OB-OBS-001PSR 44(1)(a)Prohibited obstacles

Blocking the use of the bank's credentials

What the text fixes

The ASPSP may not prevent TPPs from using the personalised security credentials it issued to its customers.

Article: PSR 44(1)(a)Provisional numbering of the April 2026 compromise (Council doc. 8221/26). The final numbering will be added when the Official Journal publishes the text, without changing the id.
Who is bound: ASPSP
Who it is for: API, Product, Audit and pentest
Application: 21 months after entry into force, the general application date (Article 112).
Level 2: No EBA mandate covers this obligation.
Origin: RTS 2018/389, Art. 32(3); EBA Opinion of 4 June 2020 on obstacles

STET 1.6.3

Covered

The TPP relies on the bank's authentication in redirect, decoupled or one-factor embedded mode (EMBEDDED-1-FACTOR).

Handbook pages

Sources

Council doc. 8221/26, page 261

Checked on October 4, 2026

The entry as JSON

{
  "id": "OB-OBS-001",
  "article": "PSR 44(1)(a)",
  "alsoIn": [],
  "articleFinal": null,
  "actors": [
    "aspsp"
  ],
  "roles": [
    "api",
    "product",
    "pentest"
  ],
  "appliesAt": "T+21",
  "title": {
    "fr": "Bloquer l'usage des identifiants de la banque",
    "en": "Blocking the use of the bank's credentials",
    "es": "Impedir el uso de las credenciales del banco",
    "pt-br": "Impedir o uso das credenciais do banco"
  },
  "level1": {
    "fr": "L'ASPSP ne peut pas empêcher les TPP d'utiliser les identifiants de sécurité personnalisés qu'il a délivrés à ses clients.",
    "en": "The ASPSP may not prevent TPPs from using the personalised security credentials it issued to its customers.",
    "es": "El ASPSP no puede impedir que los TPP usen las credenciales de seguridad personalizadas que ha emitido a sus clientes.",
    "pt-br": "O ASPSP não pode impedir os TPPs de usar as credenciais de segurança personalizadas que emitiu para seus clientes."
  },
  "level2": null,
  "origin": [
    {
      "act": "rts-2018-389",
      "articles": "32(3)"
    },
    {
      "act": "eba-opinion-2020"
    }
  ],
  "stet": {
    "1.6.3": {
      "status": "present",
      "note": {
        "fr": "Le TPP s'appuie sur l'authentification de la banque en redirection, en découplé ou en embedded à un facteur (`EMBEDDED-1-FACTOR`).",
        "en": "The TPP relies on the bank's authentication in redirect, decoupled or one-factor embedded mode (`EMBEDDED-1-FACTOR`).",
        "es": "El TPP se apoya en la autenticación del banco en modo redirección, desacoplado o embedded de un factor (`EMBEDDED-1-FACTOR`).",
        "pt-br": "O TPP usa a autenticação do banco em modo redirecionamento, desacoplado ou embedded de um fator (`EMBEDDED-1-FACTOR`)."
      },
      "pages": [
        "framework/3-prerequisites-and-technical-details",
        "resources/authentication-approach"
      ]
    }
  },
  "verification": null,
  "sources": [
    {
      "document": "8221/26",
      "page": 261
    }
  ],
  "verifiedAt": "2026-10-04"
}

All obligations Markdown version