Requirement on the use of a Qualified Certificate for Electronic Seals (QSealC) for integrity and authenticity

Article 34(1) of the Commission Delegated Regulation (EU) 2018/389 specifies that ‘for the purpose of identification, as referred to in Article 30(1)(a), payment service providers shall rely on qualified certificates for electronic seals (QSealCs) as referred to in Article 3(30) of Regulation (EU) No 910/2014 or for website authentication (QWACs) as referred to in Article 3(39) of that Regulation.’ Paragraph 11 of the Opinion of the European Banking Authority (EBA) on the use of eIDAS certificates under the RTS on strong customer authentication and secure communication , describes some of the specificities of QSealCs, namely that they (i) ensure the integrity and correctness of the origin (authenticity) of the signed data and (ii) provide strong evidence of the signed data. The reference in the EBA’s Opinion to Article 35(2) of Regulation (EU) No 910/2014 shows that the specificities of the QSealCs cited in paragraph 11 of the Opinion were in line with the applicable legislation. Further, this reference is in line with the objective of PSD2 of technological neutrality and did not infer that Qualified Electronic Seals employing a Qualified Seal creation Device are required for the purpose of Article 34(1) of the Delegated Regulation.