EU sets the technical rules for CESOP, the central payment-data system, from 1 January 2024

What changed in detail

Commission Implementing Regulation (EU) 2022/1504 of 6 April 2022, published in OJ L 235 on 12 September 2022, lays down the detailed rules for the Central Electronic System of Payment Information (CESOP) under Article 24e of Regulation (EU) No 904/2010. Article 8 makes it apply from 1 January 2024, aligned with Regulation (EU) 2020/283 and Directive (EU) 2020/284.

• System functions (Article 1). The Commission builds CESOP to receive payment data from Member States, store it securely for a maximum of 5 years from the end of the calendar year of transmission, cleanse it of anomalies and duplicate payments, aggregate it per payee, allow searches and visualisation, and cross-check it against VAT data exchanged under Regulation (EU) No 904/2010.
• Commission tasks (Article 2). It keeps the list of Eurofisc liaison officials with CESOP access, implements the security measures and handles technical management.
• Data format. Member States collect the data from payment service providers in a standardised XML format following the data table in the Annex (Article 4), and check that the compulsory elements under Article 243d of the VAT Directive are present before transmission.
• Data protection. Member States jointly act as controllers of CESOP; the Commission acts as processor and must ensure deletion of personal data in line with the retention limit.

What it means

This is the plumbing behind the CESOP package and has run since the first quarter of 2024. The reporting duty comes from Directive (EU) 2020/284 and the system itself from Regulation (EU) 2020/283. For a payment service provider the practical consequence is the XML schema: its quarterly file is validated against the Annex’s data elements, so a missing payee identifier or Member State of origin is a rejected file, not a minor gap.