Interactive Single Rulebook

The Interactive Single Rulebook is an on-line tool that provides a comprehensive compendium of  the level 1 text for the Capital Requirements Regulation (CRR) and the Capital Requirements Directive (CRD IV); Bank Recovery and Resolution Directive (BRRD); the Deposit Guarantee Schemes Directive (DGSD); and the Payments Services Directive (PSD2)  the corresponding technical standards developed by the European Banking Authority (EBA) and adopted by the European Commission (RTS and ITS), as well as the EBA Guidelines and related Q&As.
The purpose of the Single Rulebook is to ensure the consistent application of the regulatory banking framework across the EU.
This Interactive Single Rulebook is meant purely as a documentation tool and the EBA does not assume any liability for its contents. For the authentic version of EU legislation users should refer to the Official Journal of the European Union.
Please click on the relevant legislative text to see technical standards, guidelines and Q&As relating to each Article.

« Back

Interactive Single Rulebook

Path Payment Services Directive > TITLE IV > CHAPTER 5 > Article 98 (Copy link to article)
Title Article 98
Description Regulatory technical standards on authentication and communication
Main content

1. EBA shall, in close cooperation with the ECB and after consulting all relevant stakeholders, including those in the payment services market, reflecting all interests involved, develop draft regulatory technical standards addressed to payment service providers as set out in Article 1(1) of this Directive in accordance with Article 10 of Regulation (EU) No 1093/2010 specifying:

(a) the requirements of the strong customer authentication referred to in Article 97(1) and (2);

(b) the exemptions from the application of Article 97(1), (2) and (3), based on the criteria established in paragraph 3 of this Article;

(c) the requirements with which security measures have to comply, in accordance with Article 97(3) in order to protect the confidentiality and the integrity of the payment service users’ personalised security credentials; and

(d) the requirements for common and secure open standards of communication for the purpose of identification, authentication, notification, and information, as well as for the implementation of security measures, between account servicing payment service providers, payment initiation service providers, account information service providers, payers, payees and other payment service providers.

2. The draft regulatory technical standards referred to in paragraph 1 shall be developed by EBA in order to:

(a) ensure an appropriate level of security for payment service users and payment service providers, through the adoption of effective and risk-based requirements;

(b) ensure the safety of payment service users’ funds and personal data;

(c) secure and maintain fair competition among all payment service providers;

(d) ensure technology and business-model neutrality;

(e) allow for the development of user-friendly, accessible and innovative means of payment.

3. The exemptions referred to in point (b) of paragraph 1 shall be based on the following criteria:

(a) the level of risk involved in the service provided;

(b) the amount, the recurrence of the transaction, or both;

(c) the payment channel used for the execution of the transaction.

4. EBA shall submit the draft regulatory technical standards referred to in paragraph 1 to the Commission by 13 January 2017.

Power is delegated to the Commission to adopt those regulatory technical standards in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

5. In accordance with Article 10 of Regulation (EU) No 1093/2010, EBA shall review and, if appropriate, update the regulatory technical standards on a regular basis in order, inter alia, to take account of innovation and technological developments