Payments: European Court of Justice (ECJ) rules on PSP liability for unauthorised transactions and late PSU notification

What's the key takeaway for PSPs from the ECJ's ruling?

The ECJ’s ruling confirms the current industry view regarding the 13-month time period and PSP to liability for unauthorised transactions: namely, that the regime does not require a refund for a claim made before the longstop where notification of the claim has been unduly delayed.

Firms may want to review their policies and procedures for dealing with claims for unauthorised transactions to ensure they are comfortable with their understanding of what constitutes “undue delay” and (in the case of lost or stolen payment instruments) “gross negligence” when it comes to rejecting such claims, particularly given specific customer circumstances and vulnerabilities.

Whilst the ECJ’s ruling related to requirements introduced by PSD1, these requirements were retained in PSD2 and remain in the latest drafts for the PSR as part of PSD3 as they move into trilogue.

Background and facts

IL, a customer of Veracash SAS (Veracash), opened a gold deposit account with Veracash. On 24 March 2017, Veracash issued and sent a new cash withdrawal and payment card to IL’s address. IL contended that he neither requested nor received the card. Subsequently, daily withdrawals were made from his account between the period 30 March 2017 and 17 May 2017 (the period), which IL claimed were unauthorised.

The claim was refused on appeal on the basis that IL had submitted a disputed transaction two months after the first unauthorised withdrawal. IL’s subsequent counter-appeal was put on hold while issues relating to the interpretation of Articles 56,58, 60 and 61 of PSD1 were referred to the ECJ for a preliminary ruling. 

What did the ECJ decide in response to the referred questions?

The following questions were referred:

Whether the payer loses the right to reimbursement for unauthorised transactions if notification is delayed but made within the 13-month period after the debit date?

The ECJ clarified that a PSU shall be refused the right to a refund for an unauthorised payment transaction if they fail to notify their PSP without undue delay, even if the notification was made within the 13-month statutory time period. The ECJ referred to Recital 31 of PSD1 and emphasised that there is an obligation to notify the PSP ‘as soon as possible’ which is distinct from the 13-month limit.

It also noted that the ‘without undue delay’ requirement under Article 56(1)(b) of PSD1 serves a preventive purpose, encouraging prompt notification to minimise potential losses (the extent to which a notification is late will depend on the facts in the case). A reliance solely on the 13-month time limit would undermine the ‘undue delay’ objective and disrupt the balance of interests envisaged between PSUs and PSPs as intended by the Directive.

In the event the answer to the first question is in the affirmative, does the deprivation of the payer's rights depend on the delay being intentional or grossly negligent?

The ECJ clarified that the PSU is to bear all losses relating to any unauthorised payment transactions if he or she incurred them by acting fraudulently or by failing to notify the PSP in accordance with Article 56(1)(b) of the Directive. The PSU’s intentional or grossly negligent delay in notifying the PSP must amount to "a serious breach of a duty of care" given their circumstances. The ECJ held that the burden of proof lies with the PSP to demonstrate that the transaction was authenticated, accurately recorded and properly accounted for. The ECJ noted in particular that the Directive ensures that PSUs are not held liable for unauthorised transactions occurring after notification, which reinforces for the PSU the importance of reporting and removes any incentive for delay.

In the event the answer to the first question is in the affirmative and in the event of successive unauthorised payment transactions resulting from the use of a lost, stolen or misappropriated payment instrument or any unauthorised use of such an instrument, and where the payer, while observing the 13-month time limit after their debit dates, partially delayed in notifying them to his or her PSP with intent or gross negligence, is that payer deprived of his or her right to a refund of all losses resulting from those transactions?

The ECJ held that the PSU loses the right to his or her reimbursement only for losses stemming from transactions they delayed in reporting with intent or gross negligence. It noted the necessity of a causal link between the conduct of the PSU and the losses incurred in respect of which he or she cannot obtain rectification, ensuring a fair balance of interests.

In connection with this last point the ECJ appears to have differed from the Advocate General’s (AG) opinion in the case (dated 9 January 2025), which provided that in the event of losses relating to unauthorised transactions which the payer notified late with intent or gross negligence, the payer is deprived of the right to reimbursement in relation to all unauthorised transactions. The AG reasoned that the loss of such a right for only some transactions would undermine the objective of encouraging the payer to notify the PSP without undue delay, the "preventive" purpose connected to such notification, and there being "consequences" for such behaviour. 

Authored by Charles Elliott, Virginia Montgomery, and Sheharyar Nawaz.