The European Banking Authority has provided welcome clarity on how to interpret incoming strong authentication rules, but still faces questions over how some aspects will work in practice — particularly where individual member states look to go their own way.