The EU Payments module tracks the duties the EU payments rulebook places on a regulated firm: a payment institution, an electronic money institution, a credit institution providing payment services, an account servicing provider or a third-party provider offering payment initiation or account information services. Six instruments share one framework because a payments compliance officer answers to all of them at once and runs them as one programme.
What Venvera tracks
172 requirements, each cited by the instrument and the article the duty comes from, grouped into seventeen areas. Only duties on the firm are requirements. Provisions addressed to Member States, competent authorities, the EBA or the Commission, definitions, scope rules and transitional provisions are context, not rows.
| Instrument | Rows | What it covers |
|---|---|---|
| PSD2 (Directive (EU) 2015/2366, as amended by the DORA amending directive and the Instant Payments Regulation) | 66 | Authorisation, own funds and safeguarding for payment institutions, agents and outsourcing, customer terms, execution, liability and refunds, operational and security risk, incident notification, fraud reporting and complaints |
| SCA and secure communication RTS (Delegated Regulation (EU) 2018/389, as amended) | 50 | Strong customer authentication, the exemptions and their monitoring, personalised security credentials, and the open banking interfaces |
| EBA ICT and security risk guidelines (EBA/GL/2019/04 section 3.8) | 7 | User security awareness, guidance and alerts, the only section of the guidelines that survived the DORA alignment |
| EMD2 (Directive 2009/110/EC) | 21 | Capital and own funds, safeguarding of e-money funds, issuance and redemption at par, and the waiver regime for small institutions |
| Instant Payments Regulation (Regulation (EU) 2024/886, in Regulation 260/2012) | 17 | Instant credit transfers on every channel, the ten-second rule, charges parity, verification of payee, daily sanctions screening of users and the annual charges report |
| European Accessibility Act (Directive (EU) 2019/882) | 11 | Accessible consumer banking services, payment terminals, the accessibility statement and the disproportionate burden assessment |
Who each requirement applies to
Not every row applies to every firm. A payment institution does not safeguard e-money, an e-money institution does not need professional indemnity insurance for a service it does not provide, and an account servicing provider does not carry the conduct duties of an account information service provider. Where a row applies to one kind of provider only, its requirement text ends with an Applies to sentence naming the provider. EMD2 rows and the Irish instant payments return also carry an Ireland sentence with the transposition and the Central Bank of Ireland expectation.
Dashboard
The dashboard shows implementation coverage across the 172 requirements, a breakdown by the seventeen areas, and the maturity score from the gap assessment once one has been completed. Coverage and maturity answer different questions: coverage says whether a requirement is implemented or justifiably excluded, maturity says how well the firm decided the questions the instruments leave open.
| Area | Articles |
|---|---|
| Authorisation, capital and governance | PSD2 Art. 5 to 35a |
| Agents, outsourcing and records | PSD2 Art. 19 to 21 |
| Customer terms and transparency | PSD2 Art. 44 to 62, 69 and 94 |
| Execution, liability and refunds | PSD2 Art. 64 to 90 |
| Strong customer authentication | PSD2 Art. 97, RTS Art. 3 to 9 |
| SCA exemptions and fraud monitoring | RTS Art. 2 and 10 to 21, PSD2 Art. 96(6) |
| Credentials and secure communication | RTS Art. 22 to 29, 34 and 35 |
| Open banking interfaces | PSD2 Art. 65 to 68, RTS Art. 30 to 36 |
| Operational risk, incidents and complaints | PSD2 Art. 95, 96 and 101, EBA GL para. 92 to 98 |
| Safeguarding of users' funds | EMD2 Art. 3(2) and 7 |
| Own funds and capital | EMD2 Art. 4 to 6 |
| Issuance, redemption and conduct | EMD2 Art. 3(5), 6(3) and 11 to 13 |
| Instant payments operations | SEPA Reg. Art. 5a and 5b |
| Verification of payee | SEPA Reg. Art. 5c |
| Sanctions screening of users | SEPA Reg. Art. 5d |
| Accessibility of services and terminals | EAA Art. 4 to 14 |
| Governance and reporting | EMD2 Art. 3(1) and 9, SEPA Reg. Art. 15 |
Recurring duties
Twenty-five obligations land on the compliance calendar with owners, dates and reminders. Each names the article it serves. The main cycles:
Annual, PSD2 Art. 95(2). The updated assessment of the payment services' risks and of the mitigation measures, approved by senior management and submitted to the authority.
Every six months, PSD2 Art. 96(6) and the EBA fraud reporting guidelines, reconciled to the fraud rate series used for the exemptions.
Quarterly monitoring data per exemption and the fraud rate per transaction type, with the annual internal audit and the three-yearly external audit the RTS ties to the statutory audit cycle.
Quarterly own funds review, the annual safeguarding framework review by the board, the safeguarding audit, compliance testing and training the Central Bank of Ireland asks about.
Annual, due by 9 April under SEPA Regulation Art. 15(3): the only obligation with a fixed calendar date.
Annual review that the consumer banking services and the terminals still meet the Accessibility Act, with the published statement kept current.
What the module does not do
The module records obligations, statuses and evidence. It does not execute payments, run verification of payee or screen users against sanctions lists; those are the firm's own systems and the evidence they produce is what gets attached here. Event-driven duties with a clock, such as the DORA incident reports that apply to payment and e-money institutions, the advance notice of safeguarding changes or the Accessibility Act corrective action, are carried as requirement rows with the clock stated in the requirement text; the DORA incident clocks themselves run in the incident module.