Article 3(1) of the RTS states that the Auditors to perform the review of security measures should be “auditors with expertise in IT security and payments and operationally independent within or from the payment service provider”.

Article 3(2) of the RTS states that the “The auditor performing this audit shall have expertise in IT security and payments and be operationally independent within or from the payment service provider. During the first year of making use of the exemption under Article 18 and at least every 3 years thereafter, or more frequently at the competent authority's request, this audit shall be carried out by an independent and qualified external auditor.”

In many cases, internal auditors will be included in the project team of PSD2 / RTS requirements implementation. This can be seen as operationally dependent because if they would perform the audit, this means that they will audit an object that they have helped to implement. However, it seems quite hard to know if an internal auditor has helped with the implementation of the requirements in the RTS. Therefore it seems very hard for the national authority to be able to assess whether an internal auditor qualifies as "operationally independent".

The background for the second question is the following is stated in paragragh 2 of article 3 (last sentence): "this audit shall be carried out by an independent and qualified external auditor".