The gap assessment scores 81 questions across the seventeen areas of the EU Payments framework, on the same 0 to 4 maturity scale used by the DORA, ISO 42001 and CPS 234 modules.
What it is for, and how it differs from the requirements
The 172 requirement rows record whether each article is implemented. The assessment measures how the firm decided the questions the instruments leave open, which is where a supervisory review or an external audit concentrates. The questions deliberately do not restate the articles. They ask things like:
Which legal entity holds the authorisation, and were the duties mapped to that entity rather than to the group? Which services sit inside the perimeter, and what triggers an own funds recalculation?
Is there an inventory of every remote action with the decision to apply SCA, apply an exemption or treat the action as out of scope? Who owns the transaction risk analysis, and what counts as fraud in the fraud rate?
Which services generate funds that must be safeguarded, from what moment, in which accounts, and who can move them? Is the reconciliation designed from the liability side? What happens on the day a shortfall is found?
Is parity with the customer channel actually measured, including the login step? Was the fallback ever needed, and is the contingency exemption still justified?
Which Instant Payments Regulation duties already apply to the firm, and which wait for the 2027 date? Who provides verification of payee, how is name quality handled, and how are disputes about a mismatch resolved?
Is the firm a manufacturer, importer or distributor of its terminals? Has a disproportionate burden assessment ever been written, or is the exception relied on without one?
Scoring
| Score | Meaning |
|---|---|
| 0 | Not Implemented |
| 1 | Initial |
| 2 | Developing |
| 3 | Defined |
| 4 | Optimized |
Questions are weighted 1 to 3 by how much a reviewer cares about them: the entity mapping, the safeguarding universe and the SCA exemption governance carry weight 3, the housekeeping questions weight 1. The overall percentage is computed against every question, answered or not, so an unanswered question reads as a gap rather than being excluded from the denominator. A score of 80 percent or above shows as substantially aligned, 50 to 79 as partial alignment, and below 50 as significant gaps.
Running the assessment
Start an assessment from the gap assessment page; it is created in progress with a dated title. Work through the seventeen areas in the side navigation. Each answer is saved as you go, and an area turns green once every question in it has a score. The assessment can be completed once all 81 questions are answered, after which it becomes read-only and its score appears on the dashboard and in the board report. Start a new assessment next year rather than editing the completed one, so the movement between the two is visible.
Notes and evidence on answers
Each answer takes a note and an evidence URL. Use the note to record the specific fact behind the score, for example which channels offer verification of payee today, the date the safeguarding bank's due diligence was last refreshed, or the name of the person who approved the transaction risk analysis exemption. Those notes are what make a re-assessment next year meaningful rather than a fresh guess, and they are the first thing a reviewer asks to see when a score looks generous.
Who should answer
The questions span compliance, finance, product, security and operations. In practice the compliance officer runs the assessment and brings in the finance lead for own funds and safeguarding, the head of payments for execution and instant payments, the CISO for authentication and credentials, and the product owner for the interfaces and accessibility. The weight on each question tells you where to spend the time.