Definition of payee for dynamic linking

Article 5(1) of the Delegated Regulation (EU) 2018/389 states that “where payment service providers apply strong customer authentication in accordance with Article 97(2) of Directive (EU) 2015/2366, in addition to the requirements of Article 4, they shall adopt security measures that meet each of the following requirements: a) the payer is made aware of the amount of the payment transaction and of the payee; b) the authentication code generated is specific to the amount of the payment transaction and the payee agreed to by the payer when initiating the transaction; c) the authentication code accepted by the payment service provider corresponds to the original specific amount of the payment transaction and to the identity of the payee agreed to by the payer; d) any change to the amount or the payee results in the invalidation of the authentication code generated”. In that regard, the authentication code shall be specific to the payee(s) agreed to by the payer. However, the Delegated Regulation does not specify how the payee should be identified for the purpose of the dynamic linking requirements in Article 5, which can be, for instance, through the IBAN (or a similar type of unique identifier). In relation to the above, it would be sufficient to include a meaningful part of the IBAN (or a similar type of unique identifier), or none at all, in the authentication code, provided that the requirements in Article 5(1) of the Delegated Regulation are met.