EBA · 2022_6392 Final Q&A

API functionality

Regulation
Directive 2015/2366/EU (PSD2)
Article
98, para. 1
Topic
Strong customer authentication and common and secure communication (incl. access)
Submitted by
Credit institution
Submitted
2022-03-10
Answered
2022-10-14
Answer provided by
ESAs (EBA, ESMA, EIOPA)
Browse PSD2 Register → More Q&As on this regulation →

Question

Is it allowed to use a dedicated PSD2 interface by a TPP that identifies itself with an eIDAS certificate for purposes other than those specified in Article 30(1)(b) - (c) of the RTS on strong customer authentication (SCA) and secure communication?

Background

TPP has informed us that it uses API requests to the Production PSD2 API for purposes other than payment initiation or access to account information, namely, monitoring API availability. What's more, these API requests are part of the monitoring service offered on the market, which is used, among others, by some national competent authorities.   PSD2 and specifically RTS define the dedicated interface's purposes (Article 30(1)(b) and (c)of RTS on strong customer authentication (SCA) and secure communication). Furthermore, Article 34(3)(a) defines the requirements for what needs to be included in the certificates the TPP uses for identification. The roles for payment institutions are (I) account servicing, (ii) payment initiation; (iii) account information; (iv) issuing of card-based payment instruments. These roles are reflected in the eIDAS certificates. None of them refers to the monitoring activity.  Use of the actual request for monitoring purposes can also affect the conversion and error rates, as the request is counted as failed.

Answer

In accordance with Article 34(1) of Commission Delegated Regulation (EU) 2018/389 , payment service providers (PSPs) shall rely, for the purpose of identification of third party providers (TPPs) as referred to in Article 30(1)(a), on eIDAS certificates. Article 34(3) provides that the eIDAS certificate shall specify the role of the PSP as ‘account servicing’, ’payment initiation’; ‘account information’ and/or ‘issuing of card-based payment instruments’. As clarified in the  EBA Opinion on the use of eIDAS certificates under the RTS on SCA and CSC (EBA-Op-2018-7) , these four roles can be assigned to PSPs that have been authorised to provide the respective payment services as referred to in Annex I to PSD2. At the same time, TPPs should ensure that they comply with their respective obligations under Articles 66 and 67 of Directive 2015/2366/EU (PSD2) including the requirement to not access any data for purposes other than for the provision of the payment initiation service or, respectively, the account information service as explicitly requested by the payment service user.

Original source: European Banking Authority, Q&A ID 2022_6392

This Q&A is published by European Banking Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.

Similar Q&As

Certfication in relation to a Technical Service Provider (TSP)

Answered 2019-05-24

Qualified certificate under eIDAS for ASPSP

Answered 2019-06-14

Passporting and eIDAS certificates

Answered 2019-04-26

Authorisation for the provision of PIS and AIS on behalf of other legal entities belonging to the same corporate group / Autorizzazione ad offrire servizi di PIS e AIS per conto di altre Legal Entity appartenenti allo stesso Gruppo societario

Answered 2020-09-25

Scope of “additional registrations” as obstacles in the sense of Article 32(3) Delegated Regulation (EU) 2018/389

Answered 2021-12-17

More Q&As on this topic

Definition of "equivalent authentication procedure" for journeys initiated from a mobile application

Answered 2026-06-12

Obstacle assessment of a mandatory client segment selection screen in a redirection journey

Answered 2026-06-12

Clarification of the scope of the term "authentication procedures" in the context of the RTS and the EBA Opinion on obstacles

Answered 2026-06-12

SCA exception for Contactless only terminals (SoftPOS) in case of emergency

Answered 2025-10-03

the use of strong and widely recognized encryption techniques

Answered 2025-10-03

📋 Track EU financial regulation continuously

Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.

Start free trial → Learn more

14-day free trial. No credit card required.