The EU Strong Customer Authentication RTS translate PSD2 security duties into technical requirements. Two-factor authentication, dynamic linking and secure communication apply alongside defined exemptions and transaction-risk analysis, with fraud and exemption performance monitored.
TL;DR:
- Strong authentication uses independent knowledge, possession and inherence elements.
- Covered remote payments require linking authentication to the amount and payee.
- Defined exemptions and secure third-party interfaces operate within the wider PSD2 framework.
Summary
Independent factors and dynamic linking
Delegated Regulation (EU) 2018/389 translates PSD2's security requirements into technical rules. Strong customer authentication combines independent elements from knowledge, possession and inherence. Independence matters because compromise of one should not undermine the others. For covered remote electronic payments, dynamic linking connects authentication to the transaction's amount and payee. A changed amount or destination therefore has implications for the authentication result, beyond simply confirming that the user logged in.
Exemptions have defined conditions
The RTS include exemptions for specified circumstances, such as low-value transactions, trusted beneficiaries, recurring transactions, secure corporate processes and transaction-risk analysis. Each has conditions; they are not a general choice to dispense with fraud prevention. Risk-based treatment connects eligibility with the provider's controls and relevant performance. When an exemption cannot be supported, the applicable authentication requirement remains. The customer-facing absence of a challenge is therefore different from an absence of a security decision.
Secure communication and account-access services
The communication rules support interaction between account-servicing providers and eligible third-party services. They address identification, access arrangements, availability and security of the interfaces through which relevant data or instructions are exchanged. These are important to account information and payment initiation, but the two services have different functions. A secure interface and customer consent work together; one does not replace the other or turn access to information into unrestricted authority over an account.
Implementation spans more than a challenge screen
The RTS affect credential protection, device and factor design, transaction-risk engines, exemption handling and interface performance. Providers need to understand which payment or access event triggers a requirement and what evidence supports their treatment. A transaction can be securely authenticated yet still raise a separate consent, execution or liability issue under PSD2. The Regulation should be read in its amended form so later changes to access and authentication arrangements are reflected in the service design.
Keywords
- SCA RTS
- dynamic linking
- independent factors
- knowledge
- possession
- inherence
- risk exemptions
- secure interfaces
- third-party access
- credential protection