<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2018/389 — RTS — Strong customer authentication and secure communication [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/37","url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/37","title":"Article 37 — Review","family":"l2_unit_view","work_id":"spaces/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","view_of":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Consolidated version of 12 September 2023","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02018R0389-20230912","valid_from":"2018-03-14","valid_until":null,"content_id":"0e2681f37046bd43","versions":["2018-03-14"],"version_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/37/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/37/versions/2026-10-26/rev/0e2681f37046bd43","versions_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/37/versions","relations_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/37/relations","act_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication#art-37","source_line":"Commission Delegated Regulation (EU) 2018/389 · binding · OJ L 69, 13.3.2018 · dated 27 Nov 2017 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2017-11-27","entry_into_force":"2018-03-14","locators":{"document_date":"CELLAR 32018R0389 work_date_document","entry_into_force":"CELLAR 32018R0389 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","name":"Commission Delegated Regulation (EU) 2018/389","number":"2018/389","celex":"32018R0389","title_official":"COMMISSION DELEGATED REGULATION (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication (Text with EEA relevance)","document_date":"2017-11-27"},"position":{"kind":"article","key":"37","index":38,"articles":39,"annexes":1},"prev":{"path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/36","key":"36","title":"Article 36 — Data exchanges"},"next":{"path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/38","key":"38","title":"Article 38 — Entry into force"},"act_anchor":"#art-37"}}} -->
# Article 37 — Review

**Commission Delegated Regulation (EU) 2018/389 · binding · OJ L 69, 13.3.2018 · dated 27 Nov 2017 [in force]**

*In force · Consolidated version of 12 September 2023 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02018R0389-20230912)*

Without prejudice to Article 98(5) of Directive (EU) 2015/2366, EBA shall review by 14 March 2021 the fraud rates referred to in the Annex to this Regulation as well as the exemptions granted under Article 33(6) in relation to dedicated interfaces and, if appropriate, submit draft updates thereto to the Commission in accordance with Article 10 of Regulation (EU) No 1093/2010.
