{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2018/389 — RTS — Strong customer authentication and secure communication [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/5","url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/5","title":"Article 5 — Dynamic linking","family":"l2_unit_view","work_id":"spaces/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","view_of":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Consolidated version of 12 September 2023","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02018R0389-20230912","valid_from":"2018-03-14","valid_until":null,"content_id":"e70eb6fd0ce529e3","versions":["2018-03-14"],"version_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/5/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/5/versions/2026-10-26/rev/e70eb6fd0ce529e3","versions_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/5/versions","relations_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/5/relations","act_url":"https://www.headlesslaw.com/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication#art-5","source_line":"Commission Delegated Regulation (EU) 2018/389 · binding · OJ L 69, 13.3.2018 · dated 27 Nov 2017 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2017-11-27","entry_into_force":"2018-03-14","locators":{"document_date":"CELLAR 32018R0389 work_date_document","entry_into_force":"CELLAR 32018R0389 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication","name":"Commission Delegated Regulation (EU) 2018/389","number":"2018/389","celex":"32018R0389","title_official":"COMMISSION DELEGATED REGULATION (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication (Text with EEA relevance)","document_date":"2017-11-27"},"position":{"kind":"article","key":"5","index":5,"articles":39,"annexes":1},"prev":{"path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/4","key":"4","title":"Article 4 — Authentication code"},"next":{"path":"/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/articles/6","key":"6","title":"Article 6 — Requirements of the elements categorised as knowledge"},"act_anchor":"#art-5"}},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02018R0389-20230912","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication.md","unit_text_sha256":"2054dcfa9e64b0a2e6a18a48c32c302a32a655f66866709a81118914005ef790","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/psd2/level-2/rts/2018-389-strong-customer-authentication-and-secure-communication/art-5","kind":"article","key":"5","heading":"Article 5 — Dynamic linking","text":"## <a id=\"art-5\"></a>Article 5 — Dynamic linking\n\n1. <a id=\"art-5-p-1\"></a>Where payment service providers apply strong customer authentication in accordance with Article 97(2) of Directive (EU) 2015/2366, in addition to the requirements of Article 4 of this Regulation, they shall also adopt security measures that meet each of the following requirements:\n\n    <a id=\"art-5-p-1-a\"></a>**(a)** the payer is made aware of the amount of the payment transaction and of the payee;\n\n    <a id=\"art-5-p-1-b\"></a>**(b)** the authentication code generated is specific to the amount of the payment transaction and the payee agreed to by the payer when initiating the transaction;\n\n    <a id=\"art-5-p-1-c\"></a>**(c)** the authentication code accepted by the payment service provider corresponds to the original specific amount of the payment transaction and to the identity of the payee agreed to by the payer;\n\n    <a id=\"art-5-p-1-d\"></a>**(d)** any change to the amount or the payee results in the invalidation of the authentication code generated.\n\n2. <a id=\"art-5-p-2\"></a>For the purpose of paragraph 1, payment service providers shall adopt security measures which ensure the confidentiality, authenticity and integrity of each of the following:\n\n    <a id=\"art-5-p-2-a\"></a>**(a)** the amount of the transaction and the payee throughout all of the phases of the authentication;\n\n    <a id=\"art-5-p-2-b\"></a>**(b)** the information displayed to the payer throughout all of the phases of the authentication including the generation, transmission and use of the authentication code.\n\n3. <a id=\"art-5-p-3\"></a>For the purpose of paragraph 1(b) and where payment service providers apply strong customer authentication in accordance with Article 97(2) of Directive (EU) 2015/2366 the following requirements for the authentication code shall apply:\n\n    <a id=\"art-5-p-3-a\"></a>**(a)** in relation to a card-based payment transaction for which the payer has given consent to the exact amount of the funds to be blocked pursuant to Article 75(1) of that Directive, the authentication code shall be specific to the amount that the payer has given consent to be blocked and agreed to by the payer when initiating the transaction;\n\n    <a id=\"art-5-p-3-b\"></a>**(b)** in relation to payment transactions for which the payer has given consent to execute a batch of remote electronic payment transactions to one or several payees, the authentication code shall be specific to the total amount of the batch of payment transactions and to the specified payees.\n\n","marks":[],"text_hash":"2054dcfa9e64b0a2e6a18a48c32c302a32a655f66866709a81118914005ef790","revision":1}}