Arbitrating between security and obstacles

Article 32(3) of the Commission Delegated Regulation (EU) 2018/389 prescribes that ‘account servicing payment service providers that have put in place a dedicated interface shall ensure that this interface does not create obstacles to the provision of payment initiation and account information services. Such obstacles, may include, among others, preventing the use by payment service providers referred to in Article 30(1) of the credentials issued by account servicing payment service providers to their customers, imposing redirection to the account servicing payment service provider's authentication or other functions, requiring additional authorisations and registrations in addition to those provided for in Articles 11, 14 and 15 of Directive (EU) 2015/2366, or requiring additional checks of the consent given by payment service users to providers of payment initiation and account information services.’  Paragraph 50 of the Opinion on obstacles under Article 32(3) of the RTS on SCA&CSC ( EBA/OP/2020/10 ) clarified that ‘additional registrations required by ASPSPs for TPPs to be able to access the PSUs’ payment accounts, or the ASPSPs’ production interface, that go beyond what is technically necessary in order to ensure secure access to payment accounts under the conditions of the RTS, are an obstacle. For example, a requirement imposed by an ASPSP to TPPs to pre-register their contact details with the ASPSP in order for TPPs to have access to the ASPSP’s API is an obstacle. This being said, a registration process that is optional, or that is agreed between the ASPSP and TPPs, is not an obstacle’.  Accordingly, requiring TPPs to provide a mobile phone number to ASPSPs for submission of decryption password via an SMS is an obstacle.