Skip to the text
In this act Article 2 of 39
Text as of 26 Oct 2026 · Consolidated version of 12 September 2023 · Same wording as today’s text.Today’s text

Article 2 — General authentication requirements

Financial servicesLevel 2RTSPSD2In forceOfficial source

2(1)

1.Payment service providers shall have transaction monitoring mechanisms in place that enable them to detect unauthorised or fraudulent payment transactions for the purpose of the implementation of the security measures referred to in points (a) and (b) of Article 1.

Those mechanisms shall be based on the analysis of payment transactions taking into account elements which are typical of the payment service user in the circumstances of a normal use of the personalised security credentials.

Copy link
2(2)

2.Payment service providers shall ensure that the transaction monitoring mechanisms take into account, at a minimum, each of the following risk-based factors:

Copy link
2(2)(a)
(a)lists of compromised or stolen authentication elements;
Copy link
2(2)(b)
(b)the amount of each payment transaction;
Copy link
2(2)(c)
(c)known fraud scenarios in the provision of payment services;
Copy link
2(2)(d)
(d)signs of malware infection in any sessions of the authentication procedure;
Copy link
2(2)(e)
(e)in case the access device or the software is provided by the payment service provider, a log of the use of the access device or the software provided to the payment service user and the abnormal use of the access device or the software.
Copy link