Article 98Regulatory technical standards on authentication and communication

1. EBA shall, in close cooperation with the ECB and after consulting all relevant stakeholders, including those in the payment services market, reflecting all interests involved, develop draft regulatory technical standards addressed to payment service providers as set out in Article 1(1) of this Directive in accordance with Article 10 of Regulation (EU) No 1093/2010 specifying:

(a)

the requirements of the strong customer authentication referred to in Article 97(1) and (2);

(b)

the exemptions from the application of Article 97(1), (2) and (3), based on the criteria established in paragraph 3 of this Article;

(c)

the requirements with which security measures have to comply, in accordance with Article 97(3) in order to protect the confidentiality and the integrity of the payment service users’ personalised security credentials; and

(d)

the requirements for common and secure open standards of communication for the purpose of identification, authentication, notification, and information, as well as for the implementation of security measures, between account servicing payment service providers, payment initiation service providers, account information service providers, payers, payees and other payment service providers.

2. The draft regulatory technical standards referred to in paragraph 1 shall be developed by EBA in order to:

(a)

ensure an appropriate level of security for payment service users and payment service providers, through the adoption of effective and risk-based requirements;

(b)

ensure the safety of payment service users’ funds and personal data;

The article continues in the official text.