0. W3C IG
EBA PSD2 mandate on Strong Customer Authentication and Secure Communication
Geoffroy Goffinet

1. The role of the EBA
The EBA was established by Regulation (EC) No. 1093/2010 of the European Parliament and EU Council;
came into being on 1 January 2011;
took over all existing tasks and responsibilities from the Committee of European Banking Supervisors (CEBS);
took on additional tasks, incl. consumer protection, the monitoring of financial innovation, and payments;
is an independent authority;
is accountable to the EU Parliament and Council;
has as its highest governing body the EBA Board of Supervisors, comprising the Heads of the 28 national supervisors. 1

2. Output of the EBA to date
Since its creation in 2011, the EBA has issued more than 200 legal instruments, as well as more than 100 reports.
2011
2012
2013
2014
2015
Total
Regulatory Technical Standards 1 39 22 15 77
Implementing Technical Standards 21 10 9 40
Guidelines 2 6 17 19 46
Opinions / Technical Advice 14 48
Published reports 12 26 23 34
111
Recommendations 4
Breach of Union Law investigations 0 
Mediations 5 7
Peer reviews 3
Warnings  0
Stress tests  1 2

3. PSD2 - Strong Authentication & Secure Communication EBA mandates and milestones
The PSD2 confers a mandate (art 98) on the EBA to develop in close cooperation with the ECB:
the requirements of the strong customer authentication;
the exemptions from the application of strong customer authentication;
the requirements with which security measures have to comply in order to protect the confidentiality and the integrity of the payment service users’ personalised security credentials; and
the requirements for common and secure open standards of communication for the purpose of identification, authentication, notification, and information, as well as for the implementation of security measures, between account servicing payment service providers, payment initiation service providers, account information service providers, payers, payees and other payment service providers.
Joint CP to allow market participants to see the complete picture and provide meaningful responses

4. ? Strong Authentication & Secure Communication milestones
First publications on Dec 8th
Entry into force + 12mths
13 Jan 2018
Sep 2018
Entry into force + 24mths =
Application date of PSD2 (incl. all EBA mandates, except RTS SCA-CSC)
Adoption of RTS by EU Commission (date tbc)
Entry into force of RTS (RTS adoption + 18 months, i.e. not before Sep ) ?
Entry into force of PSD 2
EBA deliverable:
8 Feb 2016
Jul-Sept 2016
(jointly with the ECB)
Security
Publication of DP ↙
RTS on Strong Authentication & Secure Communication
Publication of CP ↙ ?
13 Jan 2016
13 Jan 2017
End of DP consultation
Milestones for the RTS and ITSs
8 February 2016 – End of public consultation on the DP
Q – Development of the requirements.
Summer 2016 – Tentative publication of draft Consultation Paper on the draft RTS (3 months)
End of CP – Jan 2017 – finalisation of draft RTS and submission to the EU Commission

5. Strong authentication and secure communication: finding a balance between competing demands
When developing the RTS on strong customer authentication & secure communication, EBA and ECB will have to make difficult trade-offs between competing demands.
3) Tough security standards vs. Facilitation of innovative industry solutions in the future (which may suggest a high degree of (which may suggest the opposite, i.e. high level
prescription in the requirements to requirements that provide flexibility across firms & time);
avoid circumvention of rules);
2) Tough security standards vs. Customer convenience (which may suggest that payment user (which may suggest the opposite, e.g. one-click payments); should be subject to several security and authentication steps);
1) High degree of interoperability vs. Flexibility for market participants between all ASPSPs and all PISPs/AISPs (which may suggest the opposite, i.e. high level (which may suggest one single standard/ requirements that in turn allow for different market protocol to be prescribed by the EBA); driven solutions);

6. Strong authentication and secure communication: finding a balance between competing demands (cont.)
Discussion Paper (DP) on the RTS on strong customer authentication and secure communication, EBA & ECB raise questions on five topics. The responses to the DP will be an input to the subsequent development of the RTS, on which EBA & ECB will consult in 2016Q2.
Requirements for the strong customer authentication procedure;
Exemptions to the application of strong customer authentication;
Protection of the payment service users’ personalised security credentials;
Requirements for common and secure open standards of communication; and
Possible synergies with the regulation on electronic identification and trust services for electronic transactions in the internal market (e-Idas);