Association of personalised security credentials to the payment service user

Article 97(1)(c) of Directive 2015/2366/EU (PSD2) requires payment service providers (PSPs) to apply strong customer authentication (SCA) ‘where the payer carries out any action through a remote channel which may imply a risk of payment fraud or other abuses. Article 4(31) of PSD2 defines ‘personalised security credentials’ as personalised features provided by the payment service provider to a payment service user for the purposes of authentication   Article 24 of the Commission Delegated Regulation (EU) 2018/389 prescribes further that ‘payment service providers shall ensure that only the payment service user (PSU) is associated, in a secure manner, with the personalised security credentials, the authentication devices and the software’ and that ‘the association by means of a remote channel of the payment service user's identity with the personalised security credentials and with authentication devices or software is performed using strong customer authentication’.   Accordingly, the payment service provider that has issued the payment card (issuer) is responsible for providing the SCA elements to the payment service user and is required to apply SCA when adding a payment card to a digital wallet.   Finally, issuers may outsource the provision and verification of the elements of SCA to a third party. In that case, the issuer should comply with the general requirements on outsourcing, including the requirements of the EBA Guidelines on Outsourcing arrangements (EBA/GL/2019/02) and the applicable requirements of the Delegated Regulation, including Articles 6-8 in relation to the respective SCA element, and Article 3 in relation to the periodical review of the security measures.