OB-OBS-009PSR 44(1)(i)Prohibited obstacles

Not supporting every authentication procedure

What the text fixes

The dedicated interface must support every authentication procedure the ASPSP offers its customers.

Article: PSR 44(1)(i)Provisional numbering of the April 2026 compromise (Council doc. 8221/26). The final numbering will be added when the Official Journal publishes the text, without changing the id.
Who is bound: ASPSP
Who it is for: API, Product, Audit and pentest
Application: 21 months after entry into force, the general application date (Article 112).
Level 2: No EBA mandate covers this obligation.
Origin: RTS 2018/389, Art. 32(3); EBA Opinion of 4 June 2020 on obstacles

STET 1.6.3

Covered

The specification provides redirect, decoupled and one-factor embedded, and each bank states which ones it supports.

Handbook pages

Sources

Council doc. 8221/26, page 263

Checked on October 4, 2026

The entry as JSON

{
  "id": "OB-OBS-009",
  "article": "PSR 44(1)(i)",
  "alsoIn": [],
  "articleFinal": null,
  "actors": [
    "aspsp"
  ],
  "roles": [
    "api",
    "product",
    "pentest"
  ],
  "appliesAt": "T+21",
  "title": {
    "fr": "Ne pas supporter toutes les procédures d'authentification",
    "en": "Not supporting every authentication procedure",
    "es": "No admitir todos los procedimientos de autenticación",
    "pt-br": "Não suportar todos os procedimentos de autenticação"
  },
  "level1": {
    "fr": "L'interface dédiée doit supporter toutes les procédures d'authentification que l'ASPSP offre à ses clients.",
    "en": "The dedicated interface must support every authentication procedure the ASPSP offers its customers.",
    "es": "La interfaz dedicada debe admitir todos los procedimientos de autenticación que el ASPSP ofrece a sus clientes.",
    "pt-br": "A interface dedicada deve suportar todos os procedimentos de autenticação que o ASPSP oferece a seus clientes."
  },
  "level2": null,
  "origin": [
    {
      "act": "rts-2018-389",
      "articles": "32(3)"
    },
    {
      "act": "eba-opinion-2020"
    }
  ],
  "stet": {
    "1.6.3": {
      "status": "present",
      "note": {
        "fr": "La spécification prévoit la redirection, le découplé et l'embedded à un facteur, et chaque banque indique ceux qu'elle supporte.",
        "en": "The specification provides redirect, decoupled and one-factor embedded, and each bank states which ones it supports.",
        "es": "La especificación prevé redirección, desacoplado y embedded de un factor, y cada banco indica cuáles admite.",
        "pt-br": "A especificação prevê redirecionamento, desacoplado e embedded de um fator, e cada banco indica quais suporta."
      },
      "pages": [
        "framework/3-prerequisites-and-technical-details",
        "resources/authentication-approach"
      ]
    }
  },
  "verification": null,
  "sources": [
    {
      "document": "8221/26",
      "page": 263
    }
  ],
  "verifiedAt": "2026-10-04"
}

All obligations Markdown version