Compliance7 min readUpdated October 15, 2026

What Is CESOP and Who Has to Report?

CESOP explained: a table to check if you must report, the 25-payment rule, the data fields, quarterly XML deadlines and what changes for merchants.

Nick Bonnassies, CMO at Tagada · checked against 7 sources

Article summary

TL;DR

CESOP (Central Electronic System of Payment information) is the EU database that collects cross-border payment data to fight VAT fraud. Since January 1, 2024, payment service providers must keep records of payees receiving more than 25 cross-border payments in a quarter and report them to a tax authority by the end of the next month. Merchants do not file.

CESOP rests on Directive (EU) 2020/284, which amends the VAT Directive, and Regulation (EU) 2020/283, which creates the database. Both apply from January 1, 2024.
Only PSD2 payment service providers report: banks, e-money institutions, post office giro institutions and payment institutions. Merchants do not file, but their data is in the report.
A payment is cross-border when the payer is in an EU Member State and the payee is in another Member State or outside the EU. Reporting starts above 25 such payments to one payee in a quarter.
Reports are XML files sent to the national tax authority by the end of the month after each quarter. Records are kept for three calendar years.
Crypto-asset transfers are reported under DAC8, Directive (EU) 2023/2226, not CESOP.

Want to go further? Ask

On this page

What is CESOP?

CESOP is the Central Electronic System of Payment information, an EU database run by the European Commission. Payment service providers (PSPs) send it data on cross-border payments, through their national tax authority, so that anti-fraud teams can spot sellers who do not pay VAT where they should.3

It rests on two texts adopted on February 18, 2020:

Directive (EU) 2020/284 adds articles 243a to 243d to the VAT Directive. They define who keeps records, which payments count and what data to keep.1
Regulation (EU) 2020/283 creates the CESOP database and sets how Member States collect and share the data.2

Both apply from January 1, 2024. The Commission dates the start of reporting to April 1, 2024.3 The Directive's reasoning: most EU online purchases are paid through PSPs, which hold the payee's identity and the payment details, while consumers have no VAT accounting duties.1

Only Eurofisc liaison officials, the network of national anti-fraud experts, can access CESOP, and only for VAT fraud investigations or detection.2

Am I subject to CESOP?

Four questions decide it. All come from articles 243a and 243b of the VAT Directive.1

Are you a payment service provider? That means a credit institution, an e-money institution, a post office giro institution or a payment institution (PSD2 Article 1(1)(a) to (d)), or a person exempted under PSD2 Article 32.
Do you provide a payment service in scope? Executing payments (cards, credit transfers, direct debits), issuing payment instruments or acquiring payments, or money remittance (PSD2 Annex I, points 3 to 6). Payment initiation and account information services alone are not in scope.
Is the payment cross-border? The payer is located in an EU Member State and the payee in another Member State, a third territory or a third country. Location comes from the IBAN or other identifier, or failing that, from the BIC of the PSP acting for that person.
Did one payee receive more than 25 of them in the quarter? The count is made per Member State and per payee identifier. If the PSP knows a payee has several identifiers, it counts per payee.

Source: Directive (EU) 2020/284, articles 243a to 243c; Directive (EU) 2015/2366 (PSD2), Article 1(1) and Annex I.

When both sides have an EU PSP, the payee's PSP keeps the records. The payer's PSP is exempt for that payment but still includes it in its count. When the payee's PSP is outside the EU, the payer's PSP records it.1 Irish Revenue adds that when a payee has several PSPs in the chain, all of them report.4

Illustrative situation	Who keeps records and reports
French customer pays a German shop by card; the shop's acquirer is in the EU; 40 payments that quarter	The shop's acquirer (payee's PSP)
Spanish customer pays a US shop whose only PSP is in the US; 60 payments that quarter	The customer's PSP, for example the card issuer (payer's PSP)
Italian customer pays an Italian shop	Nobody: the payment is not cross-border
A Dutch seller receives 20 cross-border payments in the quarter	Nobody: the 25-payment threshold is not passed
The online merchant itself, using a PSP to get paid	Not the merchant: its PSP reports, using the merchant's data

Illustrative examples built from articles 243b and 243c, not legal advice.

CESOP reporting rules: what goes in the report

Article 243d lists the data. It is about the payee and the payment, not the shopper.1

About the payee

BIC or other identifier of the reporting PSP
Name or business name, as in the PSP's records
VAT number or other tax number, if available
IBAN or other identifier giving the payee's location
BIC of the payee's PSP, if the payee has no payment account
Address, if available

About each cross-border payment, and each refund linked to it

Date and time
Amount and currency
Member State of origin, or of destination for a refund, and the data used to find it
A reference that uniquely identifies the payment
Whether it was initiated at the merchant's physical premises

The PSP keeps these records in electronic form for three calendar years from the end of the year of the payment.1 The Commission states that consumer information and the purpose of the payment are not transmitted.3

CESOP XML reporting and deadlines

Each Member State collects the data by the end of the month after the quarter, on an electronic standard form.2 In practice that form is an XML file. Ireland, for example, requires "a specified XML format" filed through its Revenue Online Service (ROS).4

Quarter endsMarch 31, June 30, Sept 30, Dec 31
PSP filesBy the end of the next month (Ireland: Apr 30, Jul 31, Oct 31, Jan 31)
Member State forwardsTo CESOP by the 10th day of the second month
CESOP storesUp to five years after the year of transmission

Sources: Regulation (EU) 2020/283, articles 24b and 24c; Irish Revenue.2 4

The Commission publishes the technical files on its CESOP page. As read on October 14, 2026, it lists:3

the XSD User Guide v7.00 and its XSD package, dated April 17, 2026;
the CESOP Validation Module v1.7.1 with its User Manual v6.00, dated October 20, 2025;
the Guidelines for the reporting of payment data (v1.2), dated June 19, 2025;
a CESOP Data Quality Checklist, dated June 29, 2026, and a list of national portals.

Its FAQ, it warns, "have no legal value and are subject to ongoing updates."

Data and system readiness for CESOP

"CESOP data capabilities" has two meanings. For the database itself, the Regulation lists four: store the data, aggregate it per payee, analyse it with other VAT information, and make it accessible to Eurofisc officials.2 For a PSP, readiness means being able to produce the Article 243d fields every quarter.

Find the payee data
Name, VAT number, IBAN or other identifier and address usually sit in onboarding records, not in the payment system.
Locate the payer
Keep the payer's IBAN country or the BIC of their PSP for every payment, since that decides if it is cross-border.
Count per payee
Apply the 25-payment test per Member State and per identifier, and merge identifiers you know belong to one payee.
Link the refunds
Each refund must point to the cross-border payment it reverses.
Validate the file
Check the XML against the current XSD before the deadline. The Commission publishes a Validation Module for this.

A "CESOP reporting tool" or "solution" automates this for a PSP. The legal obligation stays with the PSP.

Digital assets and CESOP

CESOP borrows PSD2 definitions: a "payment" is a PSD2 payment transaction or money remittance.1 Irish Revenue lists the methods in scope as card payments, credit or bank transfers, direct debits, e-money payments and money remittances.5 Crypto-assets follow a separate regime: DAC8, Directive (EU) 2023/2226, which makes crypto-asset service providers report to tax authorities. Member States apply it from January 1, 2026.7

What CESOP means for an online merchant

You file nothing, but you are in the data. If more than 25 of your payments in a quarter come from customers in other EU countries, your PSP reports your name, VAT number, account and every payment. That is why PSPs ask merchants for a VAT number and a correct legal address: the Directive asks them to report these "if available."1

Tax authorities in the customers' countries can then compare those payments with the VAT you declared there. For the role of your PSP in each payment, see what a payment service provider is, and for selling under someone else's VAT registration, merchant of record. The PSD2 framework behind these definitions is on our PSD2 page, and the payment flows themselves on cross-border payments.

Updated on October 15, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Am I subject to CESOP as an online merchant?

No, not as a filer. CESOP obligations apply to payment service providers as defined in PSD2. If you sell online and accept cards or transfers through a bank, acquirer or payment institution, that provider keeps the records and reports them. Your name, VAT number, account identifier and payments are part of what it reports.

Do I have to comply with CESOP if I run a marketplace?

Only if the marketplace is itself a licensed payment service provider, or benefits from a PSD2 exemption under Article 32, and provides payment services such as acquiring or money remittance. A marketplace that relies on a third-party PSP to collect payments does not file; that PSP does.

What is the CESOP reporting deadline?

Tax authorities collect the data by the end of the month following each calendar quarter. In Ireland, that means April 30, July 31, October 31 and January 31. Each Member State then forwards the data to CESOP by the tenth day of the second month after the quarter.

What data does a CESOP report contain?

The reporting PSP's BIC or other identifier, the payee's name, VAT or tax number if available, IBAN or other identifier, and address if available. For each payment or refund: date and time, amount, currency, Member State of origin or refund destination, a unique reference, and whether it was made at the merchant's premises.

Does CESOP cover crypto and digital assets?

CESOP uses PSD2 definitions, so it covers payment services such as cards, credit transfers, direct debits, e-money and money remittance. Transfers of crypto-assets are reported by crypto-asset service providers under DAC8, Directive (EU) 2023/2226, which Member States apply from January 1, 2026.

Does CESOP collect data about consumers?

Very little. The Directive says the only payer information to keep is the payer's location, and the European Commission states that consumer information and the purpose of the payment are not transmitted. The report is about payees, the businesses receiving the money.

Sources

Checked October 15, 2026

TagadaPay

Selling to customers across Europe? Run every payment from one checkout

Tell us what you sell and how you sell it. Each application is underwritten, and approval is not guaranteed.

Apply for processing See pricing

01Tell us what you sell and how
02Underwriting reviews your business
03Process through TagadaPay alongside your other processors