Submission #148

Primary tabs

View(active tab)

Notakey

Question 1: Do you agree with the EBA’s reasoning on the requirements of the strong customer authentication, and the resultant provisions proposed in Chapter 1 of the draft RTS?

Yes. However point 3. A at Article 6 should be precised. Through consultation with banks a questions has arisen does sms meet these requirements. Our interpretation of this point is that solution providers should guarantee that the Hardware or Software is not tampered. In case of Hardware we see solution using either HSMu or TEE on mobile. For purely software based solutions we do not see a way how it can be done.

Bank interpretation is that you cannot use the same channel for the OTP (i.e. you cannot send an OTP through the push notification through the mobile app because it would be using the same execution environment, but if you send an SMS in fact you are already using a different channel or execution environment).

It should be precised if SMS is an exception. In our experience developing digital identity solutions for Government and Telecommunication company, SMS can be tampered through methods like number forwarding, special devices for SMS interception etc.

Question 2: In particular, in relation to the “dynamic linking” procedure, do you agree with the EBA’s reasoning that the requirements should remain neutral as to when the “dynamic linking” should take place, under the conditions that the channel, mobile application, or device where the information about the amount and the payee of the transaction is displayed is independent or segregated from the channel, mobile application or device used for initiating the payment, as foreseen in Article 2.2 of the draft RTS.

In case of TEE mentioned in the Article 6, dynamic inking information can be provided on the same app used for initiating the payment. The channels are separated and having a separate app would just make the adoption of security solutions lower.

Question 3: In particular, in relation to the protection of authentication elements, are you aware of other threats than the ones identified in articles 3, 4 and 5 of the draft RTS against which authentication elements should be resistant? -

Question 4: Do you agree with the EBA’s reasoning on the exemptions from the application of Article 97 on strong customer authentication and on security measures, and the resultant provisions proposed in Chapter 2 of the draft RTS? Yes

Question 5: Do you have any concern with the list of exemptions contained in Chapter 2 of the draft RTS for the scenario that PSPs are prevented from implementing SCA on transactions that meet the criteria for exemption? No

Question 6: Do you agree with the EBA’s reasoning on the protection of the confidentiality and the integrity of the payment service users’ personalised security credentials, and the resultant provisions proposed in Chapter 3 of the draft RTS? Yes

Question 7: Do you agree with the EBA’s reasoning on the requirements for common and secure open standards of communication for the purpose of identification, authentication, notification, and information, and the resultant provisions proposed in Chapter 4 of the draft RTS?

Yes. Also should we include about modern cryptographic interfaces? Library called NaCl, which was in part funded by the European Commission, and which prevents misuse of cryptographic primitives, and is simpler/with a smaller attack surface than OpenSSL.

Question 8: In particular, do you agree that the use of ISO 20022 elements, components or approved message definitions, if available, should be required to ensure the interoperability of different technological communication solutions implemented between PSPs for the provision of AIS, PIS or for the confirmation on the availability of funds? Do you see any particular technical constraint that would prevent the use of such industry standards? Yes

Question 9: With regards to identification between PSPs, do you agree that website certificates issued by a qualified trust service provider under an e-IDAS policy would be suitable and allow for the use of all common types of devices (such as computers, tablets and mobile phones) for carrying out different payment services ?

Yes. Qualified Electronic Signatures states that a certificate can be generated if the device gives 100% non-repudiation guarantee. All modern smartphones and tablets have the TEE, which allows to achieve that.

Question 10: With regards to the frequency with which AIS providers can request information from designated payment accounts when the payment service user is not actively requesting such information, do you agree that the proposed limit of no more than two times a day achieve an appropriate balance between allowing AISP to provide updated information to their users while not negatively impacting the availability of the ASPSP’s communication interface? If not, please indicate what would be in your view the appropriate frequency and rationale for such frequency. It is ok.

Please select which category best describes you and/or your organisation [IT services provider "]"

Please select which category best describes the services provided by you/your organisation [Execution of payment transactions"]"

Name of organisation Notakey