Reporting of Major Operational or Security Incidents

(1) A payment service provider must inform BaFin without delay of a major operational or security incident. BaFin informs the European Banking Authority and the European Central Bank without delay of receiving a report, providing the relevant details of the incident. It must assess without delay the relevance of the incident to other domestic authorities affected within their area of competence, and inform them accordingly.
(2) BaFin assists the European Banking Authority and the European Central Bank in assessing the relevance of the incident to other authorities of the European Union, the other Member States and the other states party to the Agreement on the European Economic Area that are within their area of competence.
(3) Where BaFin is informed by the European Banking Authority or the European Central Bank of an incident within the meaning of subsection (1), first sentence, it must take the protective measures necessary for the immediate security of the financial system.
(4) Where an incident within the meaning of subsection (1), first sentence, may affect the financial interests of its payment service users, a payment service provider must without delay notify them of the incident and inform them of any measures they can take to mitigate its adverse effects.
(5) Payment service providers must submit to BaFin, at least once a year, statistical data on instances of fraud relating to the various means of payment. BaFin must make the data submitted available to the European Banking Authority and the European Central Bank in aggregated form.
(6) Reporting obligations of payment service providers to other domestic authorities, BaFin's assistance tasks, and the competences of other domestic authorities in respect of major operational or security incidents, remain unaffected.
(7) Subsections (1) to (4) do not apply to payment service providers within the meaning of section 1(1), first sentence, no. 1, 2 or 3.