On July 6, 2018, the Federal Financial Supervisory Authority (BaFin) published Circular 08/2018 for the reporting of serious payment security incidents, which sets out the criteria for when a business or security incident is considered serious, as well as rules on the format and procedure of the notifications.