{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2018/389 — RTS — Strong customer authentication and secure communication [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/21","url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/21","title":"Article 21 — Monitoring","family":"l2_unit_view","work_id":"spaces/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","view_of":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Consolidated version of 12 September 2023","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02018R0389-20230912","valid_from":"2018-03-14","valid_until":null,"content_id":"b47d61f0e0309f2f","versions":["2018-03-14"],"version_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/21/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/21/versions/2026-10-26/rev/b47d61f0e0309f2f","versions_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/21/versions","relations_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/21/relations","act_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication#art-21","source_line":"Commission Delegated Regulation (EU) 2018/389 · binding · OJ L 69, 13.3.2018 · dated 27 Nov 2017 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2017-11-27","entry_into_force":"2018-03-14","locators":{"document_date":"CELLAR 32018R0389 work_date_document","entry_into_force":"CELLAR 32018R0389 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","name":"Commission Delegated Regulation (EU) 2018/389","number":"2018/389","celex":"32018R0389","title_official":"COMMISSION DELEGATED REGULATION (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication (Text with EEA relevance)","document_date":"2017-11-27"},"position":{"kind":"article","key":"21","index":22,"articles":39,"annexes":1},"prev":{"path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/20","key":"20","title":"Article 20 — Cessation of exemptions based on transaction risk analysis"},"next":{"path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/22","key":"22","title":"Article 22 — General requirements"},"act_anchor":"#art-21"}},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02018R0389-20230912","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication.md","unit_text_sha256":"1625f44afb79db499ebc078dbb4fafe9b6d49da90e3699ae16ecc0e54ecf71e0","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/art-21","kind":"article","key":"21","heading":"Article 21 — Monitoring","text":"## <a id=\"art-21\"></a>Article 21 — Monitoring\n\n1. <a id=\"art-21-p-1\"></a>In order to make use of the exemptions set out in Articles 10 to 18, payment service providers shall record and monitor the following data for each type of payment transactions, with a breakdown for both remote and non-remote payment transactions, at least on a quarterly basis:\n\n    <a id=\"art-21-p-1-a\"></a>**(a)** the total value of unauthorised or fraudulent payment transactions in accordance with Article 64(2) of Directive (EU) 2015/2366, the total value of all payment transactions and the resulting fraud rate, including a breakdown of payment transactions initiated through strong customer authentication and under each of the exemptions;\n\n    <a id=\"art-21-p-1-b\"></a>**(b)** the average transaction value, including a breakdown of payment transactions initiated through strong customer authentication and under each of the exemptions;\n\n    <a id=\"art-21-p-1-c\"></a>**(c)** the number of payment transactions where each of the exemptions was applied and their percentage in respect of the total number of payment transactions.\n\n2. <a id=\"art-21-p-2\"></a>Payment service providers shall make the results of the monitoring in accordance with paragraph 1 available to competent authorities and to EBA, with prior notification to the relevant competent authority(ies), upon their request.\n\n**CHAPTER IV — CONFIDENTIALITY AND INTEGRITY OF THE PAYMENT SERVICE USERS' PERSONALISED SECURITY CREDENTIALS**\n\n","marks":[],"text_hash":"1625f44afb79db499ebc078dbb4fafe9b6d49da90e3699ae16ecc0e54ecf71e0","revision":1}}