# Article 7 — Requirements of the elements categorised as possession **Commission Delegated Regulation (EU) 2018/389 · binding · OJ L 69, 13.3.2018 · dated 27 Nov 2017 [in force]** *In force · Consolidated version of 12 September 2023 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02018R0389-20230912)* 1. Payment service providers shall adopt measures to mitigate the risk that the elements of strong customer authentication categorised as possession are used by unauthorised parties. 2. The use by the payer of those elements shall be subject to measures designed to prevent replication of the elements.