We would prefer option a), although this option involves numerous imponderables. What is more, PSD1 does not yet feature the legal concept of “strong customer authentication”, so that the legal background to the guidelines’ central element is missing. We therefore propose the following new Option (c): The risks outlined can be avoided and legal certainty achieved at the same time if guidelines take effect after publication of PSD2. In view of the experience made in handling the SecuRe Pay recommendations, a timeframe of 36 months for implementation by financial institutions appears realistic.