PSD2 RTS On Authentication And Communication – EU Commission Proposes Amendments

The EBA has now published the EU Commission's proposed amendments to its draft RTS on Strong Customer Authentication (SCA) and common and secure communication under the revised Payment Services Directive (PSD2), as well as the Commission's accompanying letter setting out the main changes introduced. Both documents were submitted to the EBA on Wednesday 24 May, but were not made public until Friday 1 June.

As per the Commission's letter, the main amendments are:

1. Independent auditing of the security measures in cases where the transaction risk analysis exemption is applied. (Ref. Chapter 1, Article 3(2) of the EBA draft and of the Commission's amended RTS).
   
   Payment Service Providers (PSPs) making use of the SCA "Transaction risk analysis" exemption (as per Article 18) shall have a statutory audit performed for the methodology, the model and the reported fraud rates at a minimum on a yearly basis. The Commission has introduced this to ensure that the risk