the solidity of the financial system as a whole. PSPs should bear in mind various dimensions such as whether the component/software affected is proprietary or generally available, whether the compromised network is internal or external or whether the PSP has stopped or will likely stop fulfilling its obligations in the financial market infrastructures it is a member of."]
["Reputational impact: PSPs should consider the level of visibility that, to their best knowledge, the incident has gained or will likely gain in the marketplace. In particular, PSPs should consider the likelihood of the incident to cause harm to the society as a good indicator of its potential to impact their reputation. PSPs should take into account whether i) payment service users and/or other payment service providers have complained about the adverse impact of the incident, ii) the incident has impacted a visible payment service related process and is therefore likely to receive or has already received media coverage (considering not only traditional media, such as newspapers, but also blogs, social networks, etc. However, media coverage in this context means not only a few negative comments by followers, but there should be a valid report or a significant number of negative comments/alerts.), iii) contractual obligations have been or will likely be missed, resulting in the publication of legal actions towards the payment service provider, iv) regulatory requirements have not been complied with, resulting in the imposition of supervisory measures or sanctions that have been or will likely be made publicly available or v) similar type of incident has occurred before. "]
["B 3 - INCIDENT DESCRIPTION"]
["Type of Incident: operational or security. Further explanation is provided in the corresponding field in the initial report.  "]
["Cause of incident: indicate the cause of the incident and, if it is not known yet, the one that is the most likely to be. Multiple choices may be selected."]
["Under investigation – please check the box when the cause is currently unknown."]
["Malicious action – actions intentionally targeting the PSP. These cover malicious code, information gathering, intrusions, distributed/denial of service attack (D/DoS), deliberate internal actions, deliberate external physical damage, information content security, fraudulent actions and others. For more details, please refer to section C2 of this template."]
["Process failure: the cause of the incident was a poor design or execution of the payment process, the process controls and/or the supporting processes (e.g. process for change/migration, testing, configuration, capacity, monitoring)."]
["System failure: the cause of the incident is associated with a non-adequate design, execution, components, specifications, integration or complexity of the systems, networks, infrastructures and databases that support the payment activity."]
["Human error: the incident was caused by the unintentional mistake of a person, be it as part of the payment procedure (e.g. uploading the wrong payments batch file in to the payments system) or related with it somehow (e.g. the power is accidentally cut-off and the payment activity is put on hold). "]
["External events: the cause is associated with events generally outside the organisation's direct control (e.g. natural disasters, a failure of technical service provider)."]
["Other: the cause of the incident is none of the above. Further details should be provided in the free text field."]
["Was the incident affecting you directly, or indirectly through a service provider?: please indicate whether or not the incident has targeted directly the PSP or affect it indirectly through a third party, in case this information is available. In case of an indirect impact, please provide the name of the service provider(s)."]
["B 4 - INCIDENT IMPACT"]
["Overall impact: please indicate which dimensions have been affected by the operational or security incident. Multiple choices may be selected."]
["Integrity: the property of safeguarding the accuracy and completeness of assets (including data)."]
["Availability: the property of payment-related services being fully accessible and usable by payment service users, according to acceptable predefined levels."]
["Confidentiality: the property that information is not made available or disclosed to unauthorised individuals, entities or processes."]
["Authenticity: the property of a source being what it claims to be."]
["Commercial channels affected: indicate the channel or channels of interaction with payment service users that have been impacted by the incident. Multiple boxes may be checked."]
["Branches: place of business (other than the head office) which is a part of a PSP, has no legal personality and carries out directly some or all of the transactions inherent in the business of a PSP. All of the places of the business set up in the same Member State by a PSP with a head office in another Member State should be regarded as a single branch."]
["E-banking: the use of computers to carry out financial transactions over the Internet."]
["Telephone banking: the use of telephones to carry out financial transactions."]
["Mobile banking: the use of a specific banking application on a smartphone or similar device to carry out financial transactions."]
["ATMs: an electromechanical device that allows payment service users to withdraw cash from their accounts and/or access other services."]
["Point of Sale: physical premise of the merchant at which the payment transaction is initiated."]
["Other: the commercial channel affected is none of the above. Further details should be provided in the free text field."]
["Payment services affected: indicate those payment services that are not working properly as a result of the incident. Multiple boxes may be checked."]
["Cash placement on a payment account: the handing of cash to a PSP in order to credit it on a payment account."]
["Cash withdrawal from a payment account: the request received by a PSP from its payment service user to provide cash and debit his/her payment account by the corresponding amount."]
["Operations required for operating a payment account: those actions needed to be performed in a payment account in order to activate, deactivate and/or maintain it (e.g. opening, blocking)."]
["Acquiring of payment instruments: a payment service consisting in a PSP contracting with a payee to accept and process payment transactions, which results in a transfer of funds to the payee."]
["Credit transfers: a payment service for crediting a payee’s payment account with a payment transaction or a series of payment transactions from a payer’s payment account by the PSP which holds the payer’s payment account, based on an instruction given by the payer."]
["Direct debits: a payment service for debiting a payer’s payment account, where a payment transaction is initiated by the payee on the basis of the consent given by the payer to the payee, to the payee’s payment service provider or to the payer’s own payment service provider."]
["Card payments: a payment service based on a payment card scheme's infrastructure and business rules to make a payment transaction by means of any card, telecommunication, digital or IT device or software if this results in a debit or a credit card transaction. Card-based payment transactions exclude transactions based on other kinds of payment services."]
["Issuing of payment instruments: a payment service consisting of a PSP contracting with a payer to provide them with a payment instrument to initiate and process the payer’s payment transactions."]
["Money remittance: a payment service where funds are received from a payer, without any payment accounts being created in the name of the payer or the payee, for the sole purpose of transferring a corresponding amount to a payee or to another PSP acting on behalf of the payee, and/or where such funds are received on behalf of and made available to the payee."]
["Payment initiation services: a payment service to initiate a payment order at the request of the payment service user with respect to a payment account held at another PSP."]
["Account information services: an online payment service to provide consolidated information on one or more payment accounts held by the payment service user with either another PSP or with more than one PSP."]
["B 5 - INCIDENT MITIGATION"]
["Which actions/measures have been taken so far or are planned to recover from the incident?: please, provide details about actions that have been taken or planned to be taken in order to temporarily address the incident."]
["Have the Business Continuity Plans and/or Disaster Recovery Plans been activated?: please, indicate whether it has been the case and if so, provide the most relevant details of what happened (i.e. when they were activated and what it consisted of)."]
["C - Final report"]
["C 1 - GENERAL DETAILS"]
["Update of the information from the initial report and the intermediate report(s) (summary): please, provide further information on the incident, including the specific changes made to the information provided with the intermediate report. Please also include any other relevant information.  "]
["Are all original controls in place?: please, indicate whether or not the PSP had to cancel or weaken some controls at any time during the incident. If so, please indicate whether all controls are back in place and, if not, explain in the free text field which controls are not back in place and the additional period required for their restoration."]
["C 2 - ROOT CAUSE ANALYSIS AND FOLLOW UP"]
["What was the root cause, if already known?: please, indicate which is the root cause of the incident or, if it is not known yet, the one that is the most likely to be. Multiple choices may be selected. (please note that the root cause should be distinguished from the impact of the incident)"]
["Malicious action – external or internal actions intentionally targeting the PSP. These are separated into the following categories:"]
["     Malicious code - e.g. such as a virus, worm, trojan, spyware."]
["     Information gathering - e.g. scanning, sniffing, social engineering."]
["     Intrusions - e.g. privileged account compromise, unprivileged account compromise, application compromise, bot."]
["     Distributed/Denial of service attack (D/DoS) - an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources."]
["     Deliberate internal actions – e.g. sabotage, theft."]
["     Deliberate external physical damage - e.g. sabotage, physical attack of the premises/data centers."]
["     Information content security - unauthorized access to information, unauthorized modification of information)."]
["     Fraudulent actions - unauthorized use of resources, copyright, masquerade, phishing."]
["     Others (please specify) - the cause of the incident is none of the above. Further details should be provided in the free text field."]
["Process failure: the cause of the incident was a poor design or execution of the payment process, the process controls and/or the supporting processes (e.g. process for change/migration, testing, configuration, capacity, monitoring). These are separated into the following categories:"]
["     Deficient monitoring and control - e.g. in relation to running operations, certificate expiring dates, licence expiring dates, patch expiring dates, defined maximum counter values, database fill levels, user rights management, dual control principle."]
["     Communication issues - e.g. between market participants or within the organisation."]
["     Improper operations - e.g. no exchange of certificates, cache is full."]
["     Inadequate change management - e.g. unidentified configuration errors, roll-out including updates, maintenance issues, unexpected errors."]
["     Inadequacy of internal procedures and documentation - e.g. lack of transparency regarding functionalities, processes and occurrence of malfunctioning, absence of documentation."]
["     Recovery issues - e.g. contingency management, inadequate redundancy."]
["     Others (please specify) - the cause of the incident is none of the above. Further details should be provided in the free text field."]
["System failure: the cause of the incident is associated with a non-adequate design, execution, components, specifications, integration or complexity of the systems, networks, infrastructures and databases that support the payment activity. These are separated into the following categories:"]
["     Hardware failure – failure of physical technology equipment that runs the processes and/or stores the data needed by PSPs to carry out their payment-related activity (e.g. failure of hard drives, data centres, other infrastructure)."]
["     Network failure – failure of telecommunications networks, either public or private, that allow the exchange of data and information (e.g. via the Internet) during the payment process."]
["     Database issues – data structure which stores personal and payment-related information needed to execute payment transactions."]
["     Software/application failure – failures of programs, operating systems, etc. that support the provision of payment services by the PSP (e.g. malfunctions, unknown functions)."]
["     Physical damage - e.g. unintentional damage caused by inadequate conditions, construction work."]
["     Other (please specify) - the cause of the incident is none of the above. Further details should be provided in the free text field."]
["Human error: the incident was caused by the unintentional mistake of a person, be it as part of the payment procedure (e.g. uploading the wrong payments batch file in to the payments system) or related with it somehow (e.g. the power is accidentally cut-off and the payment activity is put on hold). These are separated into the following categories:"]
["     Unintended - e.g. mistakes, errors, omissions, lack of experience and knowledge."]
["     Inaction - e.g. due to lack of skills, knowledge, experience, awareness."]
["     Insufficient resources - e.g. lack of human resources, availability of staff."]
["     Other (please specify) - the cause of the incident is none of the above. Further details should be provided in the free text field."]
["External event: the cause is associated with events generally outside the organisation's control. These are separated into the following categories:"]
["     Failure of a supplier/technical service provider - e.g. power outage, internet outage, legal issues, business issues, service dependencies."]
["     Force majeure - e.g. power failure, fires, natural causes such as earthquakes, floods, heavy precipitation, heavy wind."]
["     Other (please specify) - the cause of the incident is none of the above. Further details should be provided in the free text field."]
["Other: the cause of the incident is none of the above. Further details should be provided in the free text field."]
["Other information: please, provide any additional details on the root cause, including the preliminary conclusions drawn from the root cause analysis. "]
["Main corrective actions/measures taken or planned to prevent the incident from happening again in the future, if already known: please, describe the main actions that have been taken or are planned to be taken in order to prevent a future reoccurrence of the incident."]
["C 3 - ADDITIONAL INFORMATON"]
["Has the incident been shared with other PSPs for information purposes?: please, provide an overview as to which PSPs have been reached out, either formally or informally, to debrief them about the incident, providing details of the PSPs that have been informed, the information that has been shared and the underlying reasons for sharing this information."]
["Has any legal action been taken against the PSP?: please, indicate whether, at the time of filling out the final report, the PSP has suffered any legal action (e.g. taken to court, lost the licence…) as a result of the incident. "]
["Assessment of the effectiveness of the actions taken: please include, where available, a self-assessment of the effectiveness of the actions taken during the duration of the incident, including any lessons learnt from the incident."]