EU PSD2

Payment Services Directive 2 - Strong Customer Authentication, third-party access, open banking APIs.


Short name	PSD2
Region	Europe
Country or scope	European Union
Sector	Finance
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers PSD2

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 11 controls from Safeguard's control catalog for PSD2.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for PSD2 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`EU-PSD2-95-RISK` Operational and Security Risk Framework	Payment service providers must establish a framework to manage operational and security risks of the services they provide, which starts with an inventory of the software their payment systems comprise (Directive (EU) 2015/2366 Art. 95(1))	Scan
`EU-PSD2-95-MIT` Mitigation Measures and Control Mechanisms	The risk framework must include effective mitigation measures and control mechanisms, which for software means tracking component versions so weaknesses can be remediated (Directive (EU) 2015/2366 Art. 95(1))	Scan
`EU-PSD2-96-INC` Incident Reporting Readiness	Major operational or security incidents must be reported to the competent authority without undue delay, requiring rapid identification of which deployed components are implicated in an incident (Directive (EU) 2015/2366 Art. 96)	Scan
`EU-PSD2-97-SCA` Integrity of Authentication Software	Strong customer authentication must protect the confidentiality and integrity of authentication elements, so the software implementing SCA should carry verifiable integrity hashes (Directive (EU) 2015/2366 Art. 97)	Scan
`EU-PSD2-98-CSC` Common and Secure Standards	The regulatory technical standards on strong customer authentication and secure communication require open, common and secure standards between providers, and security documentation should likewise be in a standard machine-readable format (Directive (EU) 2015/2366 Art. 98 and RTS (EU) 2018/389)	Scan
`EU-PSD2-OUT` Outsourcing and Third-Party Accountability	Providers relying on agents or outsourced operational functions remain responsible for them, which requires knowing the supplier behind the software components used in payment services (Directive (EU) 2015/2366 outsourcing provisions, Art. 19-20; EBA outsourcing guidelines)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`PSD2-Art65`	Third-Party Provider Access to Payment Accounts
`PSD2-Art66`	Payment Initiation Service Providers
`PSD2-Art67`	Account Information Service Providers
`PSD2-Art73`	Liability for Unauthorised Transactions
`PSD2-Art74`	Refund Rights for Authorised Transactions
`PSD2-Art95`	Operational and Security Risk Management
`PSD2-Art96`	Major Incident Reporting
`PSD2-Art97`	Strong Customer Authentication (SCA)
`PSD2-Art98`	RTS on SCA and Secure Communication
`PSD2-Licensing`	PSP Authorisation and Registration
`PSD2-Safeguarding`	Safeguarding of Customer Funds

Policy templates

Written for PSD2:

PSD2 Strong Customer Authentication (SCA) Policy

And 22 from the standard set, adapted to PSD2.