What is CESOP?
On 24 November 2023, Legal Notice 272 of 2023 Value Added Tax (Reporting Obligations for Payment Service Providers) Regulations was published, transposing into Maltese VAT legislation the provisions of Article 1 of the EU Directive (2020/284) regarding the introduction of reporting requirements for payment service providers (PSPs) better known as ‘CESOP’ - Central Electronic System Of Payment information.
These regulations are effective from 1 January 2024, with their main purpose being to require PSPs to keep sufficiently detailed information of payees and payments in relation to the payment services they provide and to submit such information to the Commissioner to enable the competent authorities of the Member States (MSs) to carry out controls of the supplies of goods and in order to achieve the objective of combating VAT fraud.
Who does CESOP affect?
The main subject persons are PSPs (as defined in terms of the Financial Institutions Act Cap 376 of the Laws of Malta, or PSD II (Directive (EU) 2015/2366), whose home or host MS is Malta, which provide payment services falling within the scope of the CESOP Regulations.
PSPs shall keep detailed information on payees and on payments in relation to the payment services they provide for each calendar quarter in Malta as set out in the regulations. This requirement shall apply only to payment services provided as regards cross-border payments (i.e. when the payer is located in a MS and the payee is located in another MS, in a third territory or in a third country).
What is the CESOP precudure?
With respect to the procedure to be followed, subject persons shall notify the Commissioner by applying to be registered as a PSP for the purpose of these regulations by not later than twenty-five (25) days from the date of coming into force of these regulations or the date Malta becomes its home MS or host MS as applicable, whichever is the later.
The notification shall be submitted electronically directly through the established web portal designated by the Commissioner for the purpose of reporting under the central electronic system of payment information ("CESOP"), and shall contain the information requested therein.
The reporting requirement shall apply where, in the course of a calendar quarter, a PSP provides payment services corresponding to more than twenty-five (25) cross-border payments to the same payee (calculated by reference to the payment services provided by the PSP per MS and per payee identifier).
All applicable information shall be submitted for every calendar quarter, by no later than the 28th day of the month following the calendar quarter to which the information relates, by means of an electronic standard form to the Commissioner through the designated web portal and shall be kept by the PSP in an electronic format for a period of three years, from the end of the calendar year of the date of the respective payment.
PSPSs may delegate the task of submitting the required information or notifications to an appointed third party on their behalf. However such delegation shall not effect in any manner the obligations of the PSP to report such information or be deemed to shift in any way any liability to the appointed third party
Failure by any payment service provider to submit the information or notifications required within the respective time limits shall be liable to an administrative penalty in accordance with article 38(2)(c) of the Act (€50 per month capped at €600 ).
Moreover, PSPs failing to adhere to any of the requirements subsequent to two (2) electronic reminders sent by the Commissioner, in relation to the same required submission, over a three (3) month period, or where the information submitted is found to be incorrect in such a way that it is misleading, deceitful or false, every senior managing official of such PSP shall be guilty of an offence and shall on conviction be liable to a fine of not less than €10,000 and not more than €30,000 for each offence.