EU EBA GL/2019/04

Why does it matter?

The original Guidelines were the EBA's detailed supervisory expectation for ICT risk before DORA became directly applicable, and many policies and audit programs are still mapped to their section numbers. Anyone using them needs to know which parts were deleted and which survive.

Key benefits include:

• A clear status

As of May 20, 2025 paragraphs 1 to 91 (sections 3.1 to 3.7) are deleted and Guideline 3.8 is the part that remains.

• DORA replaced the ICT risk content

The EBA found that DORA and its technical standards cover the ICT risk management, incident, testing and third-party content, so it narrowed the Guidelines instead of keeping a parallel set.

• User-facing security still applies

Paragraphs 92 to 98 ask payment service providers to give users guidance, control over functionalities, spending limit options, alerts and support.

• Useful history for mapping

The original structure, from governance to business continuity, still shows what supervisors expected before DORA and helps when mapping old controls.

• Comply or explain

As EBA guidelines, they work on a comply or explain basis between competent authorities and institutions.

How does it work?

The original Guidelines had eight sections: proportionality (3.1), governance and strategy (3.2), the ICT and security risk management framework (3.3), information security (3.4), ICT operations management (3.5), ICT project and change management (3.6), business continuity management (3.7) and payment service user relationship management (3.8).

EBA/GL/2025/02, dated February 11, 2025, replaces the subject matter, scope and addressee paragraphs and deletes paragraphs 1 to 91, so that only Guideline 3.8 remains. They apply from May 20, 2025. DORA applies from January 17, 2025 and amends PSD2 so that Article 96(1) to (5) no longer applies to the covered payment service providers.

A payment service provider applies the 3.8 measures by building user awareness material, functions that let a user disable specific payment features, spending limit adjustment where limits were agreed under PSD2 Article 68(1), alerts on initiated or failed payment attempts, notices of security procedure changes and a support channel.

Key Elements

• Guideline 3.8 paragraph 92: user awareness

PSPs establish processes to raise users' awareness of security risks linked to payment services through assistance and guidance.

• Paragraph 93: keeping guidance current

Assistance is updated for new threats and vulnerabilities and changes are communicated to users.

• Paragraph 94: disabling functions

Where the product allows it, users can disable specific payment functionalities.

• Paragraph 95: spending limits

Where limits were agreed under PSD2 Article 68(1), the payer can adjust them up to the agreed maximum.

• Paragraphs 96 and 97: alerts and updates

Users can receive alerts on initiated and failed payment attempts, and are informed about updates to security procedures.

• Paragraph 98: support

PSPs help users with questions, requests and notifications of anomalies on security matters and explain how to get help.

What does it cover?

After the 2025 amendment the Guidelines apply to payment service providers that are credit institutions, electronic money institutions or payment institutions (Article 1(1), points (a), (b) and (d) of PSD2), including exempted ones, and to the competent authorities supervising them. The deleted sections 3.1 to 3.7 once also covered investment firms and all activities of credit institutions.

What are its objectives?

The Guidelines now make sure the user-facing security duties of PSD2 are met alongside DORA.

Help payment service users understand security risks.

Give users control over payment functionalities and spending limits.

Let users receive alerts on payment attempts.

Keep users informed about security procedure updates.

Provide support on security matters.

Framework in Context

The Guidelines were built on Article 74 of the Capital Requirements Directive and the mandate in Article 95(3) of PSD2. They now sit beside DORA and its regulatory technical standards on ICT risk management, which take over the content of the deleted sections. They are separate from the EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02), which have their own page.

Common Framework Mappings

Organizations map EBA ICT and security guidelines to other standards to achieve regulatory alignment, harmonize controls, and simplify audits across data protection, operational resilience, and technical security programs.

Mapped frameworks include:

CIS Critical Security Controls

EU Digital Operational Resilience Act (DORA)

EU General Data Protection Regulation (GDPR)

ISO/IEC 27001

ISO/IEC 27002

NIST Cybersecurity Framework

NIST SP 800-53

SWIFT Customer Security Programme (CSP)