EU regulatory technical standards under PSD2 that set requirements for strong customer authentication, permitted exemptions and secure communication between payment service providers. They define how banks and third-party providers protect access to accounts and electronic payments.
TL;DR:
- Regulation 2018/389 sets PSD2 requirements for strong customer authentication and secure communication.
- Remote-payment authentication links approval to the intended amount and payee.
- Defined exemptions and interface obligations must be assessed under the amended legal instrument.
Summary
Purpose and Scope
EU regulatory technical standards under PSD2 that set requirements for strong customer authentication, permitted exemptions and secure communication between payment service providers. They define how banks and third-party providers protect access to accounts and electronic payments.
Authentication Requirements
The RTS address independent knowledge, possession and inherence elements and protection of personalised security credentials. For electronic remote payments, dynamic linking makes authentication specific to the payer’s agreed amount and payee. A change in those details invalidates the corresponding authentication code.
Exemptions and Interfaces
Defined exemptions address particular transaction and risk situations rather than creating a general waiver of authentication. The instrument also covers common and secure communication for payment-service access. It specifies regulatory requirements without prescribing one exclusive authentication technology or commercial API product.
Legal Status
EUR-Lex identifies the act as in force with amendments and a consolidated text dated 12 September 2023. The original Official Journal publication should be read with those changes.
Keywords
- PSD2
- SCA
- Dynamic Linking
- Authentication Factors
- Secure Communication
- Account Access
- Risk Exemptions
- Credential Protection
- EU Regulation
- Payment Security