European UnionPayment Services Directive (PSD2), Operational and Security Risk Management, Incident Reporting and Strong Customer Authentication
Also known as PSD2.
Directive (EU) 2015/2366, Articles 95 to 97
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Reporting
As of .
What it requires
- Directive (EU) 2015/2366 reaches you if you are a payment service provider: a credit institution, an electronic money institution, a post office giro institution or a payment institution, including a payment initiation service provider or an account information service provider, which Article 97(4) names. A technical service provider that supports payment services without ever holding the funds to be transferred, such as one supplying data processing, authentication or terminals, is outside the Directive under Article 3(j), unless it provides payment initiation or account information services.
- Establish a framework with appropriate mitigation measures and control mechanisms to manage the operational and security risks of the payment services you provide, with effective incident management procedures that detect and classify major operational and security incidents (Article 95(1)). Where Regulation (EU) 2022/2554 applies to you, Article 95(1) applies without prejudice to Chapter II of that Regulation.
- Give your competent authority, every year or at the shorter interval it sets, an updated and comprehensive assessment of those risks and of whether your mitigation measures and control mechanisms are adequate (Article 95(2)).
- Notify the competent authority in your home Member State without undue delay of a major operational or security incident, and where the incident has or may have an impact on your users' financial interests, tell your users without undue delay of the incident and of the measures they can take to mitigate its adverse effects (Article 96(1)). This duty does not apply to a credit institution, an electronic money institution or a payment institution, to an account information service provider, or to an exempted payment institution or electronic money institution, which report major incidents under Regulation (EU) 2022/2554 (Article 96(7)).
- Give your competent authority statistical data on fraud relating to the different means of payment at least once a year (Article 96(6)).
- Apply strong customer authentication when the payer accesses a payment account online, initiates an electronic payment transaction, or carries out any action through a remote channel which may imply a risk of payment fraud or other abuses, and for an electronic remote payment use elements that dynamically link the transaction to a specific amount and a specific payee (Article 97(1) and (2)). Have adequate security measures in place to protect the confidentiality and integrity of your users' personalized security credentials (Article 97(3)).
- If you are an account servicing payment service provider, allow payment initiation service providers and account information service providers to rely on the authentication procedures you give your user (Article 97(5)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The competent authority each Member State designates under Article 100 to ensure and monitor compliance, either a competent authority within the meaning of Article 4(2) of Regulation (EU) No 1093/2010 or a body recognised by national law or a public authority expressly empowered for that purpose by national law. For an infringement of the national law transposing Titles III and IV, the competent authority is the one in the provider's home Member State, except for agents and branches conducted under the right of establishment, where it is the one in the host Member State.
What this law does
Article 1(1) of Directive (EU) 2015/2366 (PSD2) names the payment service providers the Directive covers: credit institutions, electronic money institutions, post office giro institutions, payment institutions, the ECB and national central banks when not acting in their capacity as monetary authority or other public authorities, and Member States or their regional or local authorities when not acting in their capacity as public authorities.
Article 95(1) requires payment service providers to establish a framework with appropriate mitigation measures and control mechanisms to manage the operational and security risks relating to the payment services they provide, including effective incident management procedures for the detection and classification of major operational and security incidents.
Article 95(2) requires them to give the competent authority, annually or at shorter intervals the authority sets, an updated and comprehensive assessment of those risks and of the adequacy of the mitigation measures and control mechanisms they have implemented.
Article 96(1) requires a provider, in the case of a major operational or security incident, to notify the competent authority in its home Member State without undue delay and, where the incident has or may have an impact on the financial interests of its users, to inform them without undue delay of the incident and of the measures they can take to mitigate its adverse effects.
Article 96(6) requires providers to give their competent authorities statistical data on fraud relating to the different means of payment at least once a year.
Article 96(7), which Directive (EU) 2022/2556 added, provides that paragraphs 1 to 5 of Article 96 do not apply to the payment service providers referred to in points (a), (b) and (d) of Article 1(1), to account information service providers, or to payment institutions and electronic money institutions that benefit from an exemption or waiver.
Recital 23 of Regulation (EU) 2022/2554 (DORA) states that the incident reporting requirement of Directive (EU) 2015/2366 should cease to apply to payment service providers that fall within DORA's scope, and that credit institutions, e-money institutions, payment institutions and account information service providers should report those incidents under DORA instead.
Article 96(7) does not name post office giro institutions, the ECB and national central banks, or Member States, which points (c), (e) and (f) of Article 1(1) list as providers.
Article 97 requires a provider to apply strong customer authentication where the payer accesses its payment account online, initiates an electronic payment transaction, or carries out any action through a remote channel which may imply a risk of payment fraud or other abuses, and to have adequate security measures in place to protect the confidentiality and integrity of its users' personalized security credentials.
Article 97(2) adds that for electronic remote payment transactions the authentication must include elements which dynamically link the transaction to a specific amount and a specific payee, and Article 97(4) extends these duties to payments initiated through a payment initiation service provider and to information requested through an account information service provider.
Article 98(1) tasked the European Banking Authority with draft regulatory technical standards specifying the requirements of strong customer authentication and the security measures that protect personalized security credentials, and Commission Delegated Regulation (EU) 2018/389 supplements the Directive with technical standards for strong customer authentication.
Article 3(j) takes out of the Directive services provided by technical service providers which support the provision of payment services without them entering at any time into possession of the funds to be transferred, including the provision and maintenance of terminals and devices used for payment services, with the exclusion of payment initiation services and account information services.
Article 100(1) requires each Member State to designate competent authorities to ensure and monitor effective compliance with the Directive, and Article 103(1) requires Member States to lay down penalties for infringements of the national law transposing it that are effective, proportionate and dissuasive, without setting a sum of its own.
The European Parliament's procedure file for a proposed successor Directive (2023/0209(COD)) lists it as repealing Directive 2015/2366 and shows the stage reached as awaiting the Council's first reading position, and the file for the companion proposed Payment Services Regulation (2023/0210(COD)) shows the same stage.
When LexLint raises it
When your app profile says your app is a payment provider.