Abstract;Judgment — ECLI:EU:C:2025:598
Date: 2025-08-01
Language of the case: French
Court formation: Fourth Chamber
Procedure: Reference for a preliminary ruling
Origin: France

Summary of the applicable legislation 
3 The texts applicable are those in force at the time of the withdrawals at issue, from 
30 March to 17 May 2017. 
Directive 2007/64/EC of 13 November 2007 
4 Directive 2007/64/EC of 13 November 2007 on payment services in the internal 
market amending Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC 
and repealing Directive 97/5/EC, contains an Article 56, entitled ‘Obligations of 
the payment service user in relation to payment instruments’, which provides: 
‘1. The payment service user entitled to use a payment instrument shall have the 
following obligations: 
(a) to use the payment instrument in accordance with the terms governing the 
issue and use of the payment instrument; and 
(b) to notify the payment service provider, or the entity specified by the latter, 
without undue delay on becoming aware of loss, theft or misappropriation of 
the payment instrument or of its unauthorised use. 
2. For the purposes of paragraph 1(a), the payment service user shall, in 
particular, as soon as he receives a payment instrument, take all reasonable steps 
to keep its personalised security features safe.’ 
5 According to Article 58 of that directive, entitled ‘Notification of unauthorised or 
incorrectly executed payment transactions’: 
‘The payment service user shall obtain rectification from the payment service 
provider only if he notifies his payment service provider without undue delay on 
becoming aware of any unauthorised or incorrectly executed payment transactions 
VERACASH 
 
3 
Anonymised version 
giving rise to a claim, including that under Article 75, and no later than 13 months 
after the debit date, unless, where applicable, the payment service provider has 
failed to provide or make available the information on that payment transaction in 
accordance with Title III’. 
6 Article 60 of the directive, entitled ‘Payment service provider's liability for 
unauthorised payment transactions’, provides: 
‘1. Member States shall ensure that, without prejudice to Article 58, in the case 
of an unauthorised payment transaction, the payer's payment service provider 
refunds to the payer immediately the amount of the unauthorised payment 
transaction and, where applicable, restores the debited payment account to the 
state in which it would have been had the unauthorised payment transaction not 
taken place. 
2. Further financial compensation may be determined in accordance with the 
law applicable to the contract concluded between the payer and his payment 
service provider.’ 
7 According to Article 61 of that directive, entitled ‘Payer's liability for 
unauthorised payment transactions’: 
‘1. By way of derogation from Article 60 the payer shall bear the losses relating 
to any unauthorised payment transactions, up to a maximum of EUR 150, 
resulting from the use of a lost or stolen payment instrument or, if the payer has 
failed to keep the personalised security features safe, from the misappropriation of 
a payment instrument. 
2. The payer shall bear all the losses relating to any unauthorised payment 
transactions if he incurred them by acting fraudulently or by failing to fulfil one or 
more of his obligations under Article 56 with intent or gross negligence. In such 
cases, the maximum amount referred to in paragraph 1 of this Article shall not 
apply. 
3. In cases where the payer has neither acted fraudulently nor with intent failed 
to fulfil his obligations under Article 56, Member States may reduce the liability 
referred to in paragraphs 1 and 2 of this Article, taking into account, in particular, 
the nature of the personalised security features of the payment instrument and the 
circumstances under which it was lost, stolen or misappropriated. 
4. The payer shall not bear any financial consequences resulting from use of 
the lost, stolen or misappropriated payment instrument after notification in 
accordance with Article 56(1)(b), except where he has acted fraudulently. 
5. If the payment service provider does not provide appropriate means for the 
notification at all times of a lost, stolen or misappropriated payment instrument, as 
required under Article 57(1)(c), the payer shall not be liable for the financial 
REQUEST FOR A PRELIMINARY RULING OF 8. 11. 2023 – CASE C-665/23 
 
4  
Anonymised version 
consequences resulting from use of that payment instrument, except where he has 
acted fraudulently.’ 
National law 
8 Directive 2007/64/EC was transposed into national law by the ordonnance 
No 2009-866 du 15 juillet 2009 relative aux conditions régissant la fourniture de 
services de paiement et portant création des établissements de paiement (Order 
No 2009-866 of 15 July 2009 on the conditions governing the supply of payment 
services and creating payment institutions), which introduced, in particular, 
Articles L. 133-17, L. 133-18, L. 133-19 and L. 133-24 of the Monetary and 
Financial Code adopting the provisions of Articles 56, 58, 60 and 61 of the 
directive. 
9 Under Article L. L. 133-17, I, of the Monetary and Financial Code, in the version 
resulting from that order, ‘upon becoming aware of the loss, theft, 
misappropriation or unauthorised use of his payment instrument or of the data 
associated with it, the payment service user shall, without undue delay and for the 
purposes of blocking the instrument, inform his payment service provider, or the 
entity specified by his provider.’ 
10 According to Article L. 133-18 of that code: 
‘In the case of an unauthorised payment transaction reported by the user under the 
conditions prescribed in Article L. 133-24, the payment service provider shall 
refund to the payment service user forthwith the amount of the unauthorised 
payment transaction and, where applicable, shall restore the payment account that 
had been debited with that amount to the situation that would have existed if the 
unauthorised payment transaction had not taken place. 
The payer and his payment service provider may decide on additional 
compensation on a contractual basis.’ 
11 Under Article L. 133-19 of the same code: 
‘I. In the case of an unauthorised payment transaction following the loss or theft 
of a payment instrument, the payer shall, prior to the notification stipulated in 
Article L. 133-17, bear the losses associated with the use of the lost or stolen 
instrument subject to a ceiling of 150 euros. 
The payer shall not be held liable, however, in the case of an unauthorised 
payment transaction carried out without the use of the personalised security 
features. 
II. The payer shall not be held liable where the unauthorised payment transaction 
was carried out by misappropriation, without the payer's knowledge, of the 
payment instrument or of the data associated with it. 
VERACASH 
 
5 
Anonymised version 
Likewise, he does not incur liability in the event of misuse of the payment 
instrument if he was in physical possession of his instrument when the 
unauthorised payment transaction took place. 
III. Except where he has acted fraudulently, the payer shall not bear any financial 
consequences if the payment service provider does not provide appropriate means 
of notification so that the payment instrument may be blocked, as stipulated in 
Article L. 133-17. 
IV. The payer shall bear all the losses relating to any unauthorised payment 
transactions if he incurred them by acting fraudulently or by failing to fulfil, with 
intent or gross negligence, one or more of the obligations imposed by Articles L. 
133-16 and L. 133-17.’ 
12 Finally, under Article L. 133-24 of the code: 
‘The payment service user shall notify his payment service provider without 
undue delay of any unauthorised or incorrectly executed payment transactions and 
no later than 13 months after the debit date, failing which he or she will be time-
barred, unless the payment service provider has failed to provide or make 
available the information on that payment transaction in accordance with Book III, 
Title I, Chapter IV. 
Except where the user is a natural person acting otherwise than for business or 
professional purposes, the parties may decide to derogate from this article.’ 
Examination of the grounds of appeal 
The second ground of appeal, in the first part 
Wording of the ground of appeal 
13 IL criticises the judgment for holding that it was unnecessary to order Veracash to 
return to him the gold deposit of 794.513 grams or, failing that, to pay to him the 
value in euros, and for rejecting all his other requests, whereas ‘the payment 
service user shall notify his payment service provider without undue delay of any 
unauthorised or incorrectly executed payment transactions and no later than 
13 months after the debit date, failing which he or she will be time-barred, unless 
the payment service provider has failed to provide or make available the 
information on that payment transaction […]; that, in this case, the appeal court 
held that IL could not rely on the provisions of Article L. 133-18 of the Monetary 
and Financial Code in so far as the payment service user must notify the provider 
of an unauthorised transaction ‘immediately’ and ‘without undue delay’, and that 
IL failed to demonstrate that he had fulfilled that obligation since he had sent to 
Veracash a dispute form on 23 May 2017, almost two months after the first 
disputed withdrawal, when the bank card user has 13 months after the debit date 
REQUEST FOR A PRELIMINARY RULING OF 8. 11. 2023 – CASE C-665/23 
 
6  
Anonymised version 
to make that notification; and complains that, by ruling as it did, the appeal court 
infringed Article L. 133-24 of the Monetary and Financial Code, as worded before 
Order No 2017-1252 of 9 August 2017.’ 
The Court’s reply 
Admissibility of the ground of appeal 
14 […] 
15 […] 
16 The ground of appeal is […] admissible. 
Merits of the ground of appeal 
17 The outcome of the dispute depends on whether the payment service provider can 
refuse to reimburse the amount of an unauthorised transaction where the payer, 
although he notified that transaction within 13 months after the debit date, delayed 
in doing so, without that delay having been intentional or the result of gross 
negligence on his part. 
18 [IL], the appellant, claims, primarily, that the payment service user has 13 months 
after the debit date to make the notification. 
19 Veracash, the respondent, contends that, although, in Article L. 133-24 of the 
Monetary and Financial Code, the legislature required the user to notify an 
unauthorised transaction without undue delay whilst setting a 13-month time limit, 
it intended to establish a double time limit and that the 13-month time limit is a 
final deadline. It adds that, in view of what is at stake, the scheme of that 
provision requires that, as soon as the service user sees something abnormal, he 
should react immediately by notifying his service provider of the abnormality. 
20 The provisions of the Monetary and Financial Code applicable to the dispute must 
be interpreted in accordance with the articles of Directive 2007/64/EC which they 
transpose. 
21 The Court of Cassation finds that a literal reading of Article 58 of Directive 
2007/64/EC may, as the appeal court held, lead to the conclusion that the payment 
service provider is entitled to refuse to reimburse the amount of an unauthorised 
payment transaction on the sole ground of the payment service user’s late 
notification, even though the notification was made within the 13-month time 
limit. It notes that such an interpretation finds support in recital 31 of that 
directive, which states, first, that ‘the payment service user shall obtain 
rectification from the payment service provider only if he notifies his payment 
service provider without undue delay on becoming aware of any unauthorised or 
incorrectly executed payment transactions giving rise to a claim’ and, second, that 
‘in order to reduce the risks and consequences of unauthorised or incorrectly 
VERACASH 
 
7 
Anonymised version 
executed payment transactions, the payment service user should inform the 
payment service provider as soon as possible about any contestations concerning 
allegedly unauthorised or incorrectly executed payment transactions […]. If the 
notification deadline is met by the payment service user, he should be able to 
pursue those claims within the prescription periods pursuant to national law.’ 
22 However, such an interpretation seems difficult to reconcile with Article 61(2) of 
Directive 2007/64/EC, which provides that the payer will bear all the losses 
relating to any unauthorised payment transactions, in other words, he will be 
deprived of his right to reimbursement, only if, in particular, he failed to fulfil one 
or more of his obligations under Article 56 of that directive with intent or gross 
negligence, which include that of informing his payment service provider without 
undue delay of the loss, theft or misappropriation or any unauthorised use of his 
payment instrument. In any event, the payer’s payment service provider is not 
required to reimburse the payer for the amount of an unauthorised transaction 
which the payer has been late in notifying to it, regardless of whether the delay 
was intentional or the result of gross negligence. 
23 When interpreting Article 58 of Directive 2007/64/EC in its judgment of 
2 September 2021, CRCAM (C-337/20, paragraph 36), the Court of Justice of the 
European Union held that ‘a service user who has not notified his or her service 
provider, within 13 months of the debit, of an unauthorised transaction, cannot 
invoke liability on the part of the service provider, including under the general 
law, and therefore cannot obtain a refund in respect of the unauthorised 
transaction’, but did not rule on the consequences of the payer’s non-compliance 
with the obligation to inform his payment service provider without undue delay 
that he has become aware of an unauthorised transaction. 
24 Even though the Court of Cassation recognises the interest in encouraging the 
payer to be diligent in informing his payment service provider, it considers, in the 
light of Article 61(2) of Directive 2007/64/EC, that the EU legislature did not 
intend to penalise any delay, whatever the circumstances, by totally depriving the 
payer of the right to reimbursement. It is inclined to interpret that directive as 
meaning that, apart from the case of the payer acting fraudulently and that of 
notification after the expiry of the 13-month time limit, the fact that the payer 
delays in notifying his payment service provider of the loss, theft, 
misappropriation or any unauthorised use of his payment instrument has no effect 
on his right to reimbursement of the losses caused by unauthorised transactions 
which notification without undue delay could have prevented, and that the payer 
should not be deprived of the right to reimbursement of the losses caused by an 
unauthorised transaction which notification without undue delay could have 
prevented, unless the lateness of the notification is intentional or the result of 
gross negligence on his part. 
25 However, since the exact interpretation of Articles 56, 58, 60 and 61 of Directive 
2007/64 EC is not immediately obvious, the proceedings must be stayed and the 
REQUEST FOR A PRELIMINARY RULING OF 8. 11. 2023 – CASE C-665/23 
 
8  
Anonymised version 
following questions contained in the operative part of this judgment must be 
referred to the Court of Justice for a preliminary ruling. 
ON THOSE GROUNDS, the Court: 
Having regard to Article 267 of the Treaty on the Functioning of the European 
Union; 
REFERS the following questions to the Court of Justice of the European Union 
for a preliminary ruling: 
‘1. Must Articles 56, 58, 60 and 61 of Directive 2007/64 EC of 13 November 
2007 on payment services in the internal market amending Directives 97/7/EC, 
2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC, be 
interpreted as meaning that the payer is deprived of the right to reimbursement of 
the amount of an unauthorised transaction if he delayed in notifying his payment 
service provider of the unauthorised payment transaction, even though he did so 
within 13 months from the debit date? 
2. In the event that the answer to Question 1 is in the affirmative, is the 
deprivation of the payer’s right to reimbursement conditional on the fact that the 
lateness of the notification is intentional or the result of gross negligence on the 
part of the payer? 
3. In the event that the answer to Question 1 is in the affirmative, is the payer 
deprived of the right to reimbursement of all the unauthorised transactions or only 
those which could have been prevented if the notification had not been late?’ 
[…]