A payment outage, and you have thirty seconds to know which report it triggers. The record already knows.
A payment or e-money institution runs client screening, incident response, and ICT resilience on the same tight clock. Since January 2025, an ICT outage is reported through DORA, not the old PSD2 incident channel, while a safeguarding breach or fraud spike still runs through the PSD3 sector channel, and working out which is which under deadline is live work every time. Our platform holds the suppliers, the AML/KYC casework, and the incident record as one connected set, so the classification question has an answer before the clock runs out. PSD3 safeguarding and strong customer authentication, the conduct-specific rulebook, stay with our specialists.
Which channel does this incident belong in?
Since January 2025, an ICT outage at a payment institution is reported through DORA, not the payment-incident channel PSD2 used to provide. A safeguarding breach, a fraud spike, or a settlement failure that is not ICT in nature still runs through the PSD3 sector channel. The two channels have different deadlines and different recipients, and working out which one a given incident belongs in, sometimes both, is judgement work done under pressure, not a lookup.
The safeguarding bank sits at the centre of a second problem. The same credit institution that holds segregated client funds is often the firm's own account-services provider and sometimes its acquirer too. That one relationship is tracked as a safeguarding counterparty in one file and an ICT or outsourcing dependency in another, and the two rarely agree on the detail.
Client and merchant onboarding runs its own AML/KYC track: PEP and sanctions screening, source-of-funds checks, beneficial-ownership look-through, on top of everything else, usually in a system the incident and supplier records never touch.
The incident record carries the classification with it.
On the platform, the safeguarding bank, processor, or acquirer is a single supplier object. The functions it supports, safeguarding, treasury, acquiring, and the ICT assets downstream are connected records, so the same relationship does not need reconciling across a safeguarding file and an ICT register.
Incident management runs as a workflow against that same supplier and function data. When an outage happens, the event already carries the data (which supplier, which function, what criticality) that the DORA-versus-PSD3 classification question needs, and the decision moves through a four-eye approval gate rather than a hallway conversation. AML/KYC, case management, PEP and sanctions screening, source-of-funds, beneficial-ownership look-through, runs in the platform against the same client and counterparty records, not a separate system.
What this does not claim: the platform does not decide safeguarding-diversification strategy or write the PSD3 safeguarding register itself. That interpretation stays with our specialists, using the same supplier data as their starting point.
DORA, AML/KYC, and incident classification. Safeguarding and SCA stay advisory.
When a PI or EMI is onboarded, the platform activates the DORA Register of Information across all fifteen RT/B tables, submission-ready as XBRL-CSV, with GLEIF/LEI verification on safeguarding banks, processors, acquirers, and open-banking connections modelled as suppliers. Supplier risk, the register, AI-assisted and privacy assessments, and contractual arrangements, sits on the same objects.
AML/KYC runs in the platform: case management, PEP and sanctions screening, source-of-funds, and beneficial-ownership look-through, covering client and merchant onboarding under the AMLR. Incident management is workflow-integrated, so classification and escalation happen against the supplier and function data already in the system, behind a four-eye approval gate, rather than being reconstructed after the fact.
Our specialists produce the PSD3 safeguarding-diversification register and the strong customer authentication exemption strategy, using the platform's supplier data as their starting input. PSD3 transposition readiness is tracked as national positions land.
The channel call stays with a person, recorded either way.
Whether a given incident is a DORA major incident, a PSD3 major-payment-incident, or both, and how the safeguarding-diversification strategy should be structured, are calls our specialists make, several of them former DNB payments supervisors and PI or EMI compliance officers. They work from the same supplier and incident data the platform holds, not a separate reconstruction.
The reasoning is written down against the incident or supplier record it concerns, so when a supervisor asks why an event was routed one way, the answer already exists, dated and attributed.
You own the platform, the data as adapted to your operation, and the written record of every interpretation decision. Advisory work on safeguarding and SCA continues for as long as you need it.
A discovery call, not a product demo.
You describe the compliance problem consuming the most of your team's time. We walk the platform through an example close enough to your operation that you can judge whether this way of modelling compliance fits how you want to work.
Book a discovery call →