OB-OBS-008PSR 44(1)(h)Prohibited obstacles

More SCA than in the direct channel

What the text fixes

The ASPSP may not require strong customer authentication more often than when the user accesses the account or pays directly with it.

Article: PSR 44(1)(h)Provisional numbering of the April 2026 compromise (Council doc. 8221/26). The final numbering will be added when the Official Journal publishes the text, without changing the id.
Who is bound: ASPSP
Who it is for: Product, API, Audit and pentest
Application: 21 months after entry into force, the general application date (Article 112).
Level 2: No EBA mandate covers this obligation.
Origin: RTS 2018/389, Art. 32(3); EBA Opinion of 4 June 2020 on obstacles

STET 1.6.3

To review

The specification does not count SCAs. Token and consent lifetimes, set by each bank, decide how often the user authenticates.

Handbook pages

3. Prerequisites and technical details

Sources

Council doc. 8221/26, page 262

Checked on October 4, 2026

The entry as JSON

{
  "id": "OB-OBS-008",
  "article": "PSR 44(1)(h)",
  "alsoIn": [],
  "articleFinal": null,
  "actors": [
    "aspsp"
  ],
  "roles": [
    "product",
    "api",
    "pentest"
  ],
  "appliesAt": "T+21",
  "title": {
    "fr": "Plus de SCA que dans le canal direct",
    "en": "More SCA than in the direct channel",
    "es": "Más SCA que en el canal directo",
    "pt-br": "Mais SCA do que no canal direto"
  },
  "level1": {
    "fr": "L'ASPSP ne peut pas exiger plus d'authentifications fortes que lorsque l'utilisateur consulte son compte ou paie directement chez lui.",
    "en": "The ASPSP may not require strong customer authentication more often than when the user accesses the account or pays directly with it.",
    "es": "El ASPSP no puede exigir más autenticaciones reforzadas que cuando el usuario consulta su cuenta o paga directamente con él.",
    "pt-br": "O ASPSP não pode exigir mais autenticações fortes do que quando o usuário consulta a conta ou paga diretamente com ele."
  },
  "level2": null,
  "origin": [
    {
      "act": "rts-2018-389",
      "articles": "32(3)"
    },
    {
      "act": "eba-opinion-2020"
    }
  ],
  "stet": {
    "1.6.3": {
      "status": "review",
      "note": {
        "fr": "La spécification ne compte pas les SCA. Ce sont les durées de vie des tokens et des consentements, fixées par chaque banque, qui décident combien de fois l'utilisateur s'authentifie.",
        "en": "The specification does not count SCAs. Token and consent lifetimes, set by each bank, decide how often the user authenticates.",
        "es": "La especificación no cuenta las SCA. Son las duraciones de los tokens y de los consentimientos, que fija cada banco, las que deciden cuántas veces se autentica el usuario.",
        "pt-br": "A especificação não conta as SCAs. São as durações dos tokens e dos consentimentos, definidas por cada banco, que decidem quantas vezes o usuário se autentica."
      },
      "pages": [
        "framework/3-prerequisites-and-technical-details"
      ]
    }
  },
  "verification": null,
  "sources": [
    {
      "document": "8221/26",
      "page": 262
    }
  ],
  "verifiedAt": "2026-10-04"
}

All obligations Markdown version