Skip to the text
In this act Article 9 of 39
Text as of 26 Oct 2026 · Consolidated version of 12 September 2023 · Same wording as today’s text.Today’s text

Article 9 — Independence of the elements

Financial servicesLevel 2RTSPSD2In forceOfficial source

9(1)

1.Payment service providers shall ensure that the use of the elements of strong customer authentication referred to in Articles 6, 7 and 8 is subject to measures which ensure that, in terms of technology, algorithms and parameters, the breach of one of the elements does not compromise the reliability of the other elements.

Copy link
9(2)

2.Payment service providers shall adopt security measures, where any of the elements of strong customer authentication or the authentication code itself is used through a multi-purpose device, to mitigate the risk which would result from that multi-purpose device being compromised.

Copy link
9(3)

3.For the purposes of paragraph 2, the mitigating measures shall include each of the following:

Copy link
9(3)(a)
(a)the use of separated secure execution environments through the software installed inside the multi-purpose device;
Copy link
9(3)(b)
(b)mechanisms to ensure that the software or device has not been altered by the payer or by a third party;
Copy link
9(3)(c)
(c)where alterations have taken place, mechanisms to mitigate the consequences thereof.
Copy link

CHAPTER III — EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION