Exemption from strong customer authentication

Do the revisions to Art.10 set out in Commission Delegated Regulation (EU) 2022/2360 of 3 August 2022 amending the regulatory technical standards laid down in Delegated Regulation (EU) 2018/389 as regards the 90-day exemption for account access mean that a payment service user or account information service provider is now limited to accessing only the account balance OR the transaction details for the last 90 days when availing of the revised exemption?

Article 10(1) of Delegated Regulation (EU) 2018/389 provided that, “Payment service providers shall be allowed not to apply strong customer authentication, subject to compliance with the requirements laid down in Article 2 and to paragraph 2 of this Article and, where a payment service user is limited to accessing either or both of the following items online without disclosure of sensitive payment data: (a) the balance of one or more designated payment accounts; (b) the payment transactions executed in the last 90 days through one or more designated payment accounts.   Commission Delegated Regulation (EU) 2022/2360 has revised Art.10 and introduced a new Art.10a which now provide:   Art.10(1) Payment service providers shall be allowed not to apply strong customer authentication, subject to compliance with the requirements laid down in Article 2, where a payment service user is accessing its payment account online directly, provided that access is limited to one of the following items online without disclosure of sensitive payment data: the balance of one or more designated payment accounts; the payment transactions executed in the last 90 days through one or more designated payment accounts.   Art. 10a(1) Payment service providers shall not apply strong customer authentication where a payment service user is accessing its payment account online through an account information service provider, provided that access is limited to one of the following items online without disclosure of sensitive payment data: (a) the balance of one or more designated payment accounts; (b) the payment transactions executed in the last 90 days through one or more designated payment accounts.   Under the original Art.10 exemption, a payment service user could access “either or both of”, meaning the account balance AND/OR transaction details whereas in both the revised Art.10 and the new Art.10a access is limited to “one of” the account balance or transaction details which would seem to restrict the levels of access enjoyed today. Did the Commission intend to introduce such a material change with the revised wording, and if so, why?