Mobile Banking Services and SCA in the same app

In accordance with Article 9(1) of the Delegated Regulation (EU) 2018/389, payment service providers (PSPs) shall ‘ensure that the use of the elements of strong customer authentication referred to in Articles 6, 7 and 8 is subject to measures which ensure that, in terms of technology, algorithms and parameters, the breach of one of the elements does not compromise the reliability of the other elements’. In addition, Article 9(2) requires that PSPs and ‘shall adopt security measures, where any of the elements of strong customer authentication or the authentication code itself is used through a multi-purpose device, to mitigate the risk which would result from that multi-purpose device being compromised. Article 9 of the Delegated Regulation introduces requirements for the independence of authentication elements and their security. Article 9 does not restrict PSPs from carrying out mobile banking services and authentication of payment transactions through the same mobile applications. Finally, it should be noted that the requirements of Art. 9(3)(a) of the Delegated Regulation apply with regard to the two authentication elements. It is for payment service providers to ensure that the authentication approaches are compliant with these requirements.