Commission Delegated Regulation (EU) 2018/389 (SCA-RTS)

Current as of 13 March 201838 provisionsSCA-RTS

Ask about this law Official text on eur-lex.europa.eu

Provisions

48 in the library

Find a provision

["CHAPTER IV", "CONFIDENTIALITY AND INTEGRITY OF THE PAYMENT SERVICE USERS' PERSONALISED SECURITY CREDENTIALS", "Article 23"]
Creation and transmission of credentials
Creation and transmission of credentials Payment service providers shall ensure that the creation of personalised security credentials is performed in a secure…
["CHAPTER IV", "CONFIDENTIALITY AND INTEGRITY OF THE PAYMENT SERVICE USERS' PERSONALISED SECURITY CREDENTIALS", "Article 27"]
Destruction, deactivation and revocation
Destruction, deactivation and revocation Payment service providers shall ensure that they have effective processes in place to apply each of the following…
["CHAPTER IV", "CONFIDENTIALITY AND INTEGRITY OF THE PAYMENT SERVICE USERS' PERSONALISED SECURITY CREDENTIALS", "Article 24"]
Association with the payment service user
Association with the payment service user 1. Payment service providers shall ensure that only the payment service user is associated, in a secure manner, with…
["CHAPTER III", "EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION", "Article 19"]
Calculation of fraud rates
Calculation of fraud rates 1. For each type of transaction referred to in the table set out in the Annex, the payment service provider shall ensure that the…
["Section 1", "General requirements for communication", "Article 28"]
Requirements for identification
Requirements for identification 1. Payment service providers shall ensure secure identification when communicating between the payer's device and the payee's…
["CHAPTER IV", "CONFIDENTIALITY AND INTEGRITY OF THE PAYMENT SERVICE USERS' PERSONALISED SECURITY CREDENTIALS", "Article 22"]
General requirements
General requirements 1. Payment service providers shall ensure the confidentiality and integrity of the personalised security credentials of the payment…
["Section 2", "Specific requirements for the common and secure open standards of communication", "Article 30"]
General obligations for access interfaces
General obligations for access interfaces 1. Account servicing payment service providers that offer to a payer a payment account that is accessible online…
["CHAPTER IV", "CONFIDENTIALITY AND INTEGRITY OF THE PAYMENT SERVICE USERS' PERSONALISED SECURITY CREDENTIALS", "Article 25"]
Delivery of credentials, authentication devices and software
Delivery of credentials, authentication devices and software 1. Payment service providers shall ensure that the delivery of personalised security credentials…
["CHAPTER I", "GENERAL PROVISIONS", "Article 2"]
General authentication requirements
General authentication requirements 1. Payment service providers shall have transaction monitoring mechanisms in place that enable them to detect unauthorised…
["CHAPTER VI", "FINAL PROVISIONS", "Article 38"]
Entry into force
Entry into force 1. This Regulation shall enter into force on the day following that of its publication in the Official Journal of the European Union. 2. This…
["CHAPTER III", "EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION", "Article 17"]
Secure corporate payment processes and protocols
Secure corporate payment processes and protocols Payment service providers shall be allowed not to apply strong customer authentication, in respect of legal…
["CHAPTER I", "GENERAL PROVISIONS", "Article 3"]
Review of the security measures
Review of the security measures 1. The implementation of the security measures referred to in Article 1 shall be documented, periodically tested, evaluated and…
["CHAPTER III", "EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION", "Article 12"]
Unattended terminals for transport fares and parking fees
Unattended terminals for transport fares and parking fees Payment service providers shall be allowed not to apply strong customer authentication, subject to…
["CHAPTER III", "EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION", "Article 14"]
Recurring transactions
Recurring transactions 1. Payment service providers shall apply strong customer authentication when a payer creates, amends, or initiates for the first time, a…
["Section 1", "General requirements for communication", "Article 29"]
Traceability
Traceability 1. Payment service providers shall have processes in place which ensure that all payment transactions and other interactions with the payment…
["CHAPTER III", "EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION", "Article 15"]
Credit transfers between accounts held by the same natural or legal person
Credit transfers between accounts held by the same natural or legal person Payment service providers shall be allowed not to apply strong customer…
["CHAPTER II", "SECURITY MEASURES FOR THE APPLICATION OF STRONG CUSTOMER AUTHENTICATION", "Article 8"]
Requirements of devices and software linked to elements categorised as inherence
Requirements of devices and software linked to elements categorised as inherence 1. Payment service providers shall adopt measures to mitigate the risk that…
["CHAPTER II", "SECURITY MEASURES FOR THE APPLICATION OF STRONG CUSTOMER AUTHENTICATION", "Article 7"]
Requirements of the elements categorised as possession
Requirements of the elements categorised as possession 1. Payment service providers shall adopt measures to mitigate the risk that the elements of strong…
["Section 2", "Specific requirements for the common and secure open standards of communication", "Article 36"]
Data exchanges
Data exchanges 1. Account servicing payment service providers shall comply with each of the following requirements: (a) they shall provide account information…
["CHAPTER II", "SECURITY MEASURES FOR THE APPLICATION OF STRONG CUSTOMER AUTHENTICATION", "Article 6"]
Requirements of the elements categorised as knowledge
Requirements of the elements categorised as knowledge 1. Payment service providers shall adopt measures to mitigate the risk that the elements of strong…
["CHAPTER II", "SECURITY MEASURES FOR THE APPLICATION OF STRONG CUSTOMER AUTHENTICATION", "Article 9"]
Independence of the elements
Independence of the elements 1. Payment service providers shall ensure that the use of the elements of strong customer authentication referred to in Articles…
["CHAPTER VI", "FINAL PROVISIONS", "Article 37"]
Review
Review Without prejudice to Article 98(5) of Directive (EU) 2015/2366, EBA shall review by 14 March 2021 the fraud rates referred to in the Annex to this…
["Section 2", "Specific requirements for the common and secure open standards of communication", "Article 34"]
Certificates
Certificates 1. For the purpose of identification, as referred to in Article 30(1)(a), payment service providers shall rely on qualified certificates for…
["CHAPTER IV", "CONFIDENTIALITY AND INTEGRITY OF THE PAYMENT SERVICE USERS' PERSONALISED SECURITY CREDENTIALS", "Article 26"]
Renewal of personalised security credentials
Renewal of personalised security credentials Payment service providers shall ensure that the renewal or re-activation of personalised security credentials…
["CHAPTER III", "EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION", "Article 11"]
Contactless payments at point of sale
Contactless payments at point of sale Payment service providers shall be allowed not to apply strong customer authentication, subject to compliance with the…
["Section 2", "Specific requirements for the common and secure open standards of communication", "Article 35"]
Security of communication session
Security of communication session 1. Account servicing payment service providers, payment service providers issuing card-based payment instruments, account…
["CHAPTER III", "EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION", "Article 21"]
Monitoring
Monitoring 1. In order to make use of the exemptions set out in Articles 10 to 18, payment service providers shall record and monitor the following data for…
["CHAPTER I", "GENERAL PROVISIONS", "Article 1"]
Subject matter
Subject matter This Regulation establishes the requirements to be complied with by payment service providers for the purpose of implementing security measures…
["Section 2", "Specific requirements for the common and secure open standards of communication", "Article 31"]
Access interface options
Access interface options Account servicing payment service providers shall establish the interface(s) referred to in Article 30 by means of a dedicated…
["CHAPTER II", "SECURITY MEASURES FOR THE APPLICATION OF STRONG CUSTOMER AUTHENTICATION", "Article 4"]
Authentication code
Authentication code 1. Where payment service providers apply strong customer authentication in accordance with Article 97 (1) of Directive (EU) 2015/2366, the…
["CHAPTER III", "EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION", "Article 18"]
Transaction risk analysis
Transaction risk analysis 1. Payment service providers shall be allowed not to apply strong customer authentication where the payer initiates a remote…
["CHAPTER II", "SECURITY MEASURES FOR THE APPLICATION OF STRONG CUSTOMER AUTHENTICATION", "Article 5"]
Dynamic linking
Dynamic linking 1. Where payment service providers apply strong customer authentication in accordance with Article 97 (2) of Directive (EU) 2015/2366, in…
["CHAPTER III", "EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION", "Article 10"]
Payment account information
Payment account information 1. Payment service providers shall be allowed not to apply strong customer authentication, subject to compliance with the…
["CHAPTER III", "EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION", "Article 20"]
Cessation of exemptions based on transaction risk analysis
Cessation of exemptions based on transaction risk analysis 1. Payment service providers that make use of the exemption referred to in Article 18 shall…
["Section 2", "Specific requirements for the common and secure open standards of communication", "Article 33"]
Contingency measures for a dedicated interface
Contingency measures for a dedicated interface 1. Account servicing payment service providers shall include, in the design of the dedicated interface, a…
["CHAPTER III", "EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION", "Article 13"]
Trusted beneficiaries
Trusted beneficiaries 1. Payment service providers shall apply strong customer authentication where a payer creates or amends a list of trusted beneficiaries…
["CHAPTER III", "EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION", "Article 16"]
Low-value transactions
Low-value transactions Payment service providers shall be allowed not to apply strong customer authentication, where the payer initiates a remote electronic…
["Section 2", "Specific requirements for the common and secure open standards of communication", "Article 32"]
Obligations for a dedicated interface
Obligations for a dedicated interface 1. Subject to compliance with Article 30 and 31, account servicing payment service providers that have put in place a…
["CHAPTER III", "EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION", "Article 18"]
Transaction risk analysis
Transaction risk analysis 3. Payment service providers that intend to exempt electronic remote payment transactions from strong customer authentication on the…
["Section 2", "Specific requirements for the common and secure open standards of communication", "Article 36"]
Data exchanges
Data exchanges 3. Account information service providers shall have in place suitable and effective mechanisms that prevent access to information other than…
["CHAPTER II", "SECURITY MEASURES FOR THE APPLICATION OF STRONG CUSTOMER AUTHENTICATION", "Article 4"]
Authentication code
Authentication code (1) of Directive (EU) 2015/2366 shall be temporarily or permanently blocked, shall not exceed five within a given period of time; (c) the…
["CHAPTER II", "SECURITY MEASURES FOR THE APPLICATION OF STRONG CUSTOMER AUTHENTICATION", "Article 5"]
Dynamic linking
Dynamic linking (1) of that Directive, the authentication code shall be specific to the amount that the payer has given consent to be blocked and agreed to by…
["Section 2", "Specific requirements for the common and secure open standards of communication", "Article 33"]
Contingency measures for a dedicated interface
Contingency measures for a dedicated interface (1) can be identified and can rely on the authentication procedures provided by the account servicing payment…
["Section 2", "Specific requirements for the common and secure open standards of communication", "Article 35"]
Security of communication session
Security of communication session 5. Account servicing payment service providers, account information service providers, payment initiation service providers…
["Section 2", "Specific requirements for the common and secure open standards of communication", "Article 32"]
Obligations for a dedicated interface
Obligations for a dedicated interface (1) of the credentials issued by account servicing payment service providers to their customers, imposing redirection to…
["Section 2", "Specific requirements for the common and secure open standards of communication", "Article 30"]
General obligations for access interfaces
General obligations for access interfaces 2. For the purposes of authentication of the payment service user, the interface referred to in paragraph 1 shall…
["Section 2", "Specific requirements for the common and secure open standards of communication", "Article 33"]
Contingency measures for a dedicated interface
Contingency measures for a dedicated interface (5) to the satisfaction of the payment service providers referred to therein; (c) it has been widely used for at…
["Section 2", "Specific requirements for the common and secure open standards of communication", "Article 30"]
General obligations for access interfaces
General obligations for access interfaces (2) or before the target date for the market launch of the access interface when the launch takes place after the…

Headings and opening words only; the full text is on eur-lex.europa.eu, which is authoritative. The library holds the version current as of the date shown. AI output is not legal advice — consult a licensed lawyer in the relevant jurisdiction.

Ask your first question. See the price before you do.

Start free See pricing

Free start credits · No card · No subscription · AI output is not legal advice — consult a licensed lawyer in the relevant jurisdiction.