Overcoming PSD2 Challenges with Onegini Connect

PSD2 is set to radically reshape EU financial services by mandating Strong Customer Authentication (SCA) and secure, standardized APIs that enable Third-Party Providers (TPPs) to access account data and initiate payments. By introducing new regulated roles—Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs)—PSD2 moves historically bank-controlled functions into a competitive ecosystem where non-banking firms can offer account aggregation, payment initiation, and related services. This shift increases consumer choice and pressures banks to modernize technology and business models while raising security exposure through expanded digital access.

SCA requires at least two factors from “something you know, have, or are,” accelerating adoption of user-friendly authenticators such as mobile push and smartphone biometrics, while less convenient tools like smart cards and USB tokens are expected to decline in consumer banking contexts. PSD2 also allows limited exemptions from SCA—such as low-value transactions and scenarios where transactional risk analysis (behavioral analytics) sufficiently reduces risk—creating demand for risk-adaptive authentication and granular policy controls.

On the infrastructure side, most EU banks (as of late 2017) were not prepared for large-scale programmatic access by external providers, implying substantial investment in API layers secured with defense-in-depth controls (e.g., firewalls, intrusion detection, web application firewalls, client authentication/authorization, and trust management). Banks and TPPs also need Consumer IAM (CIAM) capabilities at massive scale, supporting consent, fraud detection, KYC/AML uses, and high-volume login/transaction processing. The document positions Onegini Connect as a PSD2-ready CIAM and mobile security platform, highlighting strong authentication options, SDK-based integration, onboarding via external identities, analytics, and a case study (Bizcuit) demonstrating streamlined authentication across Dutch banks.

• EU PSD2 took effect in January 2018.
• The RTS deadline for testing components is March 14, 2019.
• The RTS deadline for implementation is September 14, 2019.
• PSD2 introduces Third-Party Providers (TPPs), including AISPs and PISPs.
• PSD2 defines strong authentication as using two of three factors: something you know, have, or are.
• PSD2 RTS lists SCA exceptions including transactions under €30 and remote unattended kiosks such as parking meters or transport stations.
• TPPs (AISPs and PISPs) have a minimal €50,000 reserve requirement.
• Standard PSD2 APIs are being refined in an open-source manner.
• As of late 2017, most EU banks were not prepared to allow programmatic access for many external financial service providers.
• Onegini was founded in 2011 and is headquartered in the Netherlands.

• “PSD2 is changing the financial sector in the EU”
• “Opening core banking functions via API will be a challenge and a risk for banks under PSD2”
• “Designed for consumers, PSD2 increases competition in the financial market”
• “CIAM will be a key ingredient for retaining and gaining financial customers in the post-PSD2 world”
• “TPPs must provide strong authentication to customers to meet PSD2 requirements”
• “PSD2 will revolutionize payments and financial services across the EU.”
• “PSD2 aims to foster competition in the financial sector, increase transactional security, and improve customer experiences.”
• “Banks will need modernize their IT infrastructure and to look to new business models to maintain and grow revenue.”
• “PSD2 is fast approaching, and the RTS will require major technology insertions for many banks and TPPs.”
• “A goal in creating a great user experience is to make the user registration and login as frictionless as possible.”