Question ID
2025_7602
Legal act
Directive 2015/2366/EU (PSD2)
Topic
Strong customer authentication and common and secure communication (incl. access)
Article
Article: 98
Paragraph
Paragraph: 1
Subparagraph
Letter: d)
COM Delegated or Implementing Acts/RTS/ITS/GLs/Recommendations
Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
Article/Paragraph
Article: 32; Paragraph: 3
Name of institution / submitter
ZNPay a.s.
Country of incorporation / residence
Czech Republic
Type of submitter
Other
Subject matter
Obstacle assessment of a mandatory client segment selection screen in a redirection journey
Question

Does a mandatory step in a redirection journey, where a Payment Service User (PSU) must manually select their client segment (e.g., retail or corporate) on an intermediary screen (web interface) before being redirected to the ASPSP's authentication app, constitute an obstacle under Article 32(3) of the RTS, if such a step is not present when the PSU accesses their account directly via the ASPSP's native mobile application?

Background on the question

Article 32(3) of the Commission Delegated Regulation (EU) 2018/389 (RTS) requires Account Servicing Payment Service Providers (ASPSPs) to ensure their dedicated interface does not create obstacles. The EBA Opinion on obstacles (EBA/OP/2020/10), specifically paragraph 15, clarifies that the authentication journey in a redirection approach should not "create unnecessary friction or add unnecessary steps in the customer journey compared to the equivalent authentication procedure offered to PSUs when directly accessing their payment accounts".

In practice, some ASPSPs implement a redirection journey where the Payment Service User (PSU) is presented with an intermediary screen. On this screen, the PSU must manually select their client segment (e.g., "Retail Banking" or "Corporate Banking"). ASPSPs justify this step by claiming they cannot decide for the client which profile to use. This selection step is not present when the PSU logs directly into their native mobile banking application.

It is unclear whether this mandatory selection constitutes an "unnecessary step" and therefore an obstacle under the current RTS. This ambiguity is particularly acute in subsequent journeys, such as a Payment Initiation Service (PIS) from an already-linked account, where the context of the client's segment is already established, or in situation where the client only has one segment (eg. retail), making the selection screen entirely redundant and illogical.

Submission date
Final publishing date
Final answer

Article 32(3) of Commission Delegated Regulation (EU) 2018/389 requires account servicing payment service providers (ASPSPs) that have implemented a dedicated interface to ensure that the interface does not create obstacles to the provision of payment initiation and account information services.

As clarified in paragraphs 6, 7 and 15 of the EBA Opinion on obstacles under Article 32(3)of the RTS on SCA and CSC (EBA/OP/2020/10), in a redirection or decoupled approach the interaction between the payment service user (PSU) and the ASPSP should be minimised to what is necessary in order for the PSU to authenticate. The authentication procedure with the ASPSP as part of an AIS or PIS journey should not include unnecessary steps or require the PSU to provide unnecessary or superfluous information compared to the way in which the PSU can authenticate when directly accessing their payment accounts or initiating a payment with the ASPSP.

In circumstances where, when PSUs access their accounts directly via the ASPSP’s customer interface, authentication is performed without requiring the PSU to manually select a client segment, such a step introduced in a redirection journey does not appear necessary for the purpose of authentication. As such a step does not appear necessary and results in additional friction in the AIS or PIS journey compared to the way in which the PSU can authenticate when directly accessing their payment accounts or initiating a payment with the ASPSP, this constitutes an obstacle within the meaning of Article 32(3) of the RTS. 

Status
Final Q&A
Answer prepared by
Answer prepared by the EBA.

Disclaimer

The Q&A refers to the provisions in force on the day of their publication. The EBA does not systematically review published Q&As following the amendment of legislative acts. Users of the Q&A tool should therefore check the date of publication of the Q&A and whether the provisions referred to in the answer remain the same.