On 1 August 2025, the Court of Justice of the European Union (CJEU) delivered a key judgment in Case C-665/23, IL v. Veracash SAS. The case revolved around the interpretation of a payer’s duty to notify unauthorised transactions under Directive 2007/64/EC (PSD1), and its relevance under Directive 2015/2366 (PSD2).
The decision provides important clarity on how late notification affects liability, and sets out the limits of a payment service provider’s right to refuse reimbursement. For issuers, acquirers, and compliance teams, the ruling has immediate operational and legal significance.
The Background Case
The dispute arose in France in 2017. IL, a customer of Veracash, claimed never to have received the payment card issued to him in March that year. Nevertheless, between March and May 2017, daily withdrawals were carried out on his account.
IL reported the issue only on 23 May 2017, nearly two months after the first disputed transaction. Both the Court of Évry and later the Paris Court of Appeal rejected his reimbursement claim, reasoning that he had failed to notify Veracash “without undue delay” as required by national law implementing PSD1.
On appeal, IL argued that EU law granted him 13 months to notify unauthorised transactions. Veracash countered that the 13-month period was merely a maximum limit, which did not override the obligation to act promptly.
The Cour de cassation (Court of Cassation, France) referred the matter to the CJEU, asking whether a payer can lose the right to reimbursement even if notification is made within the 13-month deadline, and whether intent or gross negligence must be shown to justify such a loss.
Why PSD1 and PSD2 Were Both Relevant
Although the facts occurred under PSD1, the case was judged after PSD2 had already entered into force. The CJEU considered both directives because:
- Timing: PSD2 entered into force in 2016, with a transposition deadline of January 2018, covering the transition period when the events took place.
- Continuity: Articles 56, 58, 60, and 61 of PSD1 were substantially reproduced in PSD2, meaning the Court’s interpretation applies equally to both regimes.
- Forward Guidance: Referring to PSD2 ensured the ruling’s applicability to current and future disputes, and provides interpretive continuity as the EU moves towards PSD3.
The CJEU’s Ruling
The Court made three key clarifications:
- Dual Obligation
The payer must notify both (a) without undue delay once aware of an unauthorised transaction, and (b) within 13 months of the debit. The 13-month period is not a standalone right to reimbursement. - Fraud or Gross Negligence as a Threshold
A provider may refuse reimbursement only if the payer’s delay was intentional or the result of gross negligence. Ordinary or minor delay does not deprive the payer of protection. - Successive Transactions
For multiple unauthorised debits, reimbursement may be refused for those that could have been prevented by earlier notification, again subject to the condition of intent or gross negligence.
Why This Matters for Payment Providers
For the payments industry, the judgment provides both clarity and obligations:
- Operational Impact: Providers must be able to distinguish between negligent and non-negligent customer behaviour when evaluating claims.
- Customer Disclosure: Clear communication on the dual requirement—prompt action and the 13-month maximum—is essential to manage expectations and reduce disputes.
- Fraud Management: The ruling underscores the value of real-time monitoring and customer alerts, enabling both sides to act quickly.
- Contractual Alignment: Terms and conditions should be updated to reflect this balance of obligations, ensuring compliance with both PSD2 and national transpositions.
Strategic Takeaway
The CJEU has confirmed that the 13-month period is not an unconditional safety net. Providers may deny reimbursement for undue delay, but only if intent or gross negligence is proven.
For payment providers, this ruling highlights the need to:
- reinforce fraud prevention and detection tools,
- educate customers on their duty to act quickly, and
- prepare for PSD3, which is likely to tighten liability and consumer protection rules further.
This judgment is a timely reminder that maintaining confidence in digital payments depends on striking the right balance between consumer rights and operational risk management.
CJEU #PaymentsIndustry #PaymentServices #UnauthorisedTransactions #PSD1 #PSD2 #PSD3 #RegTech #Compliance #RiskManagement #FraudPrevention #ConsumerProtection #BankingLaw #Fintech
