Meeting PSD2 Challenges with Ergon Airlock Suite

PSD2 is positioned as a radical reshaping of EU financial services, designed to increase competition, security, and customer choice by forcing banks to open access to account data and payment initiation through secure APIs. It introduces Third-Party Providers (TPPs)—notably Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs)—roles historically performed by banks, and expects new entrants from non-banking sectors. Technically, the directive concentrates pressure on two areas: Strong Customer Authentication (SCA) and secure communications through API exposure.

SCA is defined using the standard multi-factor model requiring two of three factors (knowledge, possession, inherence). The document emphasizes that passwords are inherently weak and operationally costly, driving adoption of stronger, more usable authenticators. It argues that consumer-friendly mobile approaches—push authentication and smartphone biometrics—are most likely to dominate, while enterprise-style SmartCards and USB tokens are unlikely to be accepted broadly by consumers or deployed by banks and TPPs. PSD2 also allows limited SCA exemptions, including low-value payments and cases where adequate “transactional risk analysis” (user behavioral analysis) can reduce the need for step-up authentication on every transaction.

On secure communications, banks must build and protect new TPP-facing API layers—often separate from legacy core systems—using defense-in-depth controls such as WAFs/API gateways, session and client authentication, authorization policies, and formal trust frameworks (commonly certificate-based). The paper frames API opening as both a major challenge and a risk amplifier, requiring new infrastructure, identity capabilities (CIAM at scale), and granular risk-based policies. It concludes by mapping these needs to Ergon’s Airlock Suite components (IAM/CIAM, WAF, and Login) and recommends immediate readiness assessments, gap analysis, and budgeting to meet late-2018 compliance timelines.

• PSD2 takes effect in January 2018.
• The Regulatory Technical Specifications for Strong Customer Authentication and Secure Communications go into effect in late 2018 or early 2019.
• PSD2 introduces Third-Party Providers, including AISPs and PISPs.
• Strong Customer Authentication requires two of three factors: something you know, something you have, and something you are.
• PSD2 RTS includes SCA exceptions for transactions under €30.
• PSD2 RTS includes SCA exceptions for remote, unattended payment kiosks such as parking meters or transport stations.
• PSD2 allows avoidance of SCA for every transaction when sufficient transactional risk analysis is performed.
• Banks must expose APIs that enable AISPs to read account information in real time and PISPs to initiate payments.
• Most banks in the EU were not prepared as of late 2017 to allow programmatic access to accounts by many external providers.
• Trust between banks and TPPs is commonly based on exchanging independently validated PKI certificates.

• “PSD2 will radically change the financial sector in the EU”
• “Opening core banking functions via API will be a challenge and a risk for banks under PSD2”
• “Designed for consumers, PSD2 increases competition in the financial market”
• “CIAM will be a key ingredient for retaining and gaining financial customers in the post-PSD2 world”
• “Banks and TPPs will need formal trust relationships established”
• “Airlock IAM supports a large number of authenticators”
• “Higher assurance authentication is fundamental to reducing risk of fraud and data loss.”
• “There is no such thing as a strong password.”
• “Authenticators with a higher degree of usability, such as mobile push and mobile biometrics apps, are likely to be preferred and become dominant.”
• “PSD2 is fast approaching, and the RTS will require major technology insertions for many banks and TPPs.”