Background to CESOP
CESOP has required EU payment service providers (PSPs) to record and report cross-border payment data since 1 January 2024, giving tax authorities a payment-side view of e-commerce sellers that VAT returns alone do not provide.
The regime rests on three legal texts: Council Directive (EU) 2020/284, which places record-keeping and reporting obligations on PSPs; Council Regulation (EU) 2020/283, which creates the central database and the cooperation framework; and Commission Implementing Regulation (EU) 2022/1504, which sets the harmonised reporting format. At adoption the Commission estimated e-commerce VAT fraud at around EUR 5 billion a year (2015 figures).
| Element | Requirement |
| Who reports | Credit institutions, e-money institutions, payment institutions and post office giro institutions providing payment services in the EU |
| Trigger | More than 25 cross-border payments to the same payee in a calendar quarter; once crossed, every payment to that payee in the quarter is reportable |
| Cross-border test | Payer in one Member State, payee in another Member State or a third country |
| Who files | Payee’s PSP where it is in the EU; payer’s PSP only where the payee’s PSP is outside the EU |
| Frequency | Quarterly, by the end of the month after quarter end (Q1 2024 was due 30 April 2024) |
| Where | The tax authority of each Member State in which the PSP provides payment services (home and host) |
| Format | XML payment data message to the Commission XSD, filed through each national portal |
| Retention | PSPs keep records for 3 years; CESOP holds data for up to 5 years |
| Access | Eurofisc anti-fraud officials of the 27 Member States and Norway |
The data reported centres on the payee: name, VAT or tax number, IBAN or other account identifier, address where held, and the payee’s PSP identifier (BIC). Each payment carries date and time, amount, currency, Member State of origin, a unique transaction reference, a refund flag and a physical-premises flag. No payer name or purpose of payment is transmitted.
National tax authorities validate the data and forward it to the central system, where it is aggregated across all reporting PSPs and cross-checked against VIES, OSS and IOSS registrations. A seller collecting through several PSPs therefore resolves to a single payee profile.
Uptake and experience of PSPs
Around 1,700 PSPs now report to CESOP, roughly 350 of them in two or more Member States, according to the Commission’s CESOP simplification survey summary (February 2026). Ten quarters in, the regime has moved from implementation to business as usual, but data quality and multi-country filing remain the main pain points.
Who is reporting
Of the 137 PSPs that answered the Commission’s 2025 survey, 55% were banks and 45% payment or e-money institutions. PSPs put registration at 25% and reporting at 46% of their total annual CESOP operating cost, so the burden sits in admin and submission rather than in the underlying data extraction alone.
What PSPs have experienced
- Validation failures. Mismatches between data extracted from payment systems and CESOP technical validations have been the most common problem, with PSPs facing full or partial rejections and correction cycles (PwC Luxembourg, October 2025).
- Two-stage validation. Files are checked first by the national portal and then asynchronously by the central system, which returns accepted, partially rejected or fully rejected. A full rejection means resubmitting the whole file; a partial rejection means a correction message for the affected payees only (MTCA correction mechanism, July 2025).
- National divergence. Each Member State runs its own registration, portal, authentication and file-size rules. Portugal limits each file to 40,000 transactions, Poland splits files above 200 MB and the EU rejects any file over 1 GB (KAS Q&A).
- Portal capacity. Varying IT capacity at national tax authorities has caused delays in receiving validation results, which compresses the window for corrections.
- Resourcing. CESOP needs IT, data, legal and tax input. PSPs have chosen between building in-house, buying software or outsourcing, and many are now benchmarking that choice against ongoing cost.
Data quality is now the regulator’s focus
Member States and the CESOP Operational Team have identified recurring quality issues across PSP filings and issued a CESOP Data Quality Checklist in June 2026. Hungary’s NAV has written to PSPs asking them to share it with internal teams and external providers. The issues it targets include:
- placeholder payee names such as “Unknown” or “N/A” and inconsistent spellings that break aggregation
- strings of payee names reported against clearing accounts rather than individual payees
- merchant terminal IDs used instead of IBANs or proper account identifiers
- VAT and tax identifiers held in KYC records but not reported
- amounts converted to euro rather than reported in the original currency
- refunds not linked to the original transaction identifier
- marketplaces reporting themselves rather than the underlying seller
- gaps or inconsistencies between quarters after system changes, mergers or acquisitions
PSPs are asked to review historic filings and correct gaps, not just improve future quarters.
Volumes experienced
The Commission does not publish how many payments PSPs report to CESOP. The figures below are the published reference points: how many PSPs report, and the volumes the Commission expected when it designed the system.
| Measure | Figure | What it tells a PSP | Source |
| PSPs reporting to CESOP | c. 1,700 | Size of the reporting population | Commission survey summary, Feb 2026 |
| PSPs reporting in 2+ Member States | c. 350 (about 1 in 5) | Share of PSPs managing several national registrations, portals and correction cycles | Commission survey summary, Feb 2026 |
| Total EU cross-border payment transactions per year | c. 46 billion | The wider pool of payments from which reportable payments are drawn | EBA (2022) |
| Reportable payments expected per year | c. 8 billion | The scale CESOP was built for: roughly 1 in 6 EU cross-border payments | Commission impact assessment |
| Data volume expected per year | c. 10 TB | Storage and processing load for the central system | Commission impact assessment |
| Payments to third-country e-sellers via EU card processors (2020) | c. 115 million | The flow CESOP was principally designed to expose | Commission impact assessment |
The 8 billion and 10 TB figures are planning estimates made before go-live, not reported volumes. Card transaction counts have grown by around 9–10% a year since, so actual reportable volumes are likely to be higher.
What this means in practice
- Volumes are concentrated. Acquirers, marketplaces, e-money wallets and payment institutions serving cross-border merchants generate most records. A single large acquirer can produce files that must be split to stay under national and EU size limits.
- The threshold is crossed easily. Reporting is triggered by count, not value: 26 payments of EUR 1 are treated the same as 26 payments of EUR 10,000. Any merchant with modest cross-border sales becomes a reportable payee.
- Multi-country PSPs multiply the work. A PSP with branches or passported services in several Member States files a separate, nationally validated report in each, with its own corrections cycle.
- Corrections add volume. Partial rejections generate correction messages and full rejections require complete resubmission, so the number of files handled each quarter is typically well above the number of reporting obligations.
Use of CESOP data and penalties
CESOP data is now an active enforcement tool for Eurofisc, and PSPs face penalties set nationally that range from fixed sums to a percentage of turnover.
How tax authorities use the data
Authorities cross-check payment flows against VAT registrations and OSS and IOSS filings to identify non-EU sellers supplying EU consumers, detect missing registrations and test the completeness of OSS and IOSS returns (HaysMac, April 2026). For merchants, every reportable payee profile is in effect a mirror of their EU sales. For PSPs, poor data weakens the authorities’ matching and is now drawing direct follow-up, as the Data Quality Checklist shows.
Penalties for PSPs
Penalties are left to Member States and are applied per country, so a single systemic error in a multi-country PSP can create exposure in every jurisdiction where it files.
| Member State | Penalty for missing, late or incorrect reporting | Source |
| Netherlands | Up to the sixth-category fine, EUR 1,025,000 in 2024; can be imposed up to 5 years back | Jaeger |
| France | EUR 15 per transaction, capped at EUR 500,000 per institution per quarter | DPS |
| Sweden | 0.1% of prior-year turnover for reporting failures; 0.3% for documentation failures | Deloitte Sweden |
| Austria | Up to EUR 50,000 for intentional breaches | DPS |
| Luxembourg | EUR 250 to EUR 10,000 per breach; up to EUR 25,000 per day for late filing or non-cooperation | PwC Luxembourg |
| Germany | Up to EUR 5,000 (sources differ on whether per transaction or per quarter) | DPS; PwC Luxembourg |
The Dutch five-year look-back exceeds the three-year PSP record retention period, so PSPs should keep evidence of submissions, validation results and corrections for at least as long as their longest penalty window.
Changes to CESOP that need to be considered
The next 12 months bring a new schema version and tighter data quality expectations, so any CESOP solution chosen now must absorb change without rework.
| Change | Status | What PSPs need to consider |
| XSD User Guide v7.00 and schema v4.04 | Published by the Commission on 17 April 2026; expected to be supported at EU level from Q3 or Q4 2026 (BZSt) | Each Member State sets its own switch-over date, so PSPs may need to file different schema versions in different countries during the transition |
| Retirement of older schemas | XSD 4.00 and 4.01 no longer supported from CESOP v1.7.0 (28 August 2025); Ireland accepts only VM 1.7.0, XSD 5.00 and XML 4.03 files from 19 September 2025 (Revenue) | Corrections to earlier quarters may have to be resubmitted in the current schema |
| Validation Module v1.7.1 | Released 20 October 2025 (Commission) | Pre-submission validation must track the current module, not the one used at go-live |
| Reporting Guidelines v1.2 | Published 19 June 2025 (Commission) | Revisit interpretation of marketplaces, intermediaries, e-money flows and refunds |
| CESOP Data Quality Checklist | Published 29 June 2026 (Commission) | Review historic filings, correct gaps and evidence controls; authorities expect action without feedback |
| “CESOP v2” | Signalled by advisers as a future extension of scope and data detail (PwC Luxembourg) | Data models should hold more payee and transaction attributes than are reported today |
| VAT in the Digital Age (ViDA) | Adopted March 2025; platform deemed-supplier rules from July 2028 and digital reporting for intra-EU B2B from July 2030 | CESOP payment data will increasingly be matched against e-invoice and platform data, raising the cost of inconsistencies |
| PSD3 and the Payment Services Regulation | In legislative process | CESOP scope follows PSD2 definitions of PSPs and payment services; any change in those definitions will flow through to CESOP scope |
Considerations for PSPs reviewing for a new provider
With the first build complete, many PSPs are now benchmarking cost and quality and deciding whether their current in-house, software or outsourced model is still right. The criteria below are the ones that most affect accepted filings, penalty exposure and total cost.
| Area | What to look for | Questions to ask |
| Jurisdiction coverage | Filing capability in all 27 Member States, including registration, portal credentials and agent appointments | Which countries do you file in today, directly or through partners? Who holds the portal access? |
| Data ingestion | Ability to take raw transaction data from core banking, acquiring, wallet and marketplace systems without heavy pre-processing | What formats do you accept? Who maps our data to the CESOP fields? |
| Threshold and scope logic | Correct per-payee, per-quarter, per-Member State counting across all payment types; exclusion of out-of-scope services | How do you aggregate a payee across products and accounts? How do you handle payer-PSP reporting for third-country payees? |
| Payee data quality | Name cleansing, deduplication, VAT number syntax checks, IBAN versus internal ID checks, intended-recipient logic for marketplaces | How do you address each point in the Commission Data Quality Checklist? |
| Validation | Pre-submission checks against the current Validation Module and national rules, before files reach the portal | What is your first-time acceptance rate by country? |
| Corrections | Clear process for partial and full rejections, spontaneous corrections and historic remediation | What is your turnaround on a rejected file? Can you correct prior quarters in the current schema? |
| Change management | Track record of moving clients through XSD and Validation Module releases on each country’s timetable | How did you handle the move to XSD 4.03? What is your plan for v4.04? |
| Audit trail | Retention of submitted files, validation results and correction history for at least the longest national penalty window | Can we retrieve any quarter’s submission and response on request? |
| Security and data protection | GDPR-compliant processing, EU data residency, ISO 27001 or SOC 2 assurance, DORA-ready third-party risk documentation | Where is data hosted? Who are your sub-processors? |
| Expertise | Indirect tax specialists alongside technologists, able to interpret guidance and liaise with tax authorities | Who answers when an authority queries a filing? |
| Pricing model | Transparent pricing that does not penalise volume spikes | Is pricing per country, per file, per payee or per transaction? How do fees change as volumes grow? |
| Exit and continuity | Ability to transition mid-year without gaps or duplicate reporting | How do you onboard a PSP part way through a year? What do we receive if we leave? |
Practical steps for a provider review
- Map every Member State where you have a reporting obligation, including host states for branches and passported services.
- Run the Commission Data Quality Checklist over your last four quarters and record the gaps.
- Collect your rejection and correction history by country to set a baseline.
- Ask shortlisted providers to process a sample quarter in parallel and compare acceptance results.
- Agree a transition plan that avoids a gap or overlap at quarter end, ideally starting at the beginning of a quarter.
How Tax Desk supports CESOP reporting
Tax Desk (www.taxdesk.com) provides CESOP registration, submission and audit support as part of a dedicated indirect tax compliance service, built on a platform originally developed by KPMG.
- Registration and filing in each Member State where a PSP has a reporting obligation, managed through the Tax Desk client portal.
- Data preparation and validation against the current XSD and Validation Module before submission, reducing partial and full rejections.
- Corrections and remediation for rejected files and historic quarters, aligned to the Commission Data Quality Checklist.
- Schema change management so clients move to new versions on each Member State’s timetable.
- Support on audits and authority queries from indirect tax specialists, with dedicated account managers and country experts.
- Related payment reporting for PSPs with Spanish obligations under Model 170 and Model 196 and Italian reporting, alongside VAT, OSS and IOSS compliance for merchant clients.
