--- title: "Article 98 — Regulatory technical standards on authentication and communication" type: regulation legal_status: in_force source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02015L2366-20250117" source_retrieved: 2026-10-08 shortTitle: "Article 98 — Regulatory technical standards on authentication and communication" instrument_type: level1_directive authority: Commission binding: true binding_character: binding mica_level2: false legal_basis: "Directive (EU) 2015/2366" instrument: psd2 celex: "32015L2366" regulation: PSD2 regulation-full: "Directive (EU) 2015/2366" article: 98 status: in_force object_id: eu.psd2.legal_text.article.98 text_version: "Consolidated version of 17 January 2025" source_url: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02015L2366-20250117" check_status: matched verified: true last_checked: 2026-11-09 --- *In force · Consolidated version of 17 January 2025 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02015L2366-20250117)* 1. EBA shall, in close cooperation with the ECB and after consulting all relevant stakeholders, including those in the payment services market, reflecting all interests involved, develop draft regulatory technical standards addressed to payment service providers as set out in [Article 1(1)](1.md) of this Directive in accordance with Article 10 of Regulation (EU) No 1093/2010 specifying: **(a)** the requirements of the strong customer authentication referred to in [Article 97(1)](97.md) and (2); **(b)** the exemptions from the application of [Article 97(1)](97.md), (2) and (3), based on the criteria established in paragraph 3 of this Article; **(c)** the requirements with which security measures have to comply, in accordance with [Article 97(3)](97.md) in order to protect the confidentiality and the integrity of the payment service users’ personalised security credentials; and **(d)** the requirements for common and secure open standards of communication for the purpose of identification, authentication, notification, and information, as well as for the implementation of security measures, between account servicing payment service providers, payment initiation service providers, account information service providers, payers, payees and other payment service providers. 2. The draft regulatory technical standards referred to in paragraph 1 shall be developed by EBA in order to: **(a)** ensure an appropriate level of security for payment service users and payment service providers, through the adoption of effective and risk-based requirements; **(b)** ensure the safety of payment service users’ funds and personal data; **(c)** secure and maintain fair competition among all payment service providers; **(d)** ensure technology and business-model neutrality; **(e)** allow for the development of user-friendly, accessible and innovative means of payment. 3. The exemptions referred to in point (b) of paragraph 1 shall be based on the following criteria: **(a)** the level of risk involved in the service provided; **(b)** the amount, the recurrence of the transaction, or both; **(c)** the payment channel used for the execution of the transaction. 4. EBA shall submit the draft regulatory technical standards referred to in paragraph 1 to the Commission by 13 January 2017. Power is delegated to the Commission to adopt those regulatory technical standards in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. 5. In accordance with Article 10 of Regulation (EU) No 1093/2010, EBA shall review and, if appropriate, update the regulatory technical standards on a regular basis in order, inter alia, to take account of innovation and technological developments, and of the provisions of Chapter II of [Regulation (EU) 2022/2554](https://www.headlesslaw.com/dora). ## Related Level 2 and Level 3 ### Binding measures - [2018/389 — RTS — Strong customer authentication and secure communication \[in force\]](../level-2/rts/2018-389-strong-customer-authentication-and-secure-communication.md) ### Guidance and Q&A - [EBA Q&A 2018_4043 — Q&A — Calculation of fraud rates in relation to Exemption \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4043-calculation-of-fraud-rates-in-relation-to-exemption.md) - [EBA Q&A 2018_4044 — Q&A — Transaction Risk Analysis (TRA) exemption – Time period \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4044-transaction-risk-analysis-tra-exemption-time-period-for.md) - [EBA Q&A 2018_4045 — Q&A — Transaction Risk Analysis (TRA) exemption – Frequency \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4045-transaction-risk-analysis-tra-exemption-frequency-of.md) - [EBA Q&A 2018_4071 — Q&A — Communication plans to inform payment service providers \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4071-communication-plans-to-inform-payment-service-providers.md) - [EBA Q&A 2018_4120 — Q&A — Exemptions from Strong Customer Authentication (SCA) \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4120-exemptions-from-strong-customer-authentication-sca-trusted.md) - [EBA Q&A 2018_4127 — Q&A — Application of Transaction Risk Analysis (TRA) exemption \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4127-application-of-transaction-risk-analysis-tra-exemption-real.md) - [EBA Q&A 2018_4128 — Q&A — Trusted Beneficiary exemption – Management \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4128-trusted-beneficiary-exemption-management-of-the-exemption.md) - [EBA Q&A 2018_4138 — Q&A — Testing eIDAS certificates before 14 September 2019 \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4138-testing-eidas-certificates-before-14-september-2019.md) - [EBA Q&A 2018_4140 — Q&A — ASPSP is denied the waiver to the fall-back by an NCA \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4140-aspsp-is-denied-the-waiver-to-the-fall-back-by-an-nca.md) - [EBA Q&A 2018_4163 — Q&A — Fall back exemption \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4163-fall-back-exemption.md) - [EBA Q&A 2018_4210 — Q&A — Access by AISPs when customer not present up to 4 times \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4210-access-by-aisps-when-customer-not-present-up-to-4-times-in.md) - [EBA Q&A 2018_4227 — Q&A — Contactless counting \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4227-contactless-counting.md) - [EBA Q&A 2018_4230 — Q&A — Contactless transactions - SCA \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4230-contactless-transactions-sca.md) - [EBA Q&A 2018_4235 — Q&A — Ability of static card data to be considered a possession \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4235-ability-of-static-card-data-to-be-considered-a-possession.md) - [EBA Q&A 2018_4237 — Q&A — Signature on a paper slip from a payment terminal \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4237-signature-on-a-paper-slip-from-a-payment-terminal-as-a.md) - [EBA Q&A 2018_4238 — Q&A — Signature performed on the screen of a digital device \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4238-signature-performed-on-the-screen-of-a-digital-device-as-a.md) - [EBA Q&A 2018_4239 — Q&A — Applicability of exemption from strong customer \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4239-applicability-of-exemption-from-strong-customer.md) - [EBA Q&A 2018_4241 — Q&A — Applicability of exemption under RTS Article 11 \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4241-applicability-of-exemption-under-rts-article-11-for-payee-s.md) - [EBA Q&A 2018_4242 — Q&A — Applicability of exemption under RTS Article 16 \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4242-applicability-of-exemption-under-rts-article-16-for-payee-s.md) - [EBA Q&A 2018_4338 — Q&A — Trusted Beneficiaries \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4338-trusted-beneficiaries.md) - [EBA Q&A 2018_4339 — Q&A — 90 Day Access via Direct Access \[Rejected question\]](../level-3/q-and-a/eba/eba-qa-2018-4339-90-day-access-via-direct-access.md) - [EBA Q&A 2018_4342 — Q&A — Chip and Signature cards and their inclusion in the remit \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4342-chip-and-signature-cards-and-their-inclusion-in-the-remit.md) - [EBA Q&A 2018_4366 — Q&A — Showing a password after it has been masked \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4366-showing-a-password-after-it-has-been-masked.md) - [EBA Q&A 2018_4375 — Q&A — Certfication in relation to a Technical Service Provider \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4375-certfication-in-relation-to-a-technical-service-provider-tsp.md) - [EBA Q&A 2018_4383 — Q&A — Exemption of secure corporate payment processes \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4383-exemption-of-secure-corporate-payment-processes-and.md) - [EBA Q&A 2018_4400 — Q&A — Secure corporate payment processes and protocols \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4400-secure-corporate-payment-processes-and-protocols.md) - [EBA Q&A 2018_4413 — Q&A — Qualified certificate under eIDAS for ASPSP \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4413-qualified-certificate-under-eidas-for-aspsp.md) - [EBA Q&A 2018_4439 — Q&A — Fraud rate calculation for TRA exemption – country \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2018-4439-fraud-rate-calculation-for-tra-exemption-country-dimension.md) - [EBA Q&A 2019_4586 — Q&A — Requirement on the use of a Qualified Certificate \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2019-4586-requirement-on-the-use-of-a-qualified-certificate-for.md) - [EBA Q&A 2019_4609 — Q&A — Identification and access for testing purposes \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2019-4609-identification-and-access-for-testing-purposes-of-entities.md) - [EBA Q&A 2019_4630 — Q&A — Applicability of Article 34 (eIDAS certificates) prior \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2019-4630-applicability-of-article-34-eidas-certificates-prior-to.md) - [EBA Q&A 2019_4631 — Q&A — TPP access only with PSU involvement \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2019-4631-tpp-access-only-with-psu-involvement.md) - [EBA Q&A 2019_4651 — Q&A — Relying on vendor mechanisms processing the biometric \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2019-4651-relying-on-vendor-mechanisms-processing-the-biometric-data.md) - [EBA Q&A 2019_4661 — Q&A — Inclusion of time taken for SCA in the performance KPI \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2019-4661-inclusion-of-time-taken-for-sca-in-the-performance-kpi.md) - [EBA Q&A 2019_4662 — Q&A — Define what is “given period of time” \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2019-4662-define-what-is-given-period-of-time.md) - [EBA Q&A 2019_4681 — Q&A — What is considered as a dedicated interface \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2019-4681-what-is-considered-as-a-dedicated-interface.md) - [EBA Q&A 2019_4693 — Q&A — Scope of the corporate SCA exemption. \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2019-4693-scope-of-the-corporate-sca-exemption.md) - [EBA Q&A 2019_4702 — Q&A — Transaction risk analysis (TRA) exemption – Calculation \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2019-4702-transaction-risk-analysis-tra-exemption-calculation-of.md) - [EBA Q&A 2019_4752 — Q&A — Authorisation for the provision of PIS and AIS on behalf \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2019-4752-authorisation-for-the-provision-of-pis-and-ais-on-behalf-of.md) - [EBA Q&A 2019_4783 — Q&A — Delayed or deferred PIN for wearable devices \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2019-4783-delayed-or-deferred-pin-for-wearable-devices.md) - [EBA Q&A 2019_4785 — Q&A — Unsuccessful authentications and declined transactions \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2019-4785-unsuccessful-authentications-and-declined-transactions.md) - [EBA Q&A 2019_4823 — Q&A — 3 month notification period on interface changes \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2019-4823-3-month-notification-period-on-interface-changes-to-aspsps.md) - [EBA Q&A 2019_4826 — Q&A — Scope of contingency mechanism \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2019-4826-scope-of-contingency-mechanism.md) - [EBA Q&A 2020_5224 — Q&A — Transport and parking exemption for parking and electric \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2020-5224-transport-and-parking-exemption-for-parking-and-electric.md) - [EBA Q&A 2020_5650 — Q&A — Requirements towards SCA if association is done based \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2020-5650-requirements-towards-sca-if-association-is-done-based-on.md) - [EBA Q&A 2021_5845 — Q&A — Ability of Payee’s PSP to apply exemptions from SCA \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2021-5845-ability-of-payee-s-psp-to-apply-exemptions-from-sca-in.md) - [EBA Q&A 2021_6029 — Q&A — Scope of “additional registrations” as obstacles \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2021-6029-scope-of-additional-registrations-as-obstacles-in-the-sense.md) - [EBA Q&A 2022_6392 — Q&A — API functionality \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2022-6392-api-functionality.md) - [EBA Q&A 2023_6752 — Q&A — Eligibility of communication by AISPs with ASPSP \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2023-6752-eligibility-of-communication-by-aisps-with-aspsp-throughout.md) - [EBA Q&A 2023_6753 — Q&A — Eligibility of communication by AISPs with ASPSP \[Rejected question\]](../level-3/q-and-a/eba/eba-qa-2023-6753-eligibility-of-communication-by-aisps-with-aspsp-throughout.md) - [EBA Q&A 2023_6820 — Q&A — Exemption from strong customer authentication \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2023-6820-exemption-from-strong-customer-authentication.md) - [EBA Q&A 2023_6863 — Q&A — Mobile Banking Services and SCA in the same app \[Final Q&A\]](../level-3/q-and-a/eba/eba-qa-2023-6863-mobile-banking-services-and-sca-in-the-same-app.md) ### Process documents - [EBA/RTS/2022/03 — Report — Draft RTS amending Delegated Regulation (EU) 2018/389 \[adopted\]](../process/eba-rts-2022-03-amendment-rts-sca-csc.md) *** [Title IV — Rights and obligations in relation to the provision and use of payment services](../titles/iv.md) · [← Article 97](97.md) · [Article 99 →](99.md)