PSD2 Assessment of Operational and Security Risks 1 ONR User Guidelines Document

Transcription

1 PSD2 Assessment of Operational and Security Risks 1 ONR User Guidelines Document Published Date September 2018 Version V Reporting of operational and security risks relating to payment services in accordance with Article 95 of Directive (EU) 2015/

2 Table of Contents 1. Introduction 3 2. Template for the Operational and security risks relating to payment services reports 3 3. Navigation to the Operational and Security Risks report 4 4. Upload a report 5 5. Finalise return 8 6. Signing off 9 7. Unlocking a return 11 2

3 1. Introduction Regulation 118(3) of the European Union (Payment Services) Regulations 2018 (S.I. No.6 of 2018) provides that a payment service provider shall provide to the Bank on an annual basis, or at shorter intervals as determined by the Bank, an updated and comprehensive assessment of (a) the operational and security risks relating to the payment services provided by the payment service provider, and (b) the adequacy of the mitigation measures and control mechanisms implemented in response to those risks." This document is a guide for users who will be uploading Operational and Security Risks annual assessment reports to the Central Bank of Ireland via the Online Reporting Platform (ONR). This document outlines the process for Excel file uploads as well as the Finalising and Sign-Off for these reports. Firms are advised that the returns referred to in this guide require a sign-off from an authorised second user. It is the responsibility of the Firm Administrator/Prudential Return contact, to manage user access to the return referred to in this guide. For users not familiar with the ONR system, an ONR User Manual and related guidance documents are available on the Central Bank website at this address: Screenshots and accompanying text will describe scenarios when the file upload has been both successful and unsuccessful. The information contained in this document applies for all Payment Service Providers (PSPs). 2. Template for the Operational and security risks relating to payment services reports The template to be used for the reporting of operational and security risks relating to payment services is available in the PSD2 section of the Central Bank s website. The template is an Excel based report and consists of five worksheet tabs. Only three of the worksheets require input from PSPs to record the risks, the remaining two worksheets contain validation rules. The three worksheets PSPs must complete are: Overview and PSP details Assessment Top 5 risks Please note, the template is protected, prohibiting PSPs from making changes to the report (e.g. adding columns, rows, or renaming the tabs and adding additional tabs). The template uploaded to the ONR must be the template provided on the Central Bank website. 3

4 Complete the information in each of the three tabs listed above. 3. Navigation to the Operational and Security Risks report To submit an assessment of Operational and Security risks, the user will log in to the ONR system with their normal user details, and will be presented with the following Home Page screen. The user will select the View / Edit Data option and will be presented with a list of return types that they / their firm have permission to upload. 4

5 Scroll down to the section called Payment Services. This is where the Operational and Security Risks report will be located. Click on Return name to upload an instance of this return The user will select Operational and Security Risks Reporting. The following screen will appear. 5

6 4. Upload a report The relevant report dates will already be scheduled on the ONR by the Central Bank. To upload a report, click into Load a File. The following screen should appear. Click onto Browse and select the file from your own folder/network to attach. File Naming Convention In order for the Excel files to be submitted, they must follow a defined naming convention. Filenames must conform to the following naming convention: CCCCCCC_YYYYMMDD_PSDA95.xlsx Where 1. CCCCCC is the institution code (The 6/7 institution digit code used for logging into ONR). For Credit Unions, they will need to use their CU registration number (XXXCU) instead of the institution code. 2. YYYYMMDD is the return reporting date (not submission date) e.g PSDA95 is the report name for incident reports on the ONR system 4. The file extension must be.xlsx Next, click Load File. 6

7 The file will then be queued and processed. Once processed, the following screen should appear meaning that the file upload was accepted as valid. 7

8 If the file name does not conform to the naming convention outlined above, then an error message will appear informing the user of the error. The file will not be accepted. Example of an invalid file: Error message will appear Once the file has been uploaded and accepted, go back to the Returns screen. The user can now see the file name has changed format and the status of the file is now valid. Once the status changes to Valid on the Report, the process of Finalising the return can now commence. 8

9 name 5. Finalise Return On the Returns screen, click on the relevant reporting date. The operational and security risks report will appear with a status of Valid. Next, click onto the Finalise button. Click Finalise button The following screen will appear, confirming the report has been finalised. 6. Signing Off The Return is now ready to be signed off. Note that the person that Signs Off the return must be a different user from the one who Finalises the Return. The user within the firm who Signs-Off Returns will log in with their credentials and only this person will be able to access the Sign-Off functionality. The user will navigate to the report through the View / Edit data function outlined at the start of this document. 9

10 Select View/Signoff Returns. From the Returns screen, select the relevant reporting date. This will bring you to the next screen. Press the Sign-Off button. Click to Sign-Off the report If you do not have access to sign-off, the following message will appear: 10

11 Sign-Off Confirmation The Declaration box must be ticked, then press Sign-off Return. If you have successfully signed-off the return, the following screen should appear. 7. Unlocking a Return In order to replace a file for a return that has already been submitted, a request to have the return unlocked will first need to be made to the Central Bank. Submit this request in the usual way. The Submit a Request link can be found on the bottom left of the Operational and Security Risks Reporting return screen, as shown in the screenshot below. 11

12 Once confirmation has been received from the Central Bank that the desired return has been unlocked, its status will appear as Unlocked in ONR, and the amended file can be uploaded as before. Trouble shooting If you encounter any issues uploading the report to the ONR, please follow the standard procedure and submit a query through the ONR using the Submit Request function. ONR User Manual 12