Provisional text

JUDGMENT OF THE COURT (First Chamber)

15 October 2026 (*)

( Reference for a preliminary ruling – Payment services in the internal market – Directive (EU) 2015/2366 – Unauthorised payment transactions – Article 73 – Payment service provider’s liability – Article 74 – Payer’s liability – Obligation of the payment service provider to refund immediately – Scope – Allocation of liability between the payment service provider and the payer – Article 69 – Obligations of the payment service user – Gross negligence – Refusal by the payment service provider to refund immediately to the payer the amount of an unauthorised transaction on the ground that that payer made that transaction possible through gross negligence )

In Case C‑70/25 [Tukowiecka], (i)

REQUEST for a preliminary ruling under Article 267 TFEU from the Sąd Rejonowy w Koszalinie (District Court, Koszalin, Poland), made by decision of 23 January 2025, received at the Court on 3 February 2025, in the proceedings

N.O.

v

PKO BP S.A.,

THE COURT (First Chamber),

composed of F. Biltgen, President of the Chamber, S. Gervasoni, A. Kumin, I. Ziemele and M. Bošnjak (Rapporteur), Judges,

Advocate General: A. Rantos,

Registrar: V. Di Bucci,

having regard to the written procedure,

after considering the observations submitted on behalf of:

–        PKO BP S.A., by M. Trepka and M. Wurm, radcowie prawni, and by Ł. Hejmej and A. Szczęśniak, adwokaci,

–        the Polish Government, by B. Majczyna, acting as Agent,

–        the Czech Government, by J. Očková, M. Smolek and J. Vláčil, acting as Agents,

–        the Italian Government, by S. Fiorentino, acting as Agent, and by G. Iappelli, avvocato dello Stato,

–        the European Commission, by G. Goddin and J. Szczodrowski, acting as Agents,

after hearing the Opinion of the Advocate General at the sitting on 5 March 2026,

gives the following

Judgment

1        The request for a preliminary ruling concerns the interpretation of Article 73(1) and Article 74(1) of Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ 2015 L 337, p. 35, and corrigendum OJ 2018 L 102, p. 97).

2        The request has been made in proceedings between N.O., a natural person, and PKO BP S.A., a bank, concerning that bank’s refusal to refund the amount of a payment transaction not authorised by N.O.

 Legal context

 European Union law

 Directive 2007/64/EC

3        Article 60 of Directive 2007/64/EC of the European Parliament and of the Council of 13 November 2007 on payment services in the internal market amending Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC (OJ 2007 L 319, p. 1), entitled ‘Payment service provider’s liability for unauthorised payment transactions’, provided, in paragraph 1 thereof:

‘Member States shall ensure that, without prejudice to Article 58, in the case of an unauthorised payment transaction, the payer’s payment service provider refunds to the payer immediately the amount of the unauthorised payment transaction and, where applicable, restores the debited payment account to the state in which it would have been had the unauthorised payment transaction not taken place.’

 Directive 2015/2366

4        Recitals 6 and 71 of Directive 2015/2366 read as follows:

‘(6)      New rules should be established to close the regulatory gaps while at the same time providing more legal clarity and ensuring consistent application of the legislative framework across the [European] Union. Equivalent operating conditions should be guaranteed, to existing and new players on the market, enabling new means of payment to reach a broader market, and ensuring a high level of consumer protection in the use of those payment services across the Union as a whole. This should generate efficiencies in the payment system as a whole and lead to more choice and more transparency of payment services while strengthening the trust of consumers in a harmonised payments market.

…

(71)      In the case of an unauthorised payment transaction, the payment service provider should immediately refund the amount of that transaction to the payer. However, where there is a high suspicion of an unauthorised transaction resulting from fraudulent behaviour by the payment service user and where that suspicion is based on objective grounds which are communicated to the relevant national authority, the payment service provider should be able to conduct, within a reasonable time, an investigation before refunding the payer. In order to protect the payer from any disadvantages, the credit value date of the refund should not be later than the date when the amount has been debited. In order to provide an incentive for the payment service user to notify, without undue delay, the payment service provider of any theft or loss of a payment instrument and thus to reduce the risk of unauthorised payment transactions, the user should be liable only for a very limited amount, unless the payment service user has acted fraudulently or with gross negligence. In that context, an amount of EUR 50 seems to be adequate in order to ensure a harmonised and high-level user protection within the Union. There should be no liability where the payer is not in a position to become aware of the loss, theft or misappropriation of the payment instrument. Moreover, once users have notified a payment service provider that their payment instrument may have been compromised, payment service users should not be required to cover any further losses stemming from unauthorised use of that instrument. This Directive should be without prejudice to payment service providers’ responsibility for technical security of their own products.’

5        Article 1 of Directive 2015/2366, entitled ‘Subject matter’, provides in paragraph 2(b) thereof:

‘This Directive also establishes rules concerning:

…

(b)      the respective rights and obligations of payment service users and payment service providers in relation to the provision of payment services as a regular occupation or business activity.’

6        Article 69 of that directive, entitled ‘Obligations of the payment service user in relation to payment instruments and personalised security credentials’, provides:

‘1.      The payment service user entitled to use a payment instrument shall:

(a)      use the payment instrument in accordance with the terms governing the issue and use of the payment instrument, which must be objective, non-discriminatory and proportionate;

(b)      notify the payment service provider, or the entity specified by the latter, without undue delay on becoming aware of the loss, theft, misappropriation or unauthorised use of the payment instrument.

2.      For the purposes of point (a) of paragraph 1, the payment service user shall, in particular, as soon as in receipt of a payment instrument, take all reasonable steps to keep its personalised security credentials safe.’

7        Article 71 of Directive 2015/2366, entitled ‘Notification and rectification of unauthorised or incorrectly executed payment transactions’, provides in paragraph 1 thereof:

‘The payment service user shall obtain rectification of an unauthorised or incorrectly executed payment transaction from the payment service provider only if the payment service user notifies the payment service provider without undue delay on becoming aware of any such transaction giving rise to a claim, including that under Article 89, and no later than 13 months after the debit date.

…’

8        Article 72 of that directive, entitled ‘Evidence on authentication and execution of payment transactions’, provides in paragraph 2 thereof:

‘Where a payment service user denies having authorised an executed payment transaction, the use of a payment instrument recorded by the payment service provider, including the payment initiation service provider as appropriate, shall in itself not necessarily be sufficient to prove either that the payment transaction was authorised by the payer or that the payer acted fraudulently or failed with intent or gross negligence to fulfil one or more of the obligations under Article 69. The payment service provider, including, where appropriate, the payment initiation service provider, shall provide supporting evidence to prove fraud or gross negligence on part of the payment service user.’

9        Article 73 of Directive 2015/2366, entitled ‘Payment service provider’s liability for unauthorised payment transactions’, provides in paragraph 1 thereof:

‘Member States shall ensure that, without prejudice to Article 71, in the case of an unauthorised payment transaction, the payer’s payment service provider refunds the payer the amount of the unauthorised payment transaction immediately, and in any event no later than by the end of the following business day, after noting or being notified of the transaction, except where the payer’s payment service provider has reasonable grounds for suspecting fraud and communicates those grounds to the relevant national authority in writing. Where applicable, the payer’s payment service provider shall restore the debited payment account to the state in which it would have been had the unauthorised payment transaction not taken place. This shall also ensure that the credit value date for the payer’s payment account shall be no later than the date the amount had been debited.’

10      Article 74 of that directive, entitled ‘Payer’s liability for unauthorised payment transactions’, states in paragraph 1 thereof:

‘By way of derogation from Article 73, the payer may be obliged to bear the losses relating to any unauthorised payment transactions, up to a maximum of EUR 50, resulting from the use of a lost or stolen payment instrument or from the misappropriation of a payment instrument.

The first subparagraph shall not apply if:

(a)      the loss, theft or misappropriation of a payment instrument was not detectable to the payer prior to a payment, except where the payer has acted fraudulently; or

(b)      the loss was caused by acts or lack of action of an employee, agent or branch of a payment service provider or of an entity to which its activities were outsourced.

The payer shall bear all of the losses relating to any unauthorised payment transactions if they were incurred by the payer acting fraudulently or failing to fulfil one or more of the obligations set out in Article 69 with intent or gross negligence. In such cases, the maximum amount referred to in the first subparagraph shall not apply.

Where the payer has neither acted fraudulently nor intentionally failed to fulfil its obligations under Article 69, Member States may reduce the liability referred to in this paragraph, taking into account, in particular, the nature of the personalised security credentials and the specific circumstances under which the payment instrument was lost, stolen or misappropriated.’

11      Article 102 of Directive 2015/2366, entitled ‘ADR procedures’, states in paragraph 1 thereof:

‘Member States shall ensure that adequate, independent, impartial, transparent and effective ADR procedures for the settlement of disputes between payment service users and payment service providers concerning the rights and obligations arising under Titles III and IV of this Directive are established according to … Union law … using existing competent bodies where appropriate. Member States shall ensure that ADR procedures are applicable to payment service providers.’

12      Article 107 of Directive 2015/2366, entitled ‘Full harmonisation’, provides in paragraph 1 thereof:

‘Without prejudice to Article 2, Article 8(3), Article 32, Article 38(2), Article 42(2), Article 55(6), Article 57(3), Article 58(3), Article 61(2) and (3), Article 62(5), Article 63(2) and (3), the fourth subparagraph of Article 74(1) and Article 86, in so far as this Directive contains harmonised provisions, Member States shall not maintain or introduce provisions other than those laid down in this Directive.’

 Polish law

13      Article 46 of the ustawa o usługach płatniczych (Law on payment services), of 19 August 2011 (Dz. U. No 199, item 1175), as amended (Dz. U. of 2024, item 30), which transposes Articles 73 and 74 of Directive 2015/2366 into Polish law, provides, in paragraphs 1 and 3 thereof:

‘1.      Subject to Article 44(2), in the event of an unauthorised payment transaction, the payer’s [payment service] provider shall refund to the payer the amount of the unauthorised payment transaction immediately, and in any event no later than by the end of the following business day after detecting the unauthorised transaction debited from the payer’s account, or after the date of receipt of the ad hoc declaration, except where the payer’s [payment service] provider has reasonable and duly documented grounds for suspecting fraud and communicates those grounds to the law enforcement authorities in writing. Where the payer uses a payment account, the payer’s [payment service] provider shall restore the debited payment account to the state in which it would have been had the unauthorised payment transaction not taken place. The value date on which the payer’s payment account is credited shall not be later than the date on which it was debited. …

3.      The payer shall be fully liable for the unauthorised payment transactions where he or she caused them intentionally or failed to fulfil, with intent or gross negligence, one or more of the obligations referred to in Article 42.’

 The dispute in the main proceedings and the question referred for a preliminary ruling

14      The applicant in the main proceedings entered into a current account agreement with PKO BP, a bank established in Poland.

15      She was the victim of a phishing attack committed by an unidentified perpetrator who, after showing interest in the purchase of an object advertised for sale by the victim on an online auction platform, sent her a link of such a kind as to cause her to believe that it originated from that platform and that it had the purpose of confirming the sale. After following that link, the applicant in the main proceedings accessed a website spoofing her bank’s website where she entered her online banking service login details. The data thus obtained enabled that perpetrator to transfer, from the applicant’s account to an account held by the perpetrator, the sum of 3 000 zlotys (PLN) (approximately EUR 705). That payment transaction was authorised by the perpetrator of the fraud by means of a confirmation code sent by SMS and obtained from the applicant in the main proceedings as a result of that deceit.

16      The next day, the applicant in the main proceedings realised that fraud had taken place and immediately notified the unauthorised payment transaction to PKO BP and the police. The perpetrator of the fraud was not identified.

17      PKO BP refused to refund to the applicant in the main proceedings the amount of the unauthorised payment transaction, on the ground, inter alia, that the loss she had suffered resulted from her having, as a result of gross negligence, failed to comply with her obligation to diligently safeguard the payment instrument in question and not to make it available to unauthorised persons.

18      Subsequently, the applicant in the main proceedings brought an action before the Sąd Rejonowy w Koszalinie (District Court, Koszalin, Poland), the referring court, seeking an order requiring PKO BP to pay her the sum of PLN 3 000 (approximately EUR 705).

19      In the statement of reasons for her claim, the applicant in the main proceedings states that PKO BP, as a payment service provider, was obliged to refund to her immediately the amount of the unauthorised payment transaction, unless there are reasonable grounds for suspecting the existence of fraud committed by the payer.

20      PKO BP, for its part, contends that the payer’s failure, with gross negligence, to comply with his or her obligations, also constitutes a ground exempting the payment service provider from its obligation to refund the amount of the unauthorised payment transaction. It submits, in that regard, that it may assess independently all the conditions of its liability for such a transaction and that it is exempted from that refund obligation where it establishes the existence of such negligence on the part of the payer.

21      The referring court considers that Directive 2015/2366 and the national provisions transposing it into Polish law enshrine the general principle that the payment service provider bears in full the risk associated with unauthorised payment transactions. In its view, it is for that provider, as a specialist professional, to ensure the security of the transactions against the risks of fraud and to protect the funds entrusted to it.

22      That court further notes that both that directive and the national provisions confer on the payer a right to a refund of the amount of unauthorised transactions, which entails a right to immediate recovery of the funds thus lost. That right is limited only where there are reasonable grounds for suspecting the existence of fraud committed by the payer and that fraud is reported to the competent national authorities.

23      In addition, the referring court notes that actions have not been brought before the Polish courts by banks seeking an order requiring a consumer to reimburse the amount of unauthorised payment transactions on the ground that the consumer has been grossly negligent. By contrast, many actions have been brought before the Polish courts by consumers against banking institutions on account of the refusal of those institutions to refund the amount of such transactions.

24      According to the referring court, that situation tends to demonstrate that the application by payment service providers of exceptions to the right to a refund has become the rule for unauthorised payment transactions. Those providers generally do not refund the amount of such transactions, with the result that it is the payers, and in particular consumers, who are required to assert their right to a refund before national courts.

25      In that context, the referring court considers that the interpretation of Directive 2015/2366 advocated by PKO BP would not enable attainment of the objective of protecting the payer pursued by the obligation, enshrined in the provisions of that directive, to refund the amount of the unauthorised payment transactions immediately. It therefore considers that those provisions must be interpreted as precluding the possibility for a payment service provider to refuse to refund immediately the amount of an unauthorised payment transaction on the ground that the loss suffered by the payer as a result of that transaction is attributable to the payer’s gross negligence.

26      The referring court considers that such an interpretation would have the effect of imposing on the payment service provider, as a professional, rather than on the payer, who is often a consumer, the burden of contesting its liability, in particular as regards the initiation of proceedings, the court costs, the production of evidence and the preparation of procedural documents.

27      In those circumstances, the Sąd Rejonowy w Koszalinie (District Court, Koszalin) decided to stay the proceedings and to refer the following question to the Court of Justice for a preliminary ruling:

‘Should the provisions of Article 73(1) in conjunction with Article 74(1) of Directive [2015/2366] be understood to mean that a payment service provider can refuse to refund to a payer immediately the amount of an unauthorised payment transaction if the payer has suffered a loss in connection with the unauthorised payment transaction as a result of failing, with gross negligence, to fulfil the obligations set out in Article 69 [of that directive]?’

 Consideration of the question referred

28      By its single question, the referring court asks, in essence, whether Article 73(1) and Article 74(1) of Directive 2015/2366 must be interpreted as meaning that a payment service provider can refuse to refund immediately to a payer the amount of an unauthorised payment transaction on the ground that that payer made that transaction possible through gross negligence, in breach of his or her obligations under Article 69 of that directive.

29      According to settled case-law, in interpreting a provision of EU law, it is necessary to consider its wording, the context in which it occurs and the objectives pursued by the rules of which it is part (see, to that effect, judgments of 17 November 1983, Merck, 292/82, EU:C:1983:335, paragraph 12, and of 1 August 2025, Veracash, C‑665/23, EU:C:2025:598, paragraph 34). The origins of a provision of EU law may also provide information relevant to its interpretation (judgment of 2 September 2021, CRCAM, C‑337/20, EU:C:2021:671, paragraph 31).

30      In the first place, as regards the literal interpretation, it should be noted that Articles 73 and 74 of Directive 2015/2366 govern, respectively, the liability of the payment service provider and that of the payer in the case of unauthorised payment transactions.

31      Thus, it is apparent, first, from the wording of Article 73(1) of that directive that, in principle, the payer’s payment service provider is to refund to the payer the amount of an unauthorised payment transaction immediately, and in any event no later than by the end of the following business day, after noting or being notified of the transaction.

32      That refund obligation applies ‘without prejudice to Article 71’ of Directive 2015/2366, paragraph 1 of which provides that the payment service user is to obtain rectification of an unauthorised or incorrectly executed payment transaction from the payment service provider only if the payment service user notifies the payment service provider of this without undue delay.

33      In addition, it should be emphasised that the wording of Article 73(1) of that directive provides for only one exception to the immediate refund obligation, namely the situation where the payment service provider has reasonable grounds for suspecting fraud and communicates those grounds to the relevant national authority in writing.

34      It follows that Article 73(1) of Directive 2015/2366 does not provide for any exception to the immediate refund obligation in the event of suspicion that the payer has made possible an unauthorised payment transaction through gross negligence, in breach of his or her obligations under Article 69 of that directive.

35      As regards, second, Article 74(1) of that directive, the first two subparagraphs thereof allow Members States, by way of derogation, to make the payer bear the losses relating to any unauthorised payment transaction, up to a maximum of EUR 50, resulting from the loss, theft or misappropriation of a payment instrument, unless those actions were not detectable to the payer prior to the payment. The third subparagraph of that article provides that the payer is to bear all of the losses relating to any unauthorised payment transactions if they were incurred by the payer acting fraudulently or failing to fulfil one or more of the obligations set out in Article 69 of that directive with intent or gross negligence. Those obligations include, inter alia, the obligation, referred to in Article 69(2), to take all reasonable steps to keep the payer’s personalised security credentials safe.

36      Furthermore, the fourth subparagraph of Article 74(1) of Directive 2015/2366 allows Member States to reduce the payer’s liability where the payer has neither acted fraudulently nor intentionally failed to fulfil his or her obligations under Article 69 of that directive. However, there is nothing in the order for reference or in the observations submitted to the Court to suggest that the Republic of Poland made use of that option.

37      By defining their respective rights and obligations, Articles 73 and 74 of Directive 2015/2366 thus allocate the risk between the payment service provider and the payer.

38      As regards the relationship between the obligations laid down respectively in Articles 73 and 74 of that Directive 2015/2366, it should be noted that the wording of Article 74(1) of that directive does not make it possible to determine unequivocally the scope of the derogation provided for therein. According to one interpretation, that derogation affects the immediate refund obligation, laid down in Article 73(1) of that directive, where the payer has failed, with gross negligence, to fulfil his or her obligations under Article 69 thereof. According to another interpretation, that derogation concerns only the definitive nature of the refund, with the payment service provider being obliged, initially, to proceed with that immediate refund before being able, subsequently, where appropriate, to seek reimbursement from the payer for the losses relating to unauthorised transactions by means of the legal remedies provided for that purpose.

39      As regards, in the second place, the context of Articles 73 and 74 of Directive 2015/2366, it should be pointed out, first, that recital 71 of that directive refers to the situation where the payment service provider has reasonable grounds for suspecting the existence of fraud committed by the payment service user and communicates, in writing, the objective reasons for those suspicions to the competent national authority. Recital 71 seems to support the interpretation that the only exception to the immediate refund obligation is that expressly laid down in Article 73(1) of that directive.

40      Second, it must be borne in mind that, in the context of the allocation of the burden of proof, Article 72(2) of Directive 2015/2366 places on the payment service provider the burden of proving gross negligence on the part of the payer. That allocation of the burden of proof reflects the general scheme of the system established by Articles 73 and 74 of that directive, which consists in strengthening the protection afforded to the payer in the event of unauthorised payment transactions.

41      That rule confirms that the EU legislature intended to ensure consistency between the system established in Article 73(1) of Directive 2015/2366 and the procedural rules intended to ensure its effective implementation.

42      It thus follows from the considerations set out in paragraphs 39 to 41 above that the examination of the context of Articles 73 and 74 of that directive supports the interpretation that Articles 73 and 74 govern distinct aspects of the procedure for the refund of the amount of unauthorised payment transactions in the sense that Article 73 of Directive 2015/2366 imposes on the payment service provider an obligation to refund that amount immediately, whereas Article 74 of that directive regulates the allocation of liability between that provider and the payer at a later stage, as is apparent from the mechanism described in paragraph 38 above.

43      As regards, in the third place, the objectives pursued by Directive 2015/2366, it should be borne in mind that, as is apparent from Article 1(2)(b) thereof, the purpose of that directive is, inter alia, to establish the respective rights and obligations of payment service users and payment service providers in relation to the provision of such services as a regular occupation or business activity.

44      Thus, that directive seeks, as stated in recital 6 thereof, to ensure a high level of consumer protection (see, to that effect, judgments of 11 November 2020, DenizBank, C‑287/19, EU:C:2020:897, paragraph 102, and of 11 July 2024, Eurobank Bulgaria, C‑409/22, EU:C:2024:600, paragraph 79 and the case-law cited).

45      An interpretation of Article 74(1) of Directive 2015/2366 according to which it exempts the payment service provider from its immediate refund obligation, as laid down in Article 73(1) of that directive, where the payer has failed, with gross negligence, to fulfil his or her obligations under Article 69 thereof, would have the consequence not only of depriving of its effectiveness the obligation to refund the payer immediately, but also of requiring the user to take the initiative to assert his or her right, where appropriate, before the competent courts and to bear the resultant disadvantages, including the potential costs of the proceedings. Such an allocation of liabilities and risks to the detriment of the payer is difficult to reconcile with the objective of ensuring a high level of consumer protection, as recalled in the preceding paragraph of the present judgment.

46      By contrast, an interpretation of Article 74(1) of Directive 2015/2366 according to which it does not exempt the payment service provider from its immediate refund obligation is consistent with the objective of ensuring a high level of consumer protection. That interpretation does not preclude the payment service provider from subsequently claiming from the payer, under the conditions laid down in Article 74(1) of that directive, the reimbursement of the losses relating to unauthorised payment transactions where those losses result from the payer having failed, with gross negligence, to comply with the payer’s obligations under Article 69 of that directive.

47      It follows that the objectives pursued by Directive 2015/2366 support the interpretation that the fact that the payment service provider takes the view that the payer has failed, with gross negligence, to fulfil his or her obligations under Article 69 of that directive cannot have the effect of exempting him or her from the immediate refund obligation laid down in Article 73(1) thereof.

48      In the fourth place, as regards the origins of Directive 2015/2366, it should be noted that the system established by Article 73(1) of that directive differs substantially from that which had previously been put in place by Directive 2007/64 as regards exceptions to the immediate refund obligation.

49      In fact, Article 60 of Directive 2007/64, which regulated the payment service provider’s liability for unauthorised payment transactions, did not provide for any express exception to that obligation. The same was true of the European Commission’s initial proposal, which set in motion the legislative process leading to the adoption of Directive 2015/2366 (COM(2013) 547 final). It was only during that process that the EU legislature introduced a specific exception to the immediate refund obligation where the payment service provider had reasonable grounds to suspect the existence of fraud, without allowing the Member States to maintain or introduce provisions other than those laid down in Directive 2015/2366, as follows from Article 107(1) thereof.

50      Lastly, it should be specified that, contrary to the submissions of the Czech and Italian Governments in their written observations, the interpretation set out in paragraph 47 above does not have the effect of circumventing the out-of-court dispute resolution mechanism referred to in Article 102(1) of Directive 2015/2366.

51      In that regard, as the Advocate General stated in point 51 of his Opinion, it should be emphasised that that mechanism is not limited solely to the settlement of disputes relating to the immediate refund laid down in Article 73 of that directive, but extends to any type of dispute that falls under Titles III and IV thereof. It follows that the existence of such a mechanism can neither be understood as constituting the necessary complement to the implementation of a single provision of that directive, namely Article 73 thereof, nor, accordingly, as equivalent to an obligatory mechanism for the verification of compliance with the obligations set out in Article 69 of that directive.

52      In the light of all the foregoing considerations, the answer to the question referred is that Article 73(1) and Article 74(1) of Directive 2015/2366 must be interpreted as meaning that a payment service provider cannot refuse to refund immediately to a payer the amount of an unauthorised payment transaction on the ground that that payer made that transaction possible through gross negligence, in breach of his or her obligations under Article 69 of that directive.

 Costs

53      Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (First Chamber) hereby rules:

Article 73(1) and Article 74(1) of Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC

must be interpreted as meaning that a payment service provider cannot refuse to refund immediately to a payer the amount of an unauthorised payment transaction on the ground that that payer made that transaction possible through gross negligence, in breach of his or her obligations under Article 69 of Directive 2015/2366.

[Signatures]

*      Language of the case: Polish.

i      The name of the present case is a fictitious name. It does not correspond to the real name of any party to the proceedings.