<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2018/389 — RTS — Strong customer authentication and secure communication [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/29","url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/29","title":"Article 29 — Traceability","family":"l2_unit_view","work_id":"spaces/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","view_of":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Consolidated version of 12 September 2023","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02018R0389-20230912","valid_from":"2018-03-14","valid_until":null,"content_id":"69851b22b681ffa2","versions":["2018-03-14"],"version_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/29/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/29/versions/2026-10-26/rev/69851b22b681ffa2","versions_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/29/versions","relations_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/29/relations","act_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication#art-29","source_line":"Commission Delegated Regulation (EU) 2018/389 · binding · OJ L 69, 13.3.2018 · dated 27 Nov 2017 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2017-11-27","entry_into_force":"2018-03-14","locators":{"document_date":"CELLAR 32018R0389 work_date_document","entry_into_force":"CELLAR 32018R0389 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","name":"Commission Delegated Regulation (EU) 2018/389","number":"2018/389","celex":"32018R0389","title_official":"COMMISSION DELEGATED REGULATION (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication (Text with EEA relevance)","document_date":"2017-11-27"},"position":{"kind":"article","key":"29","index":30,"articles":39,"annexes":1},"prev":{"path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/28","key":"28","title":"Article 28 — Requirements for identification"},"next":{"path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/30","key":"30","title":"Article 30 — General obligations for access interfaces"},"act_anchor":"#art-29"}}} -->
# Article 29 — Traceability

**Commission Delegated Regulation (EU) 2018/389 · binding · OJ L 69, 13.3.2018 · dated 27 Nov 2017 [in force]**

*In force · Consolidated version of 12 September 2023 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02018R0389-20230912)*

1. <a id="art-29-p-1"></a>Payment service providers shall have processes in place which ensure that all payment transactions and other interactions with the payment services user, with other payment service providers and with other entities, including merchants, in the context of the provision of the payment service are traceable, ensuring knowledge ex post of all events relevant to the electronic transaction in all the various stages.

2. <a id="art-29-p-2"></a>For the purpose of paragraph 1, payment service providers shall ensure that any communication session established with the payment services user, other payment service providers and other entities, including merchants, relies on each of the following:

    <a id="art-29-p-2-a"></a>**(a)** a unique identifier of the session;

    <a id="art-29-p-2-b"></a>**(b)** security mechanisms for the detailed logging of the transaction, including transaction number, timestamps and all relevant transaction data;

    <a id="art-29-p-2-c"></a>**(c)** timestamps which shall be based on a unified time-reference system and which shall be synchronised according to an official time signal.

**Section 2 — Specific requirements for the common and secure open standards of communication**
