Usage of SMS for dynamic linking

In accordance with Article 4(a) of the Delegated Regulation (EU) 2018/389 , “where Payment Service Providers apply Strong Customer Authentication in accordance with Article 97(1) of Directive (EU) 2015/2366, the authentication shall be based on two or more elements which are categorised as knowledge, possession and inherence and shall result in the generation of an authentication code”. Further, Article 5(2) of the Delegated Regulation states that “payment service providers shall adopt security measures which ensure the confidentiality, authenticity and integrity of each of the following: a) the amount of the transaction and the payee throughout all of the phases of the authentication; b) the information displayed to the payer throughout all of the phases of the authentication including the generation, transmission and use of the authentication code”. Based on currently available market practices on the transmission of one-time password (OTP) via a Short Message Service (SMS), the SMS may or may not include the information covered in Article 5(2)(a) or the authentication code under Article 4 of the Delegated Regulation. In the case where the SMS is used for the transmission of an OTP but does not contain the authentication code nor any payment information such as the payee or the amount of the transaction, the issuer would not be required under Article 5(2) of the Delegated Regulation to ensure the confidentiality, authenticity and integrity of the information transmitted via the SMS. In the case where the SMS contains the authentication code and/or payment information, such as the payee or the amount of the transaction, while the issuer may still use an SMS OTP to evidence the possession element as clarified in paragraph 25 of the EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06) and Q&A 2018_4039 , in accordance with Article 5(2) of the Delegated Regulation, the issuer should take all necessary security measures to ensure the confidentiality, authenticity and integrity of the authentication code and/or the payment information transmitted via the SMS.