PSD2 Guidelines en Q&As

Provision of the "acquiring of payment transactions" payment service in the EU

Paper-based postal money orders as defined by the Universal Postal Union

Money remittance

Acquisition and money remittance payment service

Access to account for FinTech Solutions that incorporate regulated services

On the access to safeguarding accounts through the Application Programming Interface (API)

Reading of the term "means of payment"

Interpretation of payment instrument

Clarification on whether a particular business model type constitutes the provision of an account information service as defined by Article 4(16) PSD2

Type of accounts accessible through common and secure communication

Collection of fees for utilities or other regular services

Does SCA apply to electronically processed SEPA Direct Debits?

Compliance of (1) card data (2) SMS OTP and (3) EMV 3DS behaviour-based inherence as an authentication information with the requirements of PSD2 and RTS on SCA

Strong customer authentication (SCA) knowledge element: Place of Birth and Date of Birth

Knowledge element of SCA

On the access to names and surnames through the API

Information to be provided / made available by ASPSP to payment initiation service provider (PISP)

Final report on the EBA Guidelines under PSD2 on the information to be provided for the authorisation of PIs and EMIs and for the registration of AISPs

Final report Guidelines on remuneration policies

Peer review follow-up report on authorisation under PSD2

Final report on EBA Guidelines on outsourcing arrangements

Final Guidelines on Professional Indemnity Insurance under PSD2

Consideration of own funds requirements as a comparable guarantee to the PII

Minimum monetary amount of professional indemnity insurance in ongoing supervision

Clarification on the protection requirements of a CustomerID when included in a payer-presented QR-code for the initiation of (instant) credit transfers at the Point of Interaction (POI)

Multi-licensed entity capital requirement

Calculation of "payment volume" for method B in Article 9 of PSD2

Calculation of own funds required for payment institution in Article 9 PSD2 when the payment institution offers acquiring services

Calculation of own funds required for payment institution in Article 9 PSD2 when "input funds" are credit transfers and "output funds" are direct debit

Safeguarding

Clarification of meanings 'transferring of funds' and 'another payment service provider' in the context of article 10(1)(a) PSD2

Safeguarding with a credit institution in a third country

Compliance of non-bank PSPs with the safeguarding requirements in PSD2

"Triangular" passport

Annex VI - Agents/distributors

Information on the host Member State in which Third Party Providers (TPPs) provide services

Credit

Passporting and eIDAS certificates

Showing a password after it has been masked

Exchange rate mark-ups part of 'all charges payable'/'currency conversion charges'

Ability of a creditor to change a mandate

Information provided to the payee on individual payment transaction

Explicit consent required by the ASPSP from the PSU to enable the PSU to use the services provided by TPPs

Sanctions list screening in the context of TPP's services - risk management policy

Consent for the provision of PIS and AIS

"Authorisation number" in eIDAS certificates

Account Data required by a ASPSP to execute a payment order via a PISP

Proxy matrices

Authentication process of the PSU with the ASPSP in a combined AIS and PIS journey in a redirection approach

Future-dated payments and recurring transactions

Individual's name to return in AISP/PISP calls

PISP's access to payable charges applied by the ASPSP on the PSU's initiated payment via the ASPSP's dedicated interface

Obstacles faced by PISPs in accessing payment status information under PSD2

Interpretation of 'Active request for account information'

Period to be covered by statistics pursuant to Article 32(4) of Commission Delegated Regulation (EU) 2018/389

Setting limit (daily and/or per transaction) for the execution of payment transaction by PSP

Application of SCA to issuing a payment instrument and tokenisation

Evidences / records to be stored by ASPSP for PIS and AIS requests

Liability for fraud when SCA exemption used

Unattended terminals and Transaction Risk Analysis (TRA) exemption and related PSP's liabilities rules

Articulation and interaction of the second and the third sub-paragraph of Article 74(1) PSD2

PISP payment order cancellation due to fraud prevention reasons

Credit value date for payment transactions with currency conversion

Final report on Revised Guidelines on major incident reporting under PSD2

Arbitrating between security and obstacles

Major incidents reporting

Service Downtime

Losses due to fraud per liability bearer

Fraud reporting

Application of SCA for confirmation of funds requests made by a PISP

SCA applicability / application of SCA at tokenisation stage

App to app redirection with biometrics for PIS

Trusted beneficiaries

Payee-initiated transactions with irregular period or variable amounts for account payments

Criteria for selecting the operations to be included in the calculation of fraud rates for the transaction risk analysis (TRA) exemption

SCA exception for Contactless only terminals (SoftPOS) in case of emergency

Bill-payment via postal service

Transactions initiated via electronic mail (email)

SCA for token replacement

Application for low-value contactless exemption - Calculation of limits at Primary Account Number (PAN) / account level or at device / token level

Criteria for the application of the transaction risk analysis (TRA) exemption - Application of the TRA exemption by authorized PSPs other than the issuer and the acquirer

Criteria for the application of the TRA exemption - Relevant fraud rates

Criteria for the application of the TRA exemption - Application of the TRA exemption at the level of individual brand, product or scheme

Criteria for the application of the TRA exemption - Fraud rate calculation methodology for the application of the TRA exemption

Applicability of SCA to 'card payments initiated by the payee only'

Geographical scope of application of the RTS on strong customer authentication (SCA) and secure communication requirements - 'Two-leg' transactions

Persistent authentication for wearable devices

Applicability of Strong Customer Authentication (SCA) to existing recurring payments solutions

Review of security measures

Display of incorrect authentication factors in case of failed authentication attempts

Currency conversion of the EUR thresholds contained in the RTS

Qualification of SMS OTP as an authentication factor

Applicability of the low-value contactless exemption to contactless-only devices

Accessing payment account online in web browser shall exceed not 5 minutes without activity

Exemption for secure corporate payment processes and protocols

Transactions initiated via Interactive Voice Response (IVR) solutions

SCA at vending machines without PIN pad

Application of the exemption for transactions to trusted beneficiaries to Face-to-Face transactions

Confidentiality of offline PIN

Confidentiality of the application cryptogram for EMV transactions

Length of authentication codes

EMV cards and EMV terminals supporting online authentication

Review of Security Measures - Auditors expertise

Review of the security measures: Audit report

Authentication code

SMS OTP and credit card as a two authentication factor

Payee-initiated transactions with irregular period or variable amount

Data authentication standards

Scope of ‘initiation of an electronic payment transaction’

Exemption from strong customer authentication (SCA) for payment account information in combination with accessing account information online in web browser

On the access to trusted beneficiaries lists (RTS Art 13) by TPPs in write mode

Usage of SMS for dynamic linking

Subsequent instances of a recurring card payment transaction, other than the first, initial one, are transactions initiated by the payee only. This is also the case for card instalment transactions.

Strong Authentication

Contactless payments at point of sale - Applications of the conditions

Contactless payments at point of sale - Applications of the conditions

Application of SCA when a PSU accesses payment transactions data older than on the last 90 days, without having access to sensitive payment data and for a period of 90 days after the last access using SCA

Responsibility of national authority with regards to audit reports

Definition of payee for dynamic linking

Unattended terminals and Transaction Risk Analysis (TRA) exemption and related Payment Service Providers (PSP)’s liabilities rules

Dynamic Linking for batch payments

Application of the Low Value Transaction Limits

Dynamic linking for batch transactions

Mount unattended contactless device on general goods vending machines

Payment Initiation Scope and Trusted Beneficiaries

Dynamic linking: transactions for which the final amount is unknown and may be lower or higher than authenticated amount

Using Trusted Beneficiary Lists to Auto Reject PISP Transactions

Applicability of SCA to electronically processed SEPA Direct Debits / Interpretation of EBA Q&A 2018_4359

Exemptions from Strong Customer Authentication (SCA): credit transfers

Secure corporate payment processes and protocols and inactivity time period

The use of strong and widely recognized encryption techniques

Authentication procedures that ASPSPs’ interfaces are required to support (using re-direction)

Exemption from strong customer authentication

Mobile Banking Services and SCA in the same app

API functionality

Eligibility of communication by AISPs with ASPSP throughout two access interfaces in parallel

Revocation of ASPSP's Exemption from the Contingency Mechanism due to Prolonged Service Disruption

Obligatory nature of the SCA and exemption based on transaction risk analysis

Ability of static card data to be considered a possession factor?

Signature on a paper slip from a payment terminal, as a factor in a two-factor SCA

Signature performed on the screen of a digital device as a factor in a two-factor SCA

Showing a password after it has been masked

Unsuccessful authentications and declined transactions effect on the counters of cumulative amount and number of consecutive transactions

Exemptions from Strong Customer Authentication (SCA): trusted beneficiaries

Access by AISPs when customer not present up to 4 times in a 24 hour period

Applicability of exemption from strong customer authentication (SCA) under Article 17 for card payments

Exemption of secure corporate payment processes and protocols

Fraud rate calculation for TRA exemption – country dimension

Compliance with SCA in offline mode on an aircraft without internet connection

Delayed or deferred PIN for wearable devices

"Push based" authentication and SCA requirements

Scope of contingency mechanism

Relying on vendor mechanisms processing the biometric data for strong customer authentication; Multiple fingerprint samples stored on a mobile device and used for purpose of user authentication.

ASPSP is denied the waiver to the fall-back by an NCA

Communication plans to inform payment service providers making use of the dedicated interface

Knowledge element of SCA.

Guidelines on the conditions to be met to benefit from an exemption from contingency measures under Article 33(6) of Regulation (EU) 2018/389 (RTS on SCA & CSC)

Change of TPP access rights for AIS consent by the PSU prior to authorisation

Ability of Payee’s PSP to apply exemptions from SCA in credit transfers

Arbitrating between security and obstacles

Calculation of fraud rates in relation to Exemption Threshold Values (ETVs)

Transaction Risk Analysis (TRA) exemption – Frequency of recalculation of fraud rate

Communication plans to inform payment service providers making use of the dedicated interface

Obligatory nature of the SCA and exemption based on transaction risk analysis

Exemptions from Strong Customer Authentication (SCA): trusted beneficiaries

Application of Transaction Risk Analysis (TRA) exemption – Real time risk analysis / monitoring

Trusted Beneficiary exemption – Management of the exemption, information flows between PSPs in the payment transaction

Testing eIDAS certificates before 14 September 2019

ASPSP is denied the waiver to the fall-back by an NCA

Fall back exemption

Ability of static card data to be considered a possession factor?

Signature performed on the screen of a digital device as a factor in a two-factor SCA

Applicability of exemption from strong customer authentication (SCA) under Article 17 for card payments

Trusted Beneficiaries

Application of the exemption related to a trusted beneficiary

Showing a password after it has been masked

Chip and Signature cards and their inclusion in the remit of RTS Article 11

Certification in relation to a Technical Service Provider (TSP)

Applicability of Article 34 (eIDAS certificates) prior to application date of Regulation (EU) 2018/389

Identification and access for testing purposes of entities that are not authorised third party providers (TPPs)

Strong Customer Authentication (SCA) possession element requirement for cryptographic validation

Content of eIDAS certificates if agents or outsource providers are involved

Fraud rate calculation for TRA exemption – country dimension

RTS on strong customer authentication and secure communication under PSD2

Final Report Guidelines on procedures for complaints of alleged infringements of Directive (EU) 2015/2366

Final Report on amending Guidelines on fraud reporting under PSD2

Final Report Guidelines on information requirements in relation to transfers of funds and certain crypto-assets transfers under Regulation (EU) 2023/1113 ('Travel Rule Guidelines')

Joint Guidelines under Article 25 of Regulation (EU) 20215/847 on the measures PSPs should take to detect missing or incomplete information on the payer or the payee, and the procedures they should put in place to manage a transfer of funds lacking the required information

Recovery- and exitplans payment institutions

Supervisory boards of payment institutions and electronic money institutions