Preparing for PSD2 technical requirements using RSA solutions

PSD2 will radically alter the EU financial services landscape by mandating stronger security controls while opening bank capabilities to new competitors through standardized, secure APIs. It introduces Third-Party Providers (TPPs)—notably Account Information Service Providers (AISPs) that aggregate account data and Payment Initiation Service Providers (PISPs) that can initiate payments directly between consumers and merchants—functions historically performed by banks. This expands consumer choice and competition, including from non-banking businesses, while increasing operational cost and risk for banks, which still bear capital reserve obligations that AISPs and PISPs do not.

Technically, PSD2 concentrates on two areas: Strong Customer Authentication (SCA) and Secure Communications. SCA follows the two-of-three factor model (something you know/have/are) and is driven by the well-known weaknesses of passwords. The text emphasizes a shift toward more usable, higher-assurance methods—especially mobile-based authenticators and smartphone biometrics—while predicting low consumer acceptance for SmartCards and USB tokens. PSD2’s Regulatory Technical Standards (RTS) also allow limited exceptions to SCA (e.g., transactions under €30, unattended kiosks, or where adequate transactional risk analysis is performed). Risk-adaptive authentication and transactional risk analysis can reduce the need for SCA on every transaction by evaluating user, device, and environmental signals and triggering step-up actions or denials when risk exceeds policy thresholds.

For Secure Communications, banks must expose APIs enabling AISPs and PISPs to retrieve account information and initiate payments, requiring new “TPP-facing” layers protected with defense-in-depth controls such as API gateways/WAFs, certificate-based trust, session authentication, authorization, and monitoring. PSD2 also explicitly requires attention to malware indicators during authentication and transaction sessions, motivating endpoint and server-side detection approaches plus integrated governance, risk, and compliance processes.

• EU PSD2 took effect in January 2018.
• Regulatory Technical Standards testing deadline is March 14, 2019.
• Regulatory Technical Standards implementation deadline is September 14, 2019.
• Strong Customer Authentication requires two of three factors: something you know, something you have, and something you are.
• PSD2 introduces Third-Party Providers, including Account Information Service Providers and Payment Initiation Service Providers.
• PSD2 RTS lists SCA exceptions that include transactions under €30 and unattended remote payment kiosks.
• Banks must expose APIs that allow AISPs to read account information and PISPs to initiate payments.
• Transaction monitoring mechanisms must consider signs of malware infection during authentication sessions.
• API security gateways can authorize methods and resources using SAML, OAuth2, XACML, or direct LDAP lookup.
• RSA Adaptive Authentication is described as deployed at over 3,000 organizations and supporting over one billion end users.

• “PSD2 will radically change the financial sector in the EU”
• “Opening core banking functions via API will be a challenge and a risk for banks under PSD2”
• “Banks will need to modernize their IT infrastructure and look to new business models to maintain and grow revenue.”
• “To reduce the risk of fraud, banks and TPPs must detect and prevent malware from interfering in financial transactions”
• “Banks and TPPs will need formal trust relationships established”
• “RSA SecurID supports a large number of authenticators”
• “Advanced risk engines capable of processing real-time fraud and threat intelligence will be essential for reducing risk under PSD2”
• “PSD2 will build on the success of the original PSD and introduce new requirements.”
• “PSD2 aims to foster competition in the financial sector, increase transactional security, and improve customer experiences.”
• “Complying with PSD2’s regulatory technical specifications almost certainly means building new capabilities, functions, and features.”