Clarification on level of protection required for the processing of the IBAN outside the inter-PSP environment

Article 4(31) of Directive 2015/2366/EU (PSD2) defines personalised security credentials (PSC) as ‘personalised features provided by the payment service provider to a payment service user for the purposes of authentication’. Accordingly, since the IBAN is not an element used for the purpose of authentication, it cannot be considered as a PSC. Article 4(32) of PSD2 defines sensitive payment data as ‘data, including personalised security credentials which can be used to carry out fraud. The article further clarifies that ‘for the activities of payment initiation service providers and account information service providers, the name of the account owner and the account number do not constitute sensitive payment data’. Accordingly, the IBAN of the payer does not constitute sensitive payment data for the activities of payment initiation service providers. In relation to the above, in a transaction initiated at the point-of-interaction (POI) by using a QR code presented by either the payer or the payee (merchant), the IBAN can be included in free text.   However, since its disclosure may be used to carry out fraud, it will be for payment service providers to assess the risks arising from transmitting the IBAN in free text between the device of the payer and the POI and from storing it, if applicable. Subsequently, PSPs should decide whether it is necessary to implement corresponding security measures to mitigate these risks.