CESOP in Italy: SID filing to the Agenzia delle Entrate
Italy’s CESOP filing travels through SID, the same tax-data pipe used for financial-account reporting, and it fails for reasons that have nothing to do with the EU schema. Under Articles 40-bis to 40-sexies of Presidential Decree 633/1972, payment service providers send quarterly cross-border payment data to the Agenzia delle Entrate, which forwards it to the EU’s Central Electronic System of Payment information. Before the first file can leave, the provider needs a PEC address in the REI, an Entratel or Fisconline account, SID registration and a signing certificate. This piece covers the legal basis, the access steps, the two receipts, the three message types and four cases from practice.
1. The legal basis
Legislative Decree 18 October 2023, no. 153 transposed Council Directive (EU) 2020/284 by adding a new Title II-bis — Articles 40-bis to 40-sexies — to the VAT decree, DPR 633/1972. The rules apply to cross-border payment services provided from 1 January 2024. The core provisions are:
- Art. 40-ter — the record-keeping duty, the threshold of more than 25 cross-border payments to the same beneficiary in a quarter, the payer-side exemption, and three-year retention.
- Art. 40-quater — the duty to make the records available to the Agenzia delle Entrate, which sends them to CESOP under Article 24b of Regulation (EU) No 904/2010 (Article 24-ter in the Italian text).
- Art. 40-sexies — the content of the records.
The implementing measure is the Director’s provvedimento of 20 November 2023, with technical annexes: the instructions for compiling and transmitting the data (version 1.2 of 28 February 2025 is the current edition), the Commission’s XSD User Guide, and a spreadsheet of record layouts and client and server error codes. The Agenzia’s CESOP pages also reproduce the Commission’s reporting guidelines and carry an FAQ.
2. Who files in Italy
The instructions describe two groups. First, payment service providers for which Italy is the home Member State. Second, providers established in other Member States, limited to the payment services for which Italy is a host Member State — for example services provided through an Italian branch, under the freedom to provide services, or through agents.
Group structures are allowed for. An EU parent can send on behalf of its Italian branch, provided the parent is enrolled in the REI section for financial investigations (Indagini finanziarie). In the message, the parent appears as the SendingPSP and the branch as the ReportingPSP.
3. The threshold and what counts
Art. 40-ter(2) sets the trigger: more than 25 cross-border payments to the same beneficiary in a calendar quarter, counted per Member State and per identifier, or per beneficiary where the provider knows that one beneficiary holds several identifiers. Art. 40-ter(3) gives the duty to the beneficiary’s provider whenever both providers are in the EU; the payer’s provider still counts those payments toward the threshold.
The Agenzia’s FAQ settles several points that recur in practice:
- payments to a sole trader and to the sole trader personally are added together toward the 25;
- for a company card used by an employee, the payer is the company;
- payments a provider makes to its own foreign suppliers can be in scope if the other conditions are met;
- payments where the payer is in San Marino are always excluded;
- after a merger during a quarter, the absorbing entity takes over the reporting and adds the absorbed entity’s payments to its own count.
Records are kept for three calendar years from the end of the year of the payment date (art. 40-ter(4)).
4. Before the first file: REI, Entratel, SID
The access steps come from section 2 of the technical instructions. Each depends on the one before, so a provider new to the Agenzia should start them well before the first deadline.
- REI. Register the provider’s certified e-mail (PEC) address in the Electronic Address Register (REI). The Agenzia uses it for administrative communications, and at intake it checks that the sender’s tax code belongs to an entity enrolled in the REI’s financial-investigations section.
- Entratel or Fisconline. Register for the Agenzia’s online services. This is a precondition for SID.
- SID. Register for the Sistema di Interscambio Flussi Dati, choosing PEC or an FTP exchange node — your own, or one run by an accredited operator for third parties.
- Software and certificate. Install “SID Gestione Flussi” with the CESOP module, and obtain the certificate used to sign and encrypt the file.
- Tax code. Sending via SID requires a valid Italian codice fiscale. Where the reporting provider has none, the sender is identified by its codice fiscale and the reporting provider by its BIC.
5. From XML to two receipts
The CESOP module runs a formal check on the XML against the Commission’s schema plus Italian client-side controls. If it passes, it compresses, encrypts and signs the file, producing a pair: the data file and a separate digital signature. Both go in a single send, without renaming:
- by PEC, from the address registered with SID, to one of sid1 to sid5 at pcert.agenziaentrate.it, with a 20 MB file limit; or
- by FTP through an exchange node, with a 100 MB limit.
Two receipts follow. The first comes from the Agenzia at intake and carries a protocol number: either acceptance or rejection of the whole file. The FAQ says this normally arrives within five days. The second is the Commission’s own result, passed back through the same channel: ACCEPTED, PARTIALLY REJECTED or FULLY REJECTED. A file rejected at intake is treated as never received.
| Stage | Who checks | Possible results | What you do |
|---|---|---|---|
| Client check | SID CESOP module on your machine | Pass, or diagnostic list | Fix and re-run; nothing is sent until it passes |
| National intake | Agenzia delle Entrate | Accepted, or whole file rejected | If rejected, correct and resend; identifiers may be reused |
| CESOP | European Commission | Accepted, partially or fully rejected | Send corrections for the rejected records |
6. Message types, identifiers and characters
Three message types are allowed each quarter: new data (CESOP100), corrections — amendment, deletion or completion of data already sent (CESOP101), and no data to report (CESOP102). The nil message is optional, but the Agenzia recommends it as a first check that the obligation is being met.
Two rules decide whether a send gets through. Uniqueness: each MessageRefId must be unique in time and space, and CESOP applies the same test to MessageRefId and DocRefId — identifiers already used cannot be reused, even if the earlier file was rejected by CESOP. The exception is a rejection at national intake, after which the instructions allow the identifiers to be sent again. Sequencing: for a given year and quarter, the Agenzia advises waiting for the intake receipt of one send before making the next.
The XML must be UTF-8 without a byte-order mark. Accented and non-Latin names are accepted. Five characters (&, <, >, apostrophe and quotation mark) must be written as predefined entities, and three sequences — double dash, slash-asterisk and ampersand-hash — are forbidden in text fields. Either defect rejects the whole file.
7. Worked case: a parent filing for its Italian branch
Facts: an e-money institution authorised in another Member State runs an Italian branch that holds accounts for Italian merchants. Central reporting sits at the head office.
What the rule says: Italy is a host Member State for the branch’s services, so an Italian file is owed. The parent may send it if enrolled in the REI’s financial-investigations section.
What the practitioner does: enrols the parent in the REI, registers it with Entratel and SID, and sets the message header with the parent as SendingPSP and the branch as ReportingPSP, both identified by codice fiscale with PSPIdType “Other”.
Outcome: the intake check finds both tax codes and the REI enrolment, and the file goes on to CESOP.
8. Worked case: 26 payments, 11 reportable
Facts: an Italian payment institution, acting for the payer, executes 26 cross-border payments in a quarter to one beneficiary: 15 where the beneficiary’s provider is in a Member State, 11 where it is in a third country.
What the rule says: all 26 count toward the threshold, so it is crossed. But under the payer-side exemption the 15 EU-side payments are the beneficiary’s provider’s business. The Agenzia’s FAQ confirms that only the 11 third-country payments are recorded and reported.
What the practitioner does: separates the count logic (all 26) from the record logic (11), and tests both in the client module before sending.
Outcome: a CESOP100 message with one payee and 11 payment records.
9. Worked case: a partial CESOP rejection
Facts: a quarterly file passes national intake but comes back from CESOP as PARTIALLY REJECTED, with errors on refund records.
What the rule says: the accepted part stands. The rejected records must be resent as corrections, and the FAQ says corrective files are accepted even after the statutory deadline — but they should be sent as soon as possible.
What the practitioner does: builds a CESOP101 message for the affected records only, with new MessageRefId and DocRefId values, sends it after the earlier intake receipt, and archives both receipts against the quarter.
Outcome: the quarter is closed with an evidence trail of two sends and four receipts.
FAQ
Which channel is used for CESOP in Italy?
SID, the Agenzia delle Entrate’s data-exchange system, by PEC (20 MB limit) or through an FTP exchange node (100 MB limit), using the SID Gestione Flussi software with the CESOP module.
Do we need a codice fiscale?
Sending via SID requires a valid Italian tax code for the sender. If the reporting provider has none, the sender is identified by tax code and the reporting provider by BIC.
Is the nil message mandatory?
No. CESOP102 is optional, but the Agenzia recommends it.
How fast does the first receipt arrive?
Usually within five days, according to the Agenzia’s FAQ. The second, CESOP-level receipt follows after the Commission’s checks.
Can we reuse a MessageRefId after a rejection?
Only after a rejection at national intake. Once a file has reached CESOP, its identifiers cannot be reused, whether it was accepted or rejected.
How long must records be kept?
Three calendar years from the end of the year of the payment date, under art. 40-ter(4) of DPR 633/1972.
What to do, today
- Head of regulatory reporting: check whether you file in Italy as home or host provider, and who sends — the entity itself or a parent.
- Operations: confirm the REI enrolment in the financial-investigations section, the SID channel (PEC or FTP), and the certificate expiry date.
- Data team: add a pre-send check for UTF-8 without BOM, the five entities and the three forbidden sequences.
- Compliance: keep a register of every MessageRefId and DocRefId ever sent, with the receipt for each.
Related: Building the CESOP file · SID, the Agenzia delle Entrate channel · Anagrafe dei rapporti finanziari
