EBA · 2018_4155 Final Q&A

Responsibility of national authority with regards to audit reports

Regulation
Directive 2015/2366/EU (PSD2)
Article
97, para. 3
Topic
Strong customer authentication and common and secure communication (incl. access)
Submitted by
Accounting firm
Submitted
2018-07-23
Answered
2018-10-26
Answer provided by
ESAs (EBA, ESMA, EIOPA)
Browse PSD2 Register → More Q&As on this regulation →

Question

Should all audit reports required under Article 3 of the RTS on strong customer authentication and secure communication be monitored by the competent national authorities? And, what are the consequences if the audit report addressing the audit (referred to in Article 3, paragraph 1 of the RTS) shows significant findings?

Background

In Article 3 paragraph 3 it is mentioned that "The entire report shall be made available to competent authorities upon their request". This does not directly state that each report will be monitored by the competent authorities. It is not clear what the rationale behind this is (why would some reports not be requested and monitored by the competent authorities?).

Answer

As stated in Article 3 of the Commission Delegated Regulation (EU) 2018/389 , the audit “report shall be made available to competent authorities upon their request”. Competent authorities will therefore establish whether or not they wish to request such a report. In addition, whether or not the competent authority is involved, and similar to any type of audit report, every payment service provider is expected to act on significant findings and weaknesses identified to ensure those are adequately addressed. The payment service provider may also wish to proactively inform the competent authority.

Original source: European Banking Authority, Q&A ID 2018_4155

This Q&A is published by European Banking Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.

Similar Q&As

Review of Security Measures - Auditors expertise

Answered 2018-10-26

Review of the security measures: Audit report

Answered 2018-10-26

Home / host cooperation

Answered 2021-12-17

Annually conducted audit under Commission Delegated Regulation (EU) 2016/957

Answered 2026-05-08

Geographical scope of application of the RTS on strong customer authentication (SCA) and secure communication requirements – ‘Two-leg’ transactions

Answered 2019-09-06

More Q&As on this topic

Definition of "equivalent authentication procedure" for journeys initiated from a mobile application

Answered 2026-06-12

Obstacle assessment of a mandatory client segment selection screen in a redirection journey

Answered 2026-06-12

Clarification of the scope of the term "authentication procedures" in the context of the RTS and the EBA Opinion on obstacles

Answered 2026-06-12

SCA exception for Contactless only terminals (SoftPOS) in case of emergency

Answered 2025-10-03

the use of strong and widely recognized encryption techniques

Answered 2025-10-03

📋 Track EU financial regulation continuously

Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.

Start free trial → Learn more

14-day free trial. No credit card required.