{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2018/389 — RTS — Strong customer authentication and secure communication [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/2","url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/2","title":"Article 2 — General authentication requirements","family":"l2_unit_view","work_id":"spaces/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","view_of":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Consolidated version of 12 September 2023","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02018R0389-20230912","valid_from":"2018-03-14","valid_until":null,"content_id":"e6a1a0c0f9cca893","versions":["2018-03-14"],"version_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/2/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/2/versions/2026-10-26/rev/e6a1a0c0f9cca893","versions_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/2/versions","relations_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/2/relations","act_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication#art-2","source_line":"Commission Delegated Regulation (EU) 2018/389 · binding · OJ L 69, 13.3.2018 · dated 27 Nov 2017 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2017-11-27","entry_into_force":"2018-03-14","locators":{"document_date":"CELLAR 32018R0389 work_date_document","entry_into_force":"CELLAR 32018R0389 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","name":"Commission Delegated Regulation (EU) 2018/389","number":"2018/389","celex":"32018R0389","title_official":"COMMISSION DELEGATED REGULATION (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication (Text with EEA relevance)","document_date":"2017-11-27"},"position":{"kind":"article","key":"2","index":2,"articles":39,"annexes":1},"prev":{"path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/1","key":"1","title":"Article 1 — Subject matter"},"next":{"path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/3","key":"3","title":"Article 3 — Review of the security measures"},"act_anchor":"#art-2"}},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02018R0389-20230912","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication.md","unit_text_sha256":"c608c837f63e1f6e36da55fda35bdcf17895526a4d4a86a907aa83e4b6babaf9","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/art-2","kind":"article","key":"2","heading":"Article 2 — General authentication requirements","text":"## Article 2 — General authentication requirements\n\n1. Payment service providers shall have transaction monitoring mechanisms in place that enable them to detect unauthorised or fraudulent payment transactions for the purpose of the implementation of the security measures referred to in points (a) and (b) of Article 1.\n\n Those mechanisms shall be based on the analysis of payment transactions taking into account elements which are typical of the payment service user in the circumstances of a normal use of the personalised security credentials.\n\n2. Payment service providers shall ensure that the transaction monitoring mechanisms take into account, at a minimum, each of the following risk-based factors:\n\n **(a)** lists of compromised or stolen authentication elements;\n\n **(b)** the amount of each payment transaction;\n\n **(c)** known fraud scenarios in the provision of payment services;\n\n **(d)** signs of malware infection in any sessions of the authentication procedure;\n\n **(e)** in case the access device or the software is provided by the payment service provider, a log of the use of the access device or the software provided to the payment service user and the abnormal use of the access device or the software.\n\n","marks":[],"text_hash":"c608c837f63e1f6e36da55fda35bdcf17895526a4d4a86a907aa83e4b6babaf9","revision":1}}