What the Payments Ecosystem Needs to Know About the EU's New Cyber Reporting Requirements

The EU's Cyber Resilience Act introduces a 24-hour reporting requirement for exploited cyber vulnerabilities in payment hardware, shifting security expectations from point-in-time compliance to continuous lifecycle security oversight. This impacts manufacturers, payment service providers, acquirers, and merchants operating in the EU payment ecosystem, requiring improved vulnerability visibility and software inventory management such as verified Software Bills of Materials (SBOMs).

This Wire brief sits within Fusion42's coverage of Fintech.