Payment statistics in Spain — Circular 2/2022

Circular 2/2022 contains a genuine simplification and, immediately after it, a trap. The simplification: for a Spanish payment service provider, the fraud statistics owed under national payments law are deemed provided by submitting the payment statistics required under the ECB regulation — one return, two obligations. The trap: where a parent consolidates its subsidiaries’ fraudulent-transaction data, the parent and the subsidiaries must also file individually. Firms that read the first sentence and stopped file one return too few.

1. Who reports

Norma 1 defines the actual reporting population as two groups, both with an establishment or establishment requirement in Spain:

• payment service providers as defined in Article 3(32) of Real Decreto-ley 19/2018, with an establishment in Spain; and
• payment system operators as defined in Article 1(d) of Regulation (EU) No 1409/2013, established in Spain.

2. What is reported, and under whose rules

Norma 2 does not restate the data requirements. It points at Regulation (EU) No 1409/2013 and says reporting agents submit the statistical information specified there, on the terms and in the cases that regulation provides, following the rules the circular adds. So the content is European and the plumbing is Spanish — which is the shape of most national statistical circulars, and the reason a mapping exercise has to start from the EU regulation rather than from the national text.

That regulation’s own scope is worth reading alongside. It carries a derogation regime in which national central banks may, guided by proportionality, exempt payment institutions meeting the conditions in Article 32(1) and (2) of PSD2 and e-money institutions meeting those in Article 9(1) and (2) of the e-money directive — regardless of whether the firm has actually been waived or exempted from prudential requirements under national law. Being outside a small-institution regime prudentially does not, by itself, decide the statistical question.

3. The fraud-statistics deeming rule, and its exception

This is the operative provision and it deserves to be read twice.

The logic is straightforward once seen: consolidation is permitted for the European statistical purpose, but the national fraud-reporting duty attaches to each provider, so consolidation cannot discharge it. A group that has centralised fraud reporting into a parent submission has, on the face of the circular, an outstanding obligation at every subsidiary.

The Banco de España may also request supplementary information or clarifications to assure compliance with either limb.

4. How the submission works

Norma 3 sets the channel: reporting agents submit by electronic means to the Payment Systems Department of the Banco de España, in the formats, conditions and requirements set out in the technical applications developing the circular. The individual fraud submissions from a consolidating parent and its subsidiaries go the same way.

Two consequences follow for the build. First, the authoritative field-level specification lives in the technical application, not in the circular — so a change to the technical application changes the file without any change to the circular, and the version in force is what you validate against. Second, the circular allows the Banco de España to determine that reporting agents need not submit information it already holds through other statistical collection mechanisms, which is worth checking before building a feed that duplicates an existing one.

Facts: a Spanish EMI belongs to a group whose parent files consolidated fraudulent-transaction statistics covering all its payment-service subsidiaries.

What the rule says: the consolidation is permitted for the statistical return, but both the parent and each subsidiary must also submit their own fraud statistics individually.

What the practitioner does: keeps the consolidated feed, and adds a per-entity fraud extract on the same cadence and from the same source data — which is a filter, not a second pipeline, provided the underlying records carry the reporting entity as a field. Where they do not, that is the change to make first.

FAQ

Related: The ECB payment statistics regulation · PSD2 fraud reporting · The Spanish reporting calendar