Meet PSD2 security and SCA requirements with less manual work
PSD2 (the second Payment Services Directive, Directive (EU) 2015/2366) is the EU law that governs payment services and the firms that provide them. It introduced strong customer authentication, regulated access to payment accounts for account information and payment initiation providers, and set rules on operational and security risk management and incident reporting. Its detailed security rules sit in the Regulatory Technical Standards on strong customer authentication and secure communication, Delegated Regulation (EU) 2018/389.
Is PSD2 right for your organisation?
PSD2 applies to payment service providers in the EU, including banks, payment institutions, e-money institutions, and account information and payment initiation service providers. Firms must meet it before and after authorisation by their national competent authority, and merchants and fintechs feel its effect through strong customer authentication on online payments. In the UK, the equivalent rules sit in the Payment Services Regulations 2017, supervised by the FCA.
It is a legal or regulatory requirement for organisations in scope.
- Official name
- Directive (EU) 2015/2366 on payment services in the internal market
- Issued by
- European Parliament and Council of the EU
- Applies since
- 13 January 2018 (SCA rules under the RTS from 14 September 2019)
- Applies to
- Payment service providers offering payment services in the EU
- Enforced by
- National competent authorities in each Member State, with EBA guidance
- Security standards
- RTS on strong customer authentication and secure communication, Delegated Regulation (EU) 2018/389
- Penalties
- Set by each Member State; must be effective, proportionate and dissuasive (Article 103)
- Type
- Law (mandatory)
- Region
- EU
- In OneClickComply
- Supported today
OneClickComply makes it simple
PSD2 is mapped in OneClickComply's control library and available on request, so payment firms can bring its security obligations into the same programme as ISO 27001, DORA or SOC 2. OneClickComply collects evidence for authentication, credential protection, encryption in transit and audit logging from your connected tools, monitors those controls for drift, and generates the security and incident policies that Article 95 and Article 96 expect.
Requirements covered
117 articles across 6 titles, with security obligations in Articles 95 to 98, supplemented by the 38 articles of the SCA and secure communication RTS (Delegated Regulation (EU) 2018/389).
Manual PSD2 vs. OneClickComply
- Reading PSD2 alongside the RTS, EBA guidelines and national rules to work out which security duties apply
- Screenshotting MFA, password and session settings across systems to prove authentication controls
- Keeping operational and security risk assessments current for the competent authority
- Tracking credential handling, encryption and logging controls in spreadsheets that go stale
- Repeating the same evidence work for PSD2, ISO 27001 and DORA as separate projects
- PSD2 security obligations mapped to clear controls, with expert guidance from Ask an Auditor
- Authentication and access evidence collected automatically from connected tools
- A living risk register and continuous monitoring that keep your risk assessment up to date
- Alerts when credential, encryption or logging controls drift, so gaps are fixed early
- One control set mapped across frameworks, so evidence collected once counts everywhere
Everything you need for PSD2
Evidence of multi-factor authentication and credential management collected from your identity provider
Encryption in transit and secure communication settings monitored across cloud and API services
Audit logging and traceability evidence gathered automatically for payment systems
AutoComplete policies for operational and security risk management and incident reporting
OneClickFix for supported misconfigurations, with each change logged as evidence
PSD2 controls mapped to ISO 27001, DORA and SOC 2 so evidence counts once across all of them
Three steps to PSD2 compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against PSD2 and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates PSD2-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
Payment Services Directive 2 (PSD2) requirements
The six PSD2 titles, the key security and account access articles of the Directive, and every article of the SCA and secure communication RTS, Delegated Regulation (EU) 2018/389 as amended.
| Reference | Requirement |
|---|---|
| PSD2 Title I | Subject matter, scope and definitions |
| PSD2 Title II | Payment service providers: authorisation, supervision and access |
| PSD2 Title III | Transparency of conditions and information requirements |
| PSD2 Title IV | Rights and obligations for providing and using payment services |
| PSD2 Title V | Delegated acts and regulatory technical standards |
| PSD2 Title VI | Final provisions |
| PSD2 Art. 66 | Access to payment accounts for payment initiation services |
| PSD2 Art. 67 | Access to payment account information for account information services |
| PSD2 Art. 94 | Data protection |
| PSD2 Art. 95 | Management of operational and security risks |
| PSD2 Art. 96 | Incident reporting |
| PSD2 Art. 97 | Authentication |
| PSD2 Art. 98 | Regulatory technical standards on authentication and communication |
| RTS Art. 1 | Subject matter |
| RTS Art. 2 | General authentication requirements |
| RTS Art. 3 | Review of the security measures |
| RTS Art. 4 | Authentication code |
| RTS Art. 5 | Dynamic linking |
| RTS Art. 6 | Requirements of the elements categorised as knowledge |
| RTS Art. 7 | Requirements of the elements categorised as possession |
Always check the official PSD2 text for the exact wording.
PSD2 FAQs
What is PSD2?
PSD2 is the second Payment Services Directive, Directive (EU) 2015/2366, which regulates payment services and payment service providers across the EU. It has applied since 13 January 2018 and introduced strong customer authentication, open banking style access for account information and payment initiation providers, and rules on security risk management and incident reporting. Each Member State transposes it into national law, so firms comply with their local implementing rules.
Who must comply with PSD2?
Payment service providers in the EU must comply with PSD2. That includes credit institutions, payment institutions, e-money institutions, account information service providers and payment initiation service providers. Merchants are not directly regulated by most of PSD2, but they are affected by strong customer authentication because their payment providers must apply it to online card and account payments unless an exemption applies.
What is strong customer authentication under PSD2?
Strong customer authentication (SCA) is authentication using at least two independent elements from knowledge, possession and inherence, such as a password plus a one-time code on a registered phone. Article 97 of PSD2 requires it when a payer accesses an account online, initiates an electronic payment or acts remotely in a way that implies fraud risk. Remote payments must also be dynamically linked to the amount and payee.
What are the PSD2 regulatory technical standards?
The PSD2 regulatory technical standards, Delegated Regulation (EU) 2018/389, set the detailed rules on strong customer authentication and common and secure open standards of communication. They have applied since 14 September 2019 and cover authentication codes, dynamic linking, SCA exemptions such as low-value and trusted beneficiary payments, protection of personalised security credentials, and the interfaces banks provide to third-party providers.
What are the penalties for breaching PSD2?
PSD2 does not set a single EU fine. Article 103 requires each Member State to set penalties for breaches of its national implementing law that are effective, proportionate and dissuasive, and allows authorities to publish them. Consequences can include fines, restrictions or withdrawal of authorisation by the national competent authority, and liability to refund customers for unauthorised payment transactions.
How does PSD2 relate to ISO 27001, GDPR and DORA?
PSD2 overlaps with all three. ISO 27001 controls such as access control, cryptography and logging support PSD2's security and credential requirements. Article 94 requires personal data processing to follow EU data protection law, meaning GDPR. Since January 2025, DORA sets ICT risk management and ICT incident reporting rules for most payment service providers, so many firms run PSD2 and DORA as one programme.
Does PSD2 apply in the UK after Brexit?
Yes, in retained form. The UK implemented PSD2 through the Payment Services Regulations 2017, which remain in force and are supervised by the FCA, and the FCA operates its own version of the strong customer authentication technical standards. UK firms serving EU customers may also need to meet the EU rules through an EU-authorised entity.
Does OneClickComply support PSD2?
PSD2 is mapped in OneClickComply's control library and available on request, rather than being a live self-serve framework today. Mapped controls cover areas such as authentication, credential protection, encryption in transit, audit logging and security assessments, and they share evidence with frameworks like ISO 27001 and DORA. Contact the team to enable it. OneClickComply does not certify PSD2 compliance, which is assessed by your regulator.
Further reading on PSD2
All articlesRelated standards
All standards- NIS2 DirectiveLaw · EU
- Germany BDSG (Federal Data Protection Act)Law · EU
- Italian Personal Data Protection Code (Codice Privacy)Law · EU
- Hungarian Information Act (Act CXII of 2011)Law · EU
- Austrian Data Protection Act (DSG)Law · EU
- Poland Act on the Protection of Personal DataLaw · EU
- Greece Data Protection Law (Law 4624/2019)Law · EU
- Belgian Data Protection Act (Act of 30 July 2018)Law · EU
Get PSD2 ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.