European Banking Authority Published Final Draft Technical Standards For Payment Service Providers

On February 23, 2017, the EBA published final draft RTS on the requirements of strong customer authentication and secure communication under the revised Payment Services Directive (known as PSD2). PSD2, which will apply from January 13, 2018, requires payment service providers to apply strong customer authentication measures where the payer accesses its payment account online, initiates an electronic payment transaction or carries out any action through a remote channel, which may imply a risk of payment fraud or other abuses.

The final draft RTS supplement PSD2 with requirements for: (i) strong customer authentication; (ii) exemptions from the authentication requirements depending on: the level of risk involved in the service provided, the amount, the recurrence of the transaction, or both or the payment channel used for the execution of the transaction; (iii) security measures to protect the confidentiality and the integrity of payment service users' personalized