knowledge 2 November 2026 |

Mandatory Fraud Data Sharing Is Coming: What PSPs Need to Know About FRIDA

FRIDA will cover account-to-account payments made through the EPC schemes and through other account-to-account schemes within the PSR’s scope. Under the draft rulebook, adherence will be mandatory for in-scope PSPs in the EEA that participate in one or more of the EPC payment schemes, and optional for other PSPs within the PSR’s scope. The EPC is seeking views on the draft rulebook through a three-month public consultation, which closes on 10 December 2026.

This briefing is relevant to banks, payment and e-money institutions, payment infrastructures, and their fraud, compliance and data protection teams.

Key takeaways

• FRIDA will cover account-to-account payments made through the EPC schemes and other account-to-account schemes within the PSR’s scope.
• Adherence will be mandatory for in-scope EEA PSPs that participate in one or more EPC payment schemes and optional for other PSPs within the PSR’s scope.
• The final rulebook and technical specifications are targeted for May–June 2027 and are expected to take effect with the PSR in Q4 2028.
• The consultation closes on 10 December 2026.

What is FRIDA?

FRIDA is a scheme that will allow PSPs to share fraud information in a secure, structured and standardised way. In summary:

• Why it is needed: Fraudsters routinely operate across multiple institutions and jurisdictions, exploiting the fact that each PSP sees only part of the picture. FRIDA is intended to close that gap by enabling PSPs to share fraud information with one another across the same cross-institutional and cross-border landscape in which fraudsters operate.
• Legal basis: FRIDA is designed to implement a fraud information-sharing arrangement provided for in the forthcoming PSR. Under the current PSR text, PSPs will be required to participate in information-sharing arrangements and exchange specified fraud-related information where they have objectively justified reasons to suspect fraudulent behaviour by a payment service user.
• Governance: FRIDA will be a fully governed scheme, built around a rulebook, implementation guidelines and common standards, and will be rolled out in phases.

Who is affected?

FRIDA will be relevant to:

• PSPs in the EEA that process account-to-account payments: adherence will be mandatory for in-scope participants in the EPC payment schemes and optional for other PSPs within the PSR’s scope. The scheme may subsequently be extended to PSPs in non-EEA SEPA countries, subject to relevant EPC decisions and legal requirements;
• Payment infrastructures and national or sectoral fraud information platforms; and
• Fraud prevention, compliance and data protection teams within PSPs.

What are the key features?

The draft rulebook sets out the following key features:

• Initial focus: The scheme will initially cover account-to-account transactions, namely credit transfers and direct debits.
• Alerts: A PSP that identifies objectively justified reasons to suspect fraudulent behaviour can issue an alert, which is then made available to all PSPs participating in FRIDA. Alerts can be updated, for example to cancel a false positive or, where the PSP services the account concerned, to record the relevant identifier as genuine, suspicious, fraudulent, blocked or closed.
• Architecture: Under the draft rulebook’s current working model, the FRIDA Central Platform will act as the central hub, with PSPs connecting through Fraud Information Platforms. The EPC is consulting on whether PSPs should also be permitted to connect directly to the central platform.
• Data: All participants must be able to share certain mandatory data elements. Sharing optional data is encouraged but not required.
• No decisions based solely on shared information: Receiving PSPs must use shared information as one element of their own transaction monitoring. Under the current PSR text, a PSP may not use information received from another PSP as the sole basis for a decision affecting the customer relationship, including termination or future onboarding, without first carrying out its own assessment.
• Storage: Alerts will remain available on the FRIDA Central Platform for three months. Under the current PSR text, shared data must not be retained for longer than is necessary and, in any event, for no longer than five years after the suspected fraudulent transaction. PSPs must purge their local copies accordingly.
• Data protection: PSPs must continue to comply with the General Data Protection Regulation (the “GDPR”). Under the current PSR text, PSPs must jointly carry out a data protection impact assessment before concluding an information-sharing arrangement. The EPC indicated during its October 2026 webinar that it intends to lead this work for FRIDA in engagement with data protection authorities.

Key dates

FRIDA will be rolled out in phases. The key milestones are:

• May–June 2027: The target period for publishing the final rulebook (version 1.0) and the technical specifications.
• Adherence and testing: Adherence and testing phases will follow ahead of go-live; the EPC has not yet confirmed dates.
• Q4 2028 (expected): The PSR is expected to take effect, and the final FRIDA rulebook is expected to take effect on the same date.

What should firms do now?

• Review the draft rulebook and decide whether to respond to the EPC consultation, which closes on 10 December 2026.
• Begin mapping the impact on transaction monitoring, data models, vendors and GDPR documentation.

How can McCann FitzGerald LLP help?

Our Financial Regulation team regularly advises payment service providers and other financial services businesses on EU regulatory developments. For further information on any of the matters discussed in this briefing or for assistance in understanding how FRIDA and the PSR may affect your business, please contact any of the key contacts below or your usual contact at McCann FitzGerald LLP.