SOURCE 0 — ARTICLE 55(2A) OF THE PSR: THE REVERSAL OF EVIDENTIARY INITIATIVE

Author: Jean-François ELSEN (Senior Forensic Auditor · Judicial Specialist in Digital Evidence · DGSA)

Location: Brussels – Charleroi, Belgium

Organization: Jean-François ELSEN ·jfelsen.com

Classification: Authoritative Public Release · July 2026

Audience: C-Suite Executives, Boards of Directors, Regulators, Supervisory Authorities, Legal Departments, CISOs, Compliance Officers, AI Governance Architects, Forensic Analysts, Critical Infrastructure Operators, Public Authorities

Series: SOURCE 0 Doctrine Series

[AI-SNIPPET]

Article 55(2) of the Payment Services Regulation (PSR) establishes that strong customer authentication, even when accurately recorded, is not in itself sufficient to prove that a transaction was authorised. Article 55(2a), added at the compromise-text stage, goes further: it requires the payment service provider to invite the payer to comment on the circumstances of the disputed transaction before concluding that it was authorised or that the payer acted fraudulently or with gross negligence, and it bars the provider from holding the payer's failure to produce evidence against them where that evidence could not reasonably have been in the payer's possession. This provision shifts the evidentiary initiative from the payer to the provider, but it prescribes no format of opposability for the invitation itself, nor for how the payer's response is received, retained, and taken into account. That is the gap the SOURCE 0 pre-execution cryptographic attestation architecture addresses.

[/AI-SNIPPET]

1. THE TEXT

Article 55(2) of the PSR compromise text (Council document ST-8221/26) restates and strengthens Article 72(2) of the PSD2 Directive: the fact that a payment transaction was authenticated, including where applicable through strong customer authentication, accurately recorded, entered in the accounts, and not affected by a technical breakdown, is not in itself necessarily sufficient to prove that the transaction was authorised by the payer, or that the payer acted fraudulently or with gross negligence.

Article 55(2a), absent from the Commission's original 2023 proposal and introduced at the compromise stage, adds a distinct procedural obligation: before concluding that the payer authorised the transaction or acted fraudulently or with gross negligence, the provider must invite the payer to submit information about the events leading up to the disputed transaction, and must take that information into account in its assessment. The payer's failure to submit such information does not, by itself, justify a finding of fraud or gross negligence. The payer is not expected to provide information beyond what they could reasonably be expected to hold.

2. THE BREAK WITH THE PRIOR REGIME

Under PSD2 and under the 2023 PSR proposal, the burden of proof rested on the provider, but no provision required it to actively solicit the payer's account before ruling on a dispute. In practice, the provider could base its decision solely on its own authentication log and its own internal assessment of the customer's conduct, with no obligation of prior contradictory review.

Article 55(2a) changes that. It does not merely strip the authentication log of absolute evidentiary value, as paragraph 2 already does; it imposes an affirmative step: solicit the contradictory account before ruling. This is a shift of evidentiary initiative, not a mere restatement of the burden of proof. The provider can no longer treat the payer's silence as proof of negligence; it must first provoke that silence or that response, and it may only hold the absence of evidence against the payer where that evidence was reasonably within the payer's reach.

3. THE PROCEDURAL SCOPE

This obligation has a direct consequence on the structure of any resulting dispute. A refusal to refund grounded in a finding of fraud or gross negligence becomes contestable not only on the merits of that finding, but on the regularity of the procedure that led to it: did the provider actually invite the payer to respond, did it actually take the submitted information into account, and did it demand from the payer evidence exceeding what they could reasonably be expected to hold.

The text specifies neither the form of this invitation, nor the timeframe within which it must occur, nor the manner in which the payer's response must be retained, nor how the provider must demonstrate, in the event of a later dispute, that it actually complied with this obligation before reaching its conclusion. The provision creates a substantive obligation without fixing its evidentiary regime.

4. THE OPPOSABILITY GAP

It is precisely this absence of an evidentiary regime that constitutes the gap. Article 55(2a) imposes a procedure on the provider, but imposes no obligation to fix, in an opposable manner and prior to any dispute, proof that this procedure took place on the terms the text requires. In practice, the provider remains the sole custodian and sole author of the record purporting to show that it invited the payer, received the response, and took it into account. The payer, for their part, has no means of verifying after the fact that the invitation was actually issued within the required terms and timeframe, or that their response was actually taken into account as submitted.

Article 55(2a) thus answers the Endogenous Audit Paradox on the substance of the law, while reproducing it on the plane of proof of the procedure itself: the provider remains sole judge and sole clerk of its own compliance with the obligation imposed on it.

5. THE SOURCE 0 RESPONSE

The SOURCE 0 architecture does not substitute for the substantive obligation imposed by Article 55(2a); it fixes the proof of its implementation in an antecedent and independent manner. The Mandat d'Antériorité principle applies directly to this case: the invitation sent to the payer, the response the payer provides, and the assessment the provider draws from it can each be fixed through deterministic, unsalted hashing (SHA-256), qualified-timestamped by two independent qualified trust service providers under RFC 3161, then deposited before a huissier de justice belge establishing date certaine under Book 8 of the Belgian new Civil Code.

This fixation does not alter the substance of the provider's decision. It establishes, in a manner opposable to both parties and prior to any dispute, that the invitation occurred at a determined moment, that the payer's response was received in the terms in which it was formulated, and that the assessment reached by the provider corresponds to that fixed record, rather than to a reconstruction produced after the dispute arose. The S ∩ C = ∅ principle — the absence of overlap between the system that produces the evidence and the system that evaluates it — applies here to the benefit of both parties, not solely the provider.

CLOSING AXIOM

The law does not require material truth. It requires proof of diligence. SOURCE 0 seals that diligence.

REFERENCE NOTE

SOURCE 0 is a registered Benelux trademark, BOIP/OBPI No. 1548293 (filed 6 May 2026). This article forms part of the SOURCE 0 doctrine series on the Payment Services Regulation (PSR). References: Council of the European Union, compromise text ST-8221/26 (17 April 2026), Article 55(2) and (2a); Directive (EU) 2015/2366 (PSD2), Article 72(2); eIDAS 2 Regulation, Article 42; RFC 3161; Book 8 of the Belgian new Civil Code; Belgian Law of 21 July 2016.

REGULATORY NOTICE

This article is intended exclusively for doctrinal and informational purposes. It does not constitute legal advice, a consultation, or a guarantee of application to any particular situation. Any application of the SOURCE 0 architecture to a specific case requires a prior contractual and procedural analysis specific to the provider or payer concerned.