Definition
RTS (Regulatory Technical Standards) are binding technical standards drafted by the EBA and adopted by the Commission as a delegated regulation.
Where the directive sets out the "what", the RTS set out the "how", in a legally enforceable way.
RTS vs guidelines vs Q&A
The EBA produces three types of text with very different force:
- RTS — binding rules, adopted by the Commission and directly applicable; failing to comply exposes you to sanctions.
- Guidelines — recommended best practices, subject to NCAs' "comply or explain": highly influential, but not binding.
- Q&A and opinions — non-binding clarifications that shape interpretation.
The adoption process
- Mandate: the directive (e.g. PSD2, Art. 98) asks the EBA to draft an RTS.
- Public consultation: the EBA publishes a draft and the industry responds over 2–3 months.
- Submission: the EBA finalises it and sends it to the Commission.
- Adoption: the Commission adopts it as a delegated regulation, published in the OJEU, unless the Parliament or Council objects.
Expect 2–3 years between the mandate and effective application.
The key PSD2 RTS
- RTS-SCA (2018/389, applicable since September 2019): strong authentication, dynamic linking, exemptions, and common and secure communication (CSC) between TPPs and ASPSPs.
- Fraud RTS: the quarterly fraud-reporting template.
- Passporting RTS: notification from one NCA to another.
- PSP grouping RTS: cooperation conditions.
What RTS do not do
- They do not create obligations beyond the directive's mandate.
- They do not replace the directive: they specify it, they do not rewrite it.
- They are not negotiable: they are a regulation, applicable as is.
- They do not cover everything: for the grey areas, you need the guidelines, Q&A and NCA positions.
In the PSD2 ecosystem
The RTS are the operational toolbox: to know how to implement PSD2 (and soon PSD3 + PSR), it is in the RTS that you find the authoritative answer, not in the directive, which is deliberately higher-level.
Concrete examples
- RTS-SCA and checkout: it is what mandated 3DS2 over 3DS1 and defined the TRA exemptions that PSPs (Stripe, Adyen, Worldline) leverage for conversion.
- AISP renewal: the 2022 amendment to the RTS-SCA moved consent renewal from 90 to 180 days, improving retention for the likes of Bankin' and Linxo.
- Fraud reporting: any PSP above a certain volume sends its NCA a standardised file under the RTS — a data volume to plan for in architecture.
- Anticipating PSD3: following EBA consultations as soon as they launch lets you influence future RTS before they are set in stone.
- Monitoring: the EBA's "Single Rulebook" centralises all RTS, guidelines and Q&A in force.