Payments: European Court of Justice (ECJ) rules on PSP liability for unauthorised transactions and late PSU notification

What's the key takeaway for PSPs from the ECJ's ruling?

Firms may want to review their policies and procedures for dealing with customer claims for unauthorised transactions to ensure they are comfortable with their understanding of what constitutes “undue delay” and “gross negligence” when it comes to rejecting such claims, particularly given specific customer circumstances and vulnerabilities.

Background and facts

IL, a customer of Veracash SAS (Veracash), opened a gold deposit account with Veracash. On 24 March 2017, Veracash issued and sent a new cash withdrawal and payment card to IL's address. IL contended that he neither requested nor received the card. Subsequently, daily withdrawals were made from his account between the period 30 March 2017 and 17 May 2017 (the period), which IL claimed were unauthorised.

First instance

IL initiated proceedings against Veracash before the Tribunal de grande instance d'Evry (Regional Court, Evry, France), seeking a reimbursement of the unauthorised transactions and damages during the period. IL's claim was partially dismissed, and he appealed to the Cour d'Appel de Paris (French Court of Appeal)

Court of Appeal

The Court of Appeal dismissed the appeal and held that IL could not rely on Article L. 133-18 of the French Monetary and Financial Code (the Code) because he failed to report the unauthorised transactions ‘immediately' and ‘without undue delay'. The Court pointed out that IL had submitted a disputed transaction form to Veracash on 23 May 2017, two months after the first unauthorised withdrawal. PSD1 was transposed into French law by Order No. 2009-866 of 15 July 2009 on the conditions governing the supply of payment services and creating payment institutions, which made relevant amendments to the Code.

Court of Cassation

IL appealed further to the Cour de Cassation (Court of Cassation, France) arguing that the Court of Appeal had erred in its interpretation of the Code and that the law provides a 13-month period from the debit date to notify the PSP of unauthorised transactions and that his notification was made within this period.

The case raises issues relating to the interpretation of Articles 56,58, 60 and 61 of PSD1. The Court of Cassation noted that a literal reading of Article 58 could support the refusal of reimbursement for late notification, but this interpretation may conflict with Article 61(2) which limits the liability of the PSU to intentional or grossly negligent conduct. It decided to stay the proceedings and refer a number of questions to the ECJ for a preliminary ruling.

What did the ECJ decide in response to the referred questions?

The following questions were referred:

Whether the payer loses the right to reimbursement for unauthorised transactions if notification is delayed but made within the 13-month period after the debit date?

The ECJ clarified that a PSU shall be refused the right to a refund for an unauthorised payment transaction if they fail to notify their PSP without undue delay, even if the notification was made within the 13-month statutory time period. The ECJ referred to Recital 31 of PSD1 and emphasised that there is an obligation to notify the PSP ‘as soon as possible' which is distinct from the 13-month limit.

It also noted that the ‘without undue delay' requirement under Article 56(1)(b) of PSD1 serves a preventive purpose, encouraging prompt notification to minimise potential losses (the extent to which a notification is late will depend on the facts in the case). A reliance solely on the 13-month time limit would undermine the ‘undue delay' objective and disrupt the balance of interests envisaged between PSUs and PSPs as intended by the Directive.

In the event the answer to the first question is in the affirmative, does the deprivation of the payer's rights depend on the delay being intentional or grossly negligent?

The ECJ clarified that the PSU is to bear all losses relating to any unauthorised payment transactions if he or she incurred them by acting fraudulently or by failing to notify the PSP in accordance with Article 56(1)(b) of the Directive. The PSU's intentional or grossly negligent delay in notifying the PSP must amount to "a serious breach of a duty of care" given their circumstances. The ECJ held that the burden of proof lies with the PSP to demonstrate that the transaction was authenticated, accurately recorded and properly accounted for.  The ECJ noted in particular that the Directive ensures that PSUs are not held liable for unauthorised transactions occurring after notification, which reinforces for the PSU the importance of reporting and removes any incentive for delay.

In the event the answer to the first question is in the affirmative and in the event of successive unauthorised payment transactions resulting from the use of a lost, stolen or misappropriated payment instrument or any unauthorised use of such an instrument, and where the payer, while observing the 13-month time limit after their debit dates, partially delayed in notifying them to his or her PSP with intent or gross negligence, is that payer deprived of his or her right to a refund of all losses resulting from those transactions?

The ECJ held that the PSU loses the right to his or her reimbursement only for losses stemming from transactions they delayed in reporting with intent or gross negligence. It noted the necessity of a causal link between the conduct of the PSU and the losses incurred in respect of which he or she cannot obtain rectification, ensuring a fair balance of interests.

In connection with this last point the ECJ appears to have differed from the Advocate General's (AG) opinion in the case (dated 9 January 2025), which provided that in the event of losses relating to unauthorised transactions which the payer notified late with intent or gross negligence, the payer is deprived of the right to reimbursement in relation to all unauthorised transactions. The AG reasoned that the loss of such a right for only some transactions would undermine the objective of encouraging the payer to notify the PSP without undue delay, the "preventive" purpose connected to such notification, and there being "consequences" for such behaviour.

What about the current position under PSD2 – and the future under PSD3?

Whilst the ECJ's ruling related to requirements introduced by PSD1, these requirements were retained in PSD2 and remain in the drafts for the PSR as part of PSD3.

The Council of the EU's drafts of PSD3 and the accompanying PSR were approved by the member states' representatives (COREPER) on 18 June 2025, meaning that the trilogue process (inter-institutional negotiations) can now begin.

Trilogues can often be a long process. However, there is strong appetite to get both files concluded under the Danish presidency which concludes at the end of the year. 

At present there is an 18-month implementation period (although the Council proposes to extend this to 24 months). As such, the earliest PSD3/PSR is likely to become applicable is H2 of 2027, although this could move into early 2028 if the Council is successful in extending the implementation period.

Authored by Charles Elliott, Virginia Montgomery, and Sheharyar Nawaz.