Relying on vendor mechanisms processing the biometric data for strong customer authentication; Multiple fingerprint samples stored on a mobile device and used for purpose of user authentication.

Are the obligations of a payment service provider (PSP) laid down in the Article 8 of RTS on strong customer authentication and secure communication fulfilled in case the biometric credentials of customer are stored at the device level and the strong customer authentication itself is processed by the mobile device? In this context, are the obligations of the PSP laid down in Article 8 and 24 of RTS on Strong Customer Authentication fulfilled in case the mobile device stores multiple fingerprint samples for user authentication?

Article 8 paragraph 1 of the EU Commission Delegated Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication provides that the PSP shall adopt measures to mitigate the risk that the authentication elements categorised as inherence and read by access devices and software provided to the payer are uncovered by unauthorised parties. At a minimum, the PSP shall ensure that those access devices and software have a very low probability of an unauthorised party being authenticated as the payer. In case customers intend to use fingerprint or facial recognition as inherence element to access their payment account online through mobile banking application on a mobile device which runs on iOS or Android operating system, the mobile banking application uses the fingerprint or facial recognition system implemented on the Android or iOS operating system. In such case, the biometric data of the respective customer are stored on the secure enclave of a mobile device and the biometric authentication itself is processed by the operating system of the respective mobile device. PSP itself does not have access to biometric data of the customer, but only obtains positive or negative result of the user verification (i.e. whether the verification was successful or not). No application has access to the secure enclave where the biometric data are stored. As a result, the PSP has to rely on the vendor mechanisms (e.g. in case of iOS Apple touch ID) for customer identity verification including the implemented security measures. Pursuant to Article 24 of RTS on Strong Customer Authentication, the PSP should ensure that only the payment service user is associated, in a secure manner, with the personalized security credentials, the authentication devices and the software. However, some fingerprint recognition software implemented on a mobile device demand multiple fingerprint samples for user verification and therefore, there is a risk that fingerprint samples of multiple persons could be stored on the mobile device even before installation and registration of a mobile banking application. Under such conditions, the PSP cannot ensure with certainty that another person will register and use the mobile banking application on behalf of the actual payment services user.