CESOP in Ireland: Revenue filing through ROS (Part 9A)
CESOP reporting in Ireland goes to Revenue through ROS, and for a passported payment firm the first obstacle is not the XML but the registration. Part 9A of the Value-Added Tax Consolidation Act 2010, inserted by two statutory instruments that took effect on 1 January 2024, requires payment service providers to keep and report cross-border payment records each quarter. Revenue then passes the data to the Commission’s central database. A firm with no Irish tax number must first get one through the Non-Resident Registration app, wait for a manual review, then register for ROS before it can upload a single file. This piece walks through the legal text, the registration routes, the upload and its three validation layers, the Irish deviations from the EU schema, and three cases from practice.
1. The legal basis: Part 9A of the VAT Consolidation Act
Ireland transposed Council Directive (EU) 2020/284 through S.I. No. 650 of 2023, which inserted sections 85A to 85F into the Value-Added Tax Consolidation Act 2010, and Council Regulation (EU) 2020/283 through S.I. No. 651 of 2023, which added sections 85G and 85H. Both were signed on 20 December 2023 and apply from 1 January 2024.
| Section | What it does |
|---|---|
| 85A | Definitions, borrowed from PSD2 (Directive (EU) 2015/2366) and the SEPA Regulation; “payment service provider” covers the PSD2 categories plus exempted providers |
| 85B | Cross-border payment: payer in a Member State, payee in another Member State, a third territory or a third country; location by IBAN or other unambiguous identifier, failing which by the BIC of the provider |
| 85C | Record-keeping duty where a provider handles more than 25 cross-border payments to the same payee in a calendar quarter; payer-side exemption when a payee’s provider is in a Member State |
| 85D | Content of the records, including refunds and the physical-premises flag |
| 85E | Electronic retention for 3 years from the end of the year of the payment |
| 85F | Reporting duty where Ireland is the home Member State, or a host Member State for services provided outside the home state |
| 85G | Electronic reporting in the form Revenue specifies, no later than the end of the month after the quarter |
| 85H | Revenue keeps the data 5 years and forwards it to CESOP by the tenth day of the second month after the quarter |
Two counting details from section 85C matter more than the threshold itself. The count runs per Member State and per payee identifier, but where the provider knows a payee holds several identifiers it counts per payee. And payments where the payer’s provider is exempt from recording still go into the count.
2. Who files in Ireland
Section 85F catches two populations. Irish-authorised credit institutions, e-money institutions and payment institutions report for services where Ireland is the home Member State. Providers authorised elsewhere report to Revenue for the services they provide in Ireland as host, whether through a branch, agents or the freedom to provide services. The Irish file covers only the Irish slice: a provider passporting into Ireland from Lithuania still files its home-state leg in Lithuania.
Revenue’s manual recognises three kinds of filer: the provider itself, a tax agent holding a Tax Advisor Identification Number (TAIN) authorised by the provider, and other third-party reporting intermediaries, such as a group entity running a central CESOP function or an outsourced technical provider. Whoever presses the button, the provider remains legally responsible. The manual expects it to check that every file sent on its behalf is complete, has passed both national and EU validation, and that all requested corrections have been made.
3. Registration: resident and non-resident routes
Revenue’s “CESOP Registration Guidelines and Guidance for Filing” (Tax and Duty Manual, updated January 2026) sets out two routes.
- Resident provider (fixed place of business and a current Irish tax registration): log into ROS, open “My Services”, choose “Manage Reporting Obligations”, and register for CESOP. Enter the start date of the obligation (not later than today) and the provider’s national ID issued by the Central Bank of Ireland. Sign and submit; a ROS acknowledgement and notice number follow. Allow up to three working days before an upload is possible.
- Non-resident provider: a three-step sequence. Register the CESOP obligation through the Revenue Non-Resident Registration (NRR) app, giving the national ID as listed on the EBA register; after approval, use the emailed system password and your 12-digit verification code to obtain a Tax Reference Number (seven digits and two letters); then register that number for ROS and obtain a ROS certificate.
The non-resident review works strictly in date order and can take up to seven working days for the CESOP team alone, before ROS registration even begins. The email address used must be unique, never used for another ROS registration. Agents with a TAIN link to the client through an “Agent Link Request” that the client approves in ROS; the link goes live within two working days. Agents without a TAIN, and other intermediaries, cannot register directly: the provider registers first and then issues them a ROS sub-certificate.
4. Filing through ROS, step by step
Once the obligation is registered, filing runs through “File a Return”, then “Complete a Form Online”, then “Reporting Obligation” and “CESOP”. The filer browses for the XML file, submits it for pre-validation, then signs and submits with the ROS password. Practical limits from the manual:
- One XML file per upload, up to 1 GB uncompressed. Batch upload is not available.
- Only the XML is required; Ireland does not ask for a meta file.
- Revenue tested the upload on Chrome, Edge and Firefox under Windows, and warns that macOS can cause compatibility problems. Do not use the browser’s back button during submission.
- Revenue accepts only the current versions listed on its filing-specifications page: since 19 September 2025, Validation Module 1.7.0 with XML version 4.03. Earlier versions are refused, with no backward compatibility.
Deadlines follow section 85G: 30 April, 31 July, 31 October and 31 January for the four quarters.
5. Three validation layers and what each returns
| Layer | What it checks | Result arrives |
|---|---|---|
| Pre-validation | File under 1 GB, XML only, not blank, header elements present (TransmittingCountry, MessageType, MessageRefId, ReportingQuarter, PSPId, ReportingYear), schema errors, MessageRefId uniqueness (10010) | On screen, before sign and submit |
| National validation | Business and technical rules, plus Irish rule 99999; a future reporting period fails here | ROS inbox (Revenue Record), normally in 12 minutes or less |
| EU CESOP validation | Commission business rules, including history-dependent ones | ROS inbox: fully accepted, partially rejected or fully rejected; no guaranteed timeline |
Revenue does not apply rules 20020 and 45050, so a file breaking them passes in Ireland and fails at EU level. Its own extra rule, 99999, rejects a correction whose CorrMessageRefId points to a message CESOP has not yet processed: wait for the first result before correcting. For full rejections, the error list shows up to 5,000 lines. Where a quarter needs several files, the obligation is met only when every file is fully accepted at EU level.
6. Corrections, resubmissions and nil returns
A file fully rejected at EU level is fixed offline and resubmitted with a new MessageRefId; reusing the old one fails national validation. A partial rejection needs a correction message (CESOP101) covering only the payees and transactions in error, with its own new MessageRefId and the original one in CorrMessageRefId. Leave that field empty and the correction fails national validation. After a national rejection, resend the same message type as the first attempt.
A nil return is not required by statute, but Revenue says filing one reduces the chance of a compliance check. Use the “Submit Nil Return” button or upload a CESOP102 file, for the current or a past quarter only. A nil return gets no EU validation message. A later CESOP100 for the same quarter overwrites the nil return, while a nil return cannot be saved once data has been filed for that quarter.
Retain every file you upload. The manual asks providers to keep a record of submissions so that later amendments can reference them, and section 85E separately requires three-year retention of the underlying payment records.
7. Worked example: the passported EMI’s first Irish quarter
Facts: An e-money institution authorised in another Member State begins serving Irish online merchants under the freedom to provide services in May. It has no Irish tax registration. Its Q2 data shows 40 Irish merchants above the 25-payment threshold.
What the rule says: Ireland is a host Member State for those services, so section 85F applies and the Q2 file is due by 31 July. The firm is non-resident, so registration runs through the NRR app with a manual review.
What the practitioner does: Submits the NRR registration in early June with the national ID shown on the EBA register, records the 12-digit verification code, and uses a dedicated mailbox never linked to ROS. After approval, obtains the Tax Reference Number, registers for ROS, and issues a sub-certificate to the group’s central reporting team.
Outcome: ROS is live in early July, three weeks before the deadline, leaving room for a test file to go through all three validation layers.
8. Worked example: the correction sent too soon
Facts: A Dublin payment institution uploads its Q3 file on 20 October. Two days later its own reconciliation finds 300 refunds without the refund flag, and the team uploads a CESOP101 correction straight away.
What comes back: National validation rejects the correction under rule 99999, because the original message has not yet been processed by CESOP.
What the practitioner does: Waits for the EU result on the original file, then sends the CESOP101 with a fresh MessageRefId, the original MessageRefId in CorrMessageRefId and IsRefund=”True” on the affected records.
Outcome: The correction clears both layers. The team adds a gate to its runbook: no correction until the original shows a final EU status.
9. Worked example: the quiet quarter
Facts: A small Irish payment institution loses its only cross-border merchant in Q4. No payee crosses 25 cross-border payments.
What the rule says: There is nothing to report, and no statutory nil return. Revenue still invites one, to reduce follow-up checks.
What the practitioner does: Uses “Submit Nil Return” for Q4 in January and keeps the ROS acknowledgement in the quarter file. If late-booked payments later push a payee over the threshold, it files a CESOP100, which overwrites the nil return.
Outcome: The quarter is closed with evidence on file, and Revenue has a positive confirmation instead of a silence it might query.
FAQ
Where is CESOP filed in Ireland?
With Revenue, through ROS (Revenue Online Service), under “Complete a Form Online”, then “Reporting Obligation” and “CESOP”.
What is the Irish legal basis?
Part 9A of the Value-Added Tax Consolidation Act 2010, sections 85A to 85H, inserted by S.I. No. 650 and S.I. No. 651 of 2023, in force since 1 January 2024.
How does a non-Irish PSP register?
Through the Revenue Non-Resident Registration app. After a manual review it receives a Tax Reference Number, then registers for ROS. Revenue advises starting at least a month before the first deadline.
What is the file size limit?
1 GB uncompressed per XML file, uploaded one file at a time. No meta file is needed.
Is a nil return mandatory?
No, but Revenue recommends one to reduce the risk of a compliance check. Use the Submit Nil Return button or a CESOP102 file.
How long must records be kept?
Three years from the end of the year of the payment, in electronic form, under section 85E.
Can a group entity or vendor file for us?
Yes, through a ROS sub-certificate issued by the provider, or through a TAIN agent link. The provider stays responsible for the filing.
What to do, today
- Passported firms: if you serve Irish payees and have no Irish tax number, start the NRR registration now. It is the long pole.
- Head of regulatory reporting: decide who files (in-house, TAIN agent or sub-certificate holder) and write down the provider’s oversight checks.
- Data team: pin the export to the versions on Revenue’s filing-specifications page, and write IsRefund as True or False.
- Operations: keep a register of every MessageRefId sent, and block corrections until the original has a final EU status.
- Compliance: diarise 30 April, 31 July, 31 October and 31 January, and file a nil return in quiet quarters.
Related: Building the CESOP file · goAML Ireland: STR filing to FIU Ireland and Revenue · Central Bank of Ireland Portal returns · CESOP in Luxembourg
