99.—(1) If a payment service provider becomes aware of a major operational or security incident, the payment service provider must, without undue delay, notify the FCA.
(2) A notification under paragraph (1) must be in such form and manner, and contain such information, as the FCA may direct.
(3) If the incident has or may have an impact on the financial interests of its payment service users, the payment service provider must, without undue delay, inform its payment service users of the incident and of all measures that they can take to mitigate the adverse effects of the incident.
(4) Upon receipt of the notification referred to in paragraph (1), the FCA [F1must notify any other relevant authorities in the United Kingdom].
F2(5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Textual Amendments
F1Words in reg. 99(4) substituted (31.12.2020) by The Electronic Money, Payment Services and Payment Systems (Amendment and Transitional Provisions) (EU Exit) Regulations 2018 (S.I. 2018/1201), reg. 1(3), Sch. 2 para. 47(2) (with reg. 4, Sch. 3 Pt. 2) (as amended by S.I. 2020/56, regs. 1, 8); 2020 c. 1, Sch. 5 para. 1(1)
F2Reg. 99(5) omitted (31.12.2020) by virtue of The Electronic Money, Payment Services and Payment Systems (Amendment and Transitional Provisions) (EU Exit) Regulations 2018 (S.I. 2018/1201), reg. 1(3), Sch. 2 para. 47(3) (with reg. 4, Sch. 3 Pt. 2) (as amended by S.I. 2020/56, regs. 1, 8); 2020 c. 1, Sch. 5 para. 1(1)