{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2018-10-26","gaps":[],"covered":["EBA Q&A 2018_4155 — Q&A — Responsibility of national authority [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4155-responsibility-of-national-authority-with-regards-to-audit","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4155-responsibility-of-national-authority-with-regards-to-audit","title":"EBA Q&A 2018_4155 — Q&A — Responsibility of national authority [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4155-responsibility-of-national-authority-with-regards-to-audit","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 26 October 2018","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4155","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"5c723ae75f5678fb","change_date":null,"nearest_versions":["2018-10-26"],"first_text_date":null,"correction_applies":false,"versions":["2018-10-26"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4155-responsibility-of-national-authority-with-regards-to-audit/versions/2018-10-26","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4155-responsibility-of-national-authority-with-regards-to-audit/versions/2018-10-26/rev/5c723ae75f5678fb","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4155-responsibility-of-national-authority-with-regards-to-audit/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4155-responsibility-of-national-authority-with-regards-to-audit/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 26 Oct 2018 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2018-10-26","question_submitted_on":"2018-07-23","locators":{"published_on":"EBA Q&A register entry 2018_4155, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4155, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4155","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4155-responsibility-of-national-authority-with-regards-to-audit.md","body_sha256":"10cda3b2be74f9b9d3ffade1fec94db7e7920a97bc82ef568c8901fd645dd361"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2018_4155 — Q&A — Responsibility of national authority [Final Q&A]\"\nshortTitle: \"EBA Q&A 2018_4155 — Q&A — Responsibility of national authority [Final Q&A]\"\nanswer_id: EBA_QA_2018_4155\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 97(3) PSD2\"\ndate: 26 October 2018\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4155\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 26 October 2018\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4155\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2018_4155, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2018-10-26\"\n  question_submitted_on: \"2018-07-23\"\n  locators:\n    published_on: \"EBA Q&A register entry 2018_4155, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2018_4155, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 26 Oct 2018 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 26 October 2018 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4155)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2018_4155 — Q&A — Responsibility of national authority \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2018_4155 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 26 October 2018; question submitted 23 July 2018 |\n| **Legal basis** | Article 97(3) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Responsibility of national authority with regards to audit reports**\n\n### Question\n\nShould all audit reports required under Article 3 of the RTS on strong customer authentication and secure communication be monitored by the competent national authorities?\n\nAnd, what are the consequences if the audit report addressing the audit (referred to in Article 3, paragraph 1 of the RTS) shows significant findings?\n\n### Background\n\nIn Article 3 paragraph 3 it is mentioned that \"The entire report shall be made available to competent authorities upon their request\". This does not directly state that each report will be monitored by the competent authorities. It is not clear what the rationale behind this is (why would some reports not be requested and monitored by the competent authorities?).\n\n***\n\n### Answer\n\nAs stated in Article 3 of the Commission Delegated Regulation (EU) 2018/389, the audit “report shall be made available to competent authorities upon their request”. Competent authorities will therefore establish whether or not they wish to request such a report. In addition, whether or not the competent authority is involved, and similar to any type of audit report, every payment service provider is expected to act on significant findings and weaknesses identified to ensure those are adequately addressed. The payment service provider may also wish to proactively inform the competent authority.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4155)\n\n## Related Level 1 articles\n\n- [Article 97 — Authentication](../../../articles/97.md)\n"}