The EBA's ICT and Security Risk Management Guidelines provide guidance whose amended scope focuses on payment-service user relationship management. Read alongside DORA's ICT-risk framework, they help distinguish remaining payment-specific guidance from the digital-resilience regime.
TL;DR:
- The May 2026 text focuses on payment-user security awareness, guidance, limits, alerts and support.
- Earlier broad ICT-governance and continuity chapters were deleted after DORA.
- DORA and its technical standards now supply the wider resilience framework.
Summary
An amended guideline alongside DORA
EBA/GL/2019/04 originally covered a broad ICT and security risk-management framework. Following DORA's application, the EBA narrowed the guidelines through EBA/GL/2025/02. The consolidated text dated 19 May 2026 states that its subject is payment-user relationship management and that it complements DORA risk-management measures. Reading the historic title alone can therefore give a misleading impression of the current substantive scope.
Security awareness and assistance for users
The retained section expects payment-service providers to help users understand security risks through assistance and guidance. That material should be updated as threats and vulnerabilities change, and relevant changes communicated to users. Providers should also inform users about security-procedure updates that affect their payment services. The emphasis is on the continuing provider-user relationship and the information that enables customers to use the service more safely.
Controls and alerts within the payment product
Where functionality permits, providers should allow users to disable specific payment functions. Where spending limits have been agreed for relevant instruments, users should be able to adjust them up to the agreed maximum. The guidelines also describe options for alerts about initiated payments and failed attempts to initiate them. These expectations connect security management with product controls that help users recognise or limit fraudulent and malicious activity.
Support and the boundary of the retained text
Providers should assist with security questions, support requests and notifications of anomalies or problems and make clear how users can obtain that assistance. The consolidated version marks the earlier governance, information-security, ICT-operations, project-management and continuity sections as deleted. Wider institutional resilience requirements must therefore be located in DORA and the other applicable instruments. The guidelines remain supervisory guidance under the EBA framework, rather than a replacement for the legislation they complement.
Keywords
- EBA guidelines
- payment-user security
- DORA alignment
- security awareness
- customer guidance
- transaction alerts
- adjustable limits
- user support
- 2026 consolidation
- ICT scope