The European Banking Authority (EBA) has published the final draft of its regulatory technical standards for strong authentication under the revised Payment Services Directive (PSD2), relaxing several provisions and outlining new exemptions based on specific fraud rates.

The EBA said it had taken on board the raft of industry criticism received during consultations and will now allow payment service providers (PSPs) to choose when strong authentication is applied, providing fraud rates are kept below specific values.

“The EBA considered adding such an exemption in the original draft but was not able at the time to identify objective criteria that would have been legally acceptable,” it said in explanatory notes accompanying the standards.

“Nevertheless, the EBA agrees with the view expressed by these respondents that a risk-based approach, including the ability to conduct detailed TRA [transaction risk analysis] and fraud monitoring, is essential to achieve the objective under PSD2 of reducing overall fraud.”

The choice not to apply strong authentication can only be made if the PSP has a system for real-time risk scoring in place, and has used it to conclude the payment is low-risk