Malta: Record keeping and reporting obligations for payment service providers beginning 2024

“Payment service providers” will face new record keeping and reporting obligations beginning 1 January 2024. The additional recording and reporting obligations will be introduced to counter value added tax (VAT) fraud associated with e-commerce.

Entities affected by the new rules

The new rules will affect payment service providers as defined under Directive (EU) 2015/2366 (PSD II)—namely credit institutions, electronic money institutions, post-office giro institutions, and payment institutions—when these entities provide payment services.

Payment service providers’ obligation to maintain records and make these records available to the VAT authorities

Payment service providers will be required to maintain records and report when they provide payment services that:

• Qualify as “cross-border payments”
• When in a calendar quarter the number of cross-border payments per payee per EU Member State exceeds 25

The payment service provider of the payer will not be required to maintain records and reporting if at least one of the payment service providers of the payee is based within the EU.

This means that:

• There are no reporting obligations for payment service providers with respect to transactions when both the payer and the payee are based within the same EU Member State or when the payer is based outside the EU.
• In all the other circumstances, the payment service provider of the payee providing payment services in respect of cross-border transactions is required to record and report the transactions. When the payment service provider of the payee is based outside the EU, this obligation shifts to the payment service provider of the payer.

Record keeping obligations under the new rules

Payment service providers that provide payment services in respect to more than 25 cross-border payments per payee per quarter and that have the obligation to maintain records and report, will be required to keep records containing the following information in electronic format for a period of three calendar years from the end of the calendar year of the date of the payment:

• Bank identifier code or other code that unambiguously identifies the payment service provider
• Name of the payee, as it appears in the records of the payment service provider
• Any VAT ID number or other national tax number of the payee (if available)
• International bank account number (IBAN) or similar unique identification that gives the location of the payee
• Bank identifier code that unambiguously identifies and gives location of the payment service provider acting on behalf of the payee where the payee receives funds without having a payment account
• Address of payee as it appears in the records of the payment service provider (if available)
• Details of the cross-border payment and any related refund, namely:
  • The date and time of payment or of the payment refund
  • The amount and currency of the payment /payment refund
  • Member State of origin of the payment received by or on behalf of the payee, the Member State of destination of the refund as appropriate, and the information used to determine the origin or the destination of the payment or the payment refund
  • Any reference that unambiguously identifies the payment
  • Information that the payment is initiated at the physical premises of the merchant (when applicable)

In addition to maintaining the records, payment service providers will be required to make such records available to the tax authorities of the relevant MS through a new system—the central electronic system of payment information (CESOP).

KPMG observation

While the growth of e-commerce facilitated the sale of goods and services across various EU Member States, it has also provided businesses with the opportunity of gaining an unfair market advantage by evading their VAT obligations. Given that the vast majority of online purchases made by consumers are executed through payment service providers, the new rules are aimed at payment service providers as they have access to information which, once communicated to the tax authorities, enables the authorities to detect fraudulent businesses and control VAT liabilities.

Ahead of these rules, payment service providers may need to review the manner in which information is currently being captured for regulatory reporting purposes and assess whether the system may require updating to capture the information necessary to fulfil the new recording and reporting obligations effective as from 1 January 2024.

Read an August 2022 report [PDF 685 KB] prepared by the KPMG member firm in Malta