ForgeRock Identity Platform capabilities for Authentication under PSD2

PSD2 will significantly reshape EU financial services by increasing competition, improving transaction security, and enhancing customer experience. It enables new business entities—Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs)—to aggregate account data and initiate payments directly from bank accounts, functions historically controlled by banks. Because PSD2 is an EU Directive, it must be transposed into national laws, which may lead to differences in certification, enforcement, and penalties across jurisdictions, even as common Regulatory Technical Specifications (RTS) guide implementation.

From a technical standpoint, PSD2 drives change in two main areas: Strong Customer Authentication (SCA) and secure API exposure for third parties. SCA requires multi-factor authentication using two of three factors (knowledge, possession, inherence). The document argues passwords are fundamentally weak and operationally costly, making adoption of more usable authenticators likely—especially mobile push and smartphone biometrics—while less user-friendly hardware tokens are unlikely to gain consumer acceptance. PSD2 RTS also allows limited SCA exemptions, including low-value payments under €30, certain unattended terminals, and scenarios where transactional risk analysis is sufficiently performed.

To reduce friction, banks and TPPs can use risk-adaptive authentication: analyzing contextual and behavioral signals (e.g., geo-velocity, device fingerprinting, compromised network checks, transaction amount/type, user history) to decide when to step up authentication or deny transactions. PSD2 readiness requires banks in particular to modernize IT, implement CIAM at scale, manage consent aligned with GDPR, and integrate AML/KYC needs. ForgeRock Identity Platform is presented as a foundation for PSD2-aligned architectures, emphasizing policy-based “Authentication Trees,” broad protocol/authenticator support, and integrations with fraud and threat intelligence sources.

• EU PSD2 took effect in January 2018.
• The PSD2 Regulatory Technical Specifications set a testing deadline of March 14, 2019.
• The PSD2 Regulatory Technical Specifications set an implementation deadline of September 14, 2019.
• PSD2 defines Third-Party Providers (TPPs) including Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs).
• Strong Customer Authentication requires two of three factors: something you know, something you have, and something you are.
• PSD2 RTS lists SCA exemptions including transactions under €30 and certain remote unattended payment kiosks.
• PISPs must have €50,000 on hand plus a variable amount of indemnity insurance.
• PSD2 is Directive 2015/2366/EU and amends and succeeds Directive 2007/64/EC.
• EU Directives must be enacted into national law, while EU Regulations are binding legislative acts across all member states.
• ForgeRock was selected by the UK Open Banking Implementation Entity to provide a Reference Bank Application for Open Banking standards.

• “PSD2 will radically alter the financial services landscape.”
• “There is no such thing as a strong password.”
• “PSD2 will spur the adoption of these new authenticators in the quest to achieve SCA.”
• “Complying with PSD2’s regulatory technical specifications almost certainly means building new capabilities, functions, and features.”
• “Neither passwords nor Knowledge-Based Authentication (KBA) alone constitute SCA.”
• “CIAM will be a key ingredient for retaining and gaining financial customers in the post-PSD2 world”
• “Advanced risk engines capable of processing real-time fraud and threat intelligence will be essential for reducing risk under PSD2”
• “Banks will need to modernize their IT infrastructure and to look to new business models to maintain and grow revenue.”
• “The directive, when implemented, will allow consumers more freedom to choose how to handle their financial business.”
• “Utilize risk adaptive authentication for transactions that fall under the purview of SCA.”