The RTS turn PSD2's security principles into detailed requirements for authentication and communication. Strong customer authentication combines independent elements drawn from knowledge, possession and inherence. For covered remote electronic payments, dynamic linking connects authentication to the amount and payee, so changing those transaction details affects the authentication result.

The regulation includes conditional exemptions, including specified low-value payments, trusted beneficiaries, recurring transactions, secure corporate processes and transaction-risk analysis. An exemption is a controlled exception whose eligibility must be demonstrated; it is not a general waiver of fraud prevention or PSD2 liability rules. Independence of authentication factors and protection of credentials matter as much as the visible challenge presented to the customer.

The communication requirements support secure interaction between account-servicing providers and authorised third parties. They address identification, interfaces, availability and access without unnecessary obstacles. Implementing the RTS therefore involves customer journeys, risk engines, credentials, interface performance and evidence of the decision to apply authentication or an exemption.