Are you ready for CESOP?

With the first reporting deadline for CESOP around the corner, it is critical that your company is fully prepared, writes Emma Broderick

From 2024, all European Union (EU) payment service providers (PSPs) will be required under legislation to record and report transactional data in excess of 25 cross-border payments quarterly. This includes banks, electronic money institutions and other regulated payment institutions.

The information given will be stored in a centralised European database – the Central Electronic System of Payment (CESOP) – and all information will be made available to anti-fraud experts. This has been brought in to help combat e-commerce VAT fraud.

The first reporting deadline is 30 April 2024, meaning payment service providers have less than two weeks to file the report.

Here are five key points to consider when helping payment service providers.

1. The Central Electronic System of Payment (CESOP) report must be filed in the country where the PSP provides a payment service according to the payment license. For many providers offering payment services in multiple countries under an EU passport, a CESOP report must be filed in each country.
   
   
2. Registration is required in most countries, but the manner of registration differs. In some countries, the PSP must apply to access the CESOP portal, while tax registration is required in other countries. Sometimes, the PSP must apply for a certificate.
   
   Unfortunately, in a few countries, it is necessary to have all three.
   
   The CESOP registration for Irish-resident PSPs can be completed using the online system operated by the Revenue Commissioners (Revenue). Revenue has also developed a Non-Resident Registration app for PSPs resident outside Ireland.
   
   
3. In some cases, filing the CESOP report requires the use of special software, an electronic certificate, special encryption or an electronic signature. For example, in the Netherlands, you must have a public key infrastructure (PKI) government certificate and access to the Digipoort bestandsuitwisseling FTP.
   
   In Ireland, a PSP can engage the services of an intermediary to prepare and file the CESOP report without the PSP having to use any further technical tools. That is also the case in many other countries.
   
   
4. There is a standard XML format for preparing and filing the CESOP report, but a specific heading is required in several countries. Revenue will have guidance on the headings needed for Ireland.
   
   
5. The data in the CESOP report must comply with the CESOP requirements. There are various ways to check this. The European Commission website has a CESOP validation module, for example.
   
   However, please be aware that the European Commission has recently released new explanatory notes on the requirements of the file. The explanatory notes state that PCPs must consolidate all transactions for a single account under the same payee. Reporting per payment instead of per payee results in an incorrect report.

Next steps

We recommend PSPs establish the countries in which a CESOP report must be filed as soon as possible. If those countries require registration, it is important to do this immediately to meet the 30 April deadline.

Although the market has asked for this, there is currently no general extension, which means many countries will continue to maintain the 30 April deadline.

It is a good idea to test the data that will be filed to avoid it being rejected or returned with error messages.

Emma Broderick is a Director with KPMG