# Commission Delegated Regulation (EU) 2018/389 (SCA-RTS) URL: https://consilena.com/coverage/laws/ksrc_9ds54xxvhda4k8sp - Jurisdiction: European Union - Type: Regulation - Short name: SCA-RTS - Identifier: 32018R0389 - Current as of: 13 March 2018 - Provisions: 38 - Official text: https://eur-lex.europa.eu/eli/reg > The library is a research copy. Check the official source before relying on a provision: the text published there, not the copy in Consilena, is the law. ## Provisions - **Creation and transmission of credentials**: Payment service providers shall ensure that the creation of personalised security credentials is performed in a secure… - **Destruction, deactivation and revocation**: Payment service providers shall ensure that they have effective processes in place to apply each of the following… - **Association with the payment service user**: 1. Payment service providers shall ensure that only the payment service user is associated, in a secure manner, with… - **Calculation of fraud rates**: 1. For each type of transaction referred to in the table set out in the Annex, the payment service provider shall ensure that the… - **Requirements for identification**: 1. Payment service providers shall ensure secure identification when communicating between the payer's device and the payee's… - **General requirements**: 1. Payment service providers shall ensure the confidentiality and integrity of the personalised security credentials of the payment… - **General obligations for access interfaces**: 1. Account servicing payment service providers that offer to a payer a payment account that is accessible online… - **Delivery of credentials, authentication devices and software**: 1. Payment service providers shall ensure that the delivery of personalised security credentials… - **General authentication requirements**: 1. Payment service providers shall have transaction monitoring mechanisms in place that enable them to detect unauthorised… - **Entry into force**: 1. This Regulation shall enter into force on the day following that of its publication in the Official Journal of the European Union. 2. This… - **Secure corporate payment processes and protocols**: Payment service providers shall be allowed not to apply strong customer authentication, in respect of legal… - **Review of the security measures**: 1. The implementation of the security measures referred to in Article 1 shall be documented, periodically tested, evaluated and… - **Unattended terminals for transport fares and parking fees**: Payment service providers shall be allowed not to apply strong customer authentication, subject to… - **Recurring transactions**: 1. Payment service providers shall apply strong customer authentication when a payer creates, amends, or initiates for the first time, a… - **Traceability**: 1. Payment service providers shall have processes in place which ensure that all payment transactions and other interactions with the payment… - **Credit transfers between accounts held by the same natural or legal person**: Payment service providers shall be allowed not to apply strong customer… - **Requirements of devices and software linked to elements categorised as inherence**: 1. Payment service providers shall adopt measures to mitigate the risk that… - **Requirements of the elements categorised as possession**: 1. Payment service providers shall adopt measures to mitigate the risk that the elements of strong… - **Data exchanges**: 1. Account servicing payment service providers shall comply with each of the following requirements: (a) they shall provide account information… - **Requirements of the elements categorised as knowledge**: 1. Payment service providers shall adopt measures to mitigate the risk that the elements of strong… - **Independence of the elements**: 1. Payment service providers shall ensure that the use of the elements of strong customer authentication referred to in Articles… - **Review**: Without prejudice to Article 98(5) of Directive (EU) 2015/2366, EBA shall review by 14 March 2021 the fraud rates referred to in the Annex to this… - **Certificates**: 1. For the purpose of identification, as referred to in Article 30(1)(a), payment service providers shall rely on qualified certificates for… - **Renewal of personalised security credentials**: Payment service providers shall ensure that the renewal or re-activation of personalised security credentials… - **Contactless payments at point of sale**: Payment service providers shall be allowed not to apply strong customer authentication, subject to compliance with the… - **Security of communication session**: 1. Account servicing payment service providers, payment service providers issuing card-based payment instruments, account… - **Monitoring**: 1. In order to make use of the exemptions set out in Articles 10 to 18, payment service providers shall record and monitor the following data for… - **Subject matter**: This Regulation establishes the requirements to be complied with by payment service providers for the purpose of implementing security measures… - **Access interface options**: Account servicing payment service providers shall establish the interface(s) referred to in Article 30 by means of a dedicated… - **Authentication code**: 1. Where payment service providers apply strong customer authentication in accordance with Article 97 (1) of Directive (EU) 2015/2366, the… - **Transaction risk analysis**: 1. Payment service providers shall be allowed not to apply strong customer authentication where the payer initiates a remote… - **Dynamic linking**: 1. Where payment service providers apply strong customer authentication in accordance with Article 97 (2) of Directive (EU) 2015/2366, in… - **Payment account information**: 1. Payment service providers shall be allowed not to apply strong customer authentication, subject to compliance with the… - **Cessation of exemptions based on transaction risk analysis**: 1. Payment service providers that make use of the exemption referred to in Article 18 shall… - **Contingency measures for a dedicated interface**: 1. Account servicing payment service providers shall include, in the design of the dedicated interface, a… - **Trusted beneficiaries**: 1. Payment service providers shall apply strong customer authentication where a payer creates or amends a list of trusted beneficiaries… - **Low-value transactions**: Payment service providers shall be allowed not to apply strong customer authentication, where the payer initiates a remote electronic… - **Obligations for a dedicated interface**: 1. Subject to compliance with Article 30 and 31, account servicing payment service providers that have put in place a… - **Transaction risk analysis**: 3. Payment service providers that intend to exempt electronic remote payment transactions from strong customer authentication on the… - **Data exchanges**: 3. Account information service providers shall have in place suitable and effective mechanisms that prevent access to information other than… - **Authentication code**: (1) of Directive (EU) 2015/2366 shall be temporarily or permanently blocked, shall not exceed five within a given period of time; (c) the… - **Dynamic linking**: (1) of that Directive, the authentication code shall be specific to the amount that the payer has given consent to be blocked and agreed to by… - **Contingency measures for a dedicated interface**: (1) can be identified and can rely on the authentication procedures provided by the account servicing payment… - **Security of communication session**: 5. Account servicing payment service providers, account information service providers, payment initiation service providers… - **Obligations for a dedicated interface**: (1) of the credentials issued by account servicing payment service providers to their customers, imposing redirection to… - **General obligations for access interfaces**: 2. For the purposes of authentication of the payment service user, the interface referred to in paragraph 1 shall… - **Contingency measures for a dedicated interface**: (5) to the satisfaction of the payment service providers referred to therein; (c) it has been widely used for at… - **General obligations for access interfaces**: (2) or before the target date for the market launch of the access interface when the launch takes place after the… --- Consilena is a software provider, not a law firm. AI output is not legal advice: consult a licensed lawyer in the relevant jurisdiction. Page: https://consilena.com/coverage/laws/ksrc_9ds54xxvhda4k8sp. Index of every page: https://consilena.com/llms.txt.