Lawbster is desktop-first for professionals — but we won't let you down for a quick read.

PSD2 Regulatory Technical Standards (RTS)

Table of Contents

Chapter I — GENERAL PROVISIONS

Art. 1 — Subject matter Art. 2 — General authentication requirements Art. 3 — Review of the security measures

Chapter II — SECURITY MEASURES FOR THE APPLICATION OF STRONG CUSTOMER AUTHENTICATION

Art. 4 — Authentication code Art. 5 — Dynamic linking Art. 6 — Requirements of the elements categorised as knowledge Art. 7 — Requirements of the elements categorised as possession Art. 8 — Requirements of devices and software linked to elements categorised as inherence Art. 9 — Independence of the elements

Chapter III — EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION

Art. 10 — Access to the payment account information directly with the account servicing payment service provider Art. 10a — Access to the payment account information through an account information service provider Art. 11 — Contactless payments at point of sale Art. 12 — Unattended terminals for transport fares and parking fees Art. 13 — Trusted beneficiaries Art. 14 — Recurring transactions Art. 15 — Credit transfers between accounts held by the same natural or legal person Art. 16 — Low-value transactions Art. 17 — Secure corporate payment processes and protocols Art. 18 — Transaction risk analysis Art. 19 — Calculation of fraud rates Art. 20 — Cessation of exemptions based on transaction risk analysis Art. 21 — Monitoring

Chapter IV — CONFIDENTIALITY AND INTEGRITY OF THE PAYMENT SERVICE USERS' PERSONALISED SECURITY CREDENTIALS

Art. 22 — General requirements Art. 23 — Creation and transmission of credentials Art. 24 — Association with the payment service user Art. 25 — Delivery of credentials, authentication devices and software Art. 26 — Renewal of personalised security credentials Art. 27 — Destruction, deactivation and revocation

Chapter V — COMMON AND SECURE OPEN STANDARDS OF COMMUNICATION

Art. 28 — Requirements for identification Art. 29 — Traceability Art. 30 — General obligations for access interfaces Art. 31 — Access interface options Art. 32 — Obligations for a dedicated interface Art. 33 — Contingency measures for a dedicated interface Art. 34 — Certificates Art. 35 — Security of communication session Art. 36 — Data exchanges

Chapter VI — FINAL PROVISIONS

Art. 37 — Review Art. 38 — Entry into force

Recitals

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30

Annexes

Annex I — ANNEX

Lawbster — EU Regulation Library Lawbster is a multilingual library of EU regulations for legal professionals, free to browse without an account — available in English, German, and French, with full regulation texts presented article by article.

Digital Markets Act (DMA)

Cybersecurity Act

Digital Services Act (DSA)

Data Governance Act (DGA)

Product Liability Directive (PLD)

Critical Entities Resilience Directive (CER)

Cyber Resilience Act (CRA)

DMA Implementing Regulation

Imprint · Privacy