Responsibility for comprehensive assessment according to Article 95(2) PSD2

The EBA Guidelines on security measures for operational and security risks of payments services under PSD2 (EBA/GL/2017/17) do not list the operational functions that can be outsourced. Instead, they state the following principles to follow when outsourcing: (i) the need to ensure the effectiveness of the security measures set for the referred outsourced operational functions and (ii) the need to ensure that measures and performance targets are built into contracts and service-level agreements with the providers to whom they have outsourced such functions (Guidelines 2.7 and 2.8 of these EBA Guidelines). Furthermore, payment service providers (PSPs) should have regard to the general principles of outsourcing as specified under PSD2 and/or CRD IV (depending on the type of license), in particular, that PSPs retain full responsibility when outsourcing and therefore should comply with all the regulatory requirements. Accordingly, the risk assessment referred to in Article 95 of PSD2 could be outsourced, provided such outsourcing complies with the afore-mentioned principles and provisions in PSD2 and in the Guidelines. Finally, it should be noted that outsourcing of the risk assessment should also be done in accordance with the EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02 ). The  Guidelines on outsourcing arrangements are addressed to all PSPs and are in line and should be read in conjunction with the requirements of PSD2 and the Guidelines on security measures for operational and security risks of payments services.