General obligations for access interfaces
- Provide and maintain a compliant access interface for third-party payment services
Retained EU Law
2018
United Kingdom
Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication (Text with EEA relevance)
At a glance
What's here
6 compliance obligations
What this Act requires
Sections that create concrete duties on businesses or carry penalties. Procedural and definitional sections are folded into the “Browse other sections” expander at the bottom of each group. Click any section title to read the source text on legislation.gov.uk.
Access interface options
- Provide payment service access via dedicated or existing interface
Obligations for a dedicated interface
- Ensure your dedicated interface is available and performs as well as your customer-facing online banking
Contingency measures for a dedicated interface
- Have a fallback plan if your payment interface goes down
Security of communication session
- Ensure security of communication sessions for payment services
Data exchanges
- Provide equal data access, fund confirmation, and error notifications to third-party payment providers
Browse 32 other sections — procedural / definitional / commencement
Subject matter
General authentication requirements
Review of the security measures
Authentication code
Dynamic linking
Requirements of the elements categorised as knowledge
Requirements of the elements categorised as possession
Requirements of devices and software linked to elements categorised as inherence
Independence of the elements
Payment account information
Contactless payments at point of sale
Unattended terminals for transport fares and parking fees
Trusted beneficiaries
Recurring transactions
Credit transfers between accounts held by the same natural or legal person
Low-value transactions
Secure corporate payment processes and protocols
Transaction risk analysis
Calculation of fraud rates
Cessation of exemptions based on transaction risk analysis
Monitoring
General requirements
Creation and transmission of credentials
Association with the payment service user
Delivery of credentials, authentication devices and software
Renewal of personalised security credentials
Destruction, deactivation and revocation
Requirements for identification
Traceability
Certificates
Review
Entry into force
Explore more
Browse legislation
Find other UK business legislation with related guidance.