Topic starter
24/06/2026 10:19 pm
TL;DR: PSD2 requires EU and EEA payment organisations to open APIs to third-party providers, enforce strong customer authentication with two independent factors, and improve fraud transparency and reporting, according to 1Kosmos. For identity teams, the directive turns customer authentication, delegated access, and consent handling into governance problems, not just payment controls.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “What Is PSD2 Compliance? How Does It Affect Your Business?”.
By the numbers:
- Organizations that fail to comply with PSD2 risk financial penalties of up to 4% of annual returns.
Key questions
Q: How should IAM teams govern customer consent in PSD2 open banking flows?
A: Treat consent as a governed delegation event, not a one-time checkbox.
Q: Why does PSD2 require two independent authentication factors?
A: PSD2 uses two independent factors so a single compromise does not let an attacker complete a payment or account action.
Q: What breaks when open-banking access is not tightly governed?
A: When consent, authentication strength, and API security are managed separately, third-party access can drift beyond its intended scope.
Practitioner guidance
- Map PSD2 journeys to explicit delegation scopes Document which account information and payment initiation actions each third-party provider may perform, then align those scopes to customer consent and business approval paths.
- Verify factor independence in strong customer authentication Test whether the two required authentication elements are operationally independent in recovery, device binding, and transaction approval flows.
- Separate authentication evidence from fraud evidence Keep records that show who consented, who initiated the action, what was executed, and how any suspicious or unauthorised payment was handled.
Bottom line: PSD2 makes payment identity a governance problem by tying customer authentication, delegated access, and consent to regulated banking workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:57 am
PSD2 turns customer authentication into a delegated-access control problem. The directive is not just asking for stronger logins. It requires organisations to decide how customer consent, third-party access, and transaction approval are connected inside the access model. That makes payment security dependent on identity governance, not only on fraud tooling. Practitioners should treat every PSD2 control as part of a regulated delegation chain.
A question worth separating out:
Q: What should organisations retain for PSD2 audit and fraud review?
A: Keep consent records, transaction provenance, third-party identity details, authentication evidence, and fraud handling records together. Those artefacts let compliance, security, and operations reconstruct what happened and prove that a payment or account action was properly authorised under PSD2.
👉 Read our full editorial: PSD2 compliance and strong customer authentication in EU finance