Definition
RTS (Regulatory Technical Standards) are binding technical standards drafted by the EBA and adopted by the Commission as a delegated regulation.
Where the directive sets out the "what", the RTS set out the "how", in a legally enforceable way.
RTS vs guidelines vs Q&A
The EBA produces three types of text with very different force:
- RTS — binding rules, adopted by the Commission and directly applicable; failing to comply exposes you to sanctions.
- Guidelines — recommended best practices, subject to NCAs' "comply or explain": highly influential, but not binding.
- Q&A and opinions — non-binding clarifications that shape interpretation.
The adoption process
- Mandate: the directive (e.g. PSD2, Art. 98) asks the EBA to draft an RTS.
- Public consultation: the EBA publishes a draft and the industry responds over 2–3 months.
- Submission: the EBA finalises it and sends it to the Commission.
- Adoption: the Commission adopts it as a delegated regulation, published in the OJEU, unless the Parliament or Council objects.
Expect 2–3 years between the mandate and effective application.
The key PSD2 RTS
- RTS-SCA (2018/389, applicable since September 2019): strong authentication, dynamic linking, exemptions, and common and secure communication (CSC) between TPPs and ASPSPs.
- Fraud RTS: the quarterly fraud-reporting template.
- Passporting RTS: notification from one NCA to another.
- PSP grouping RTS: cooperation conditions.
What RTS do not do
- They do not create obligations beyond the directive's mandate.
- They do not replace the directive: they specify it, they do not rewrite it.
- They are not negotiable: they are a regulation, applicable as is.
- They do not cover everything: for the grey areas, you need the guidelines, Q&A and NCA positions.
In the PSD2 ecosystem
The RTS are the operational toolbox: to know how to implement PSD2 (and later the PSR), it is in the RTS that you find the authoritative answer, not in the directive, which is deliberately higher-level.
Concrete examples
- RTS-SCA and checkout: it is what mandated 3DS2 over 3DS1 and defined the TRA exemptions that PSPs (Stripe, Adyen, Worldline) leverage for conversion.
- AISP renewal: the 2022 amendment to the RTS-SCA moved consent renewal from 90 to 180 days, improving retention for the likes of Bankin' and Linxo.
- Fraud reporting: any PSP above a certain volume sends its NCA a standardised file under the RTS — a data volume to plan for in architecture.
- Moving to the PSR: Delegated Regulation 2018/389 remains applicable alongside PSD2 until 21 months after the PSR enters into force. The EBA must deliver its draft new RTS on SCA and interfaces twelve months after that entry into force (art. 89, provisional numbering of the April 2026 compromise), which leaves nine months before application. The text does not say what happens to 2018/389 if these RTS are not ready in time. At the end of September 2026, the EBA had not opened any consultation.
- Monitoring: the EBA's "Single Rulebook" centralises all RTS, guidelines and Q&A in force.