Bank of Albania Regulation 29/2022 on Strong Customer Authentication and Secure Communication Standards

R E P U B L I C O F A L B A N I A BANK OF ALBANIA SUPERVISORY COUNCIL DECISION No. 29, dated 1.6.2022 APPROVAL OF REGULATION “ON STRONG CUSTOMER AUTHENTICATION AND COMMON, OPEN AND SECURE STANDARDS OF COMMUNICATION” In accordance with article 3, paragraph 3, article 12, letter “a”, and article 43, letter “c” of the law no. 8269, dated 23.12.1997 “On the Bank of Albania”, as amended; articles 90 and 91 of the law no. 55/2020, dated 30.4.2020 “On payment services”; the Supervisory Council of the Bank of Albania, having regard to the proposal from the Supervision Department, DECIDED:

1. To approve the regulation “On strong customer authentication and common, open and secure standards of communication”, thereof.
2. This decision applies to payment services providers.
3. Payment service providers until the entry into force of the regulation “On strong customer authentication and common, open and secure standards of communication”, shall take the measures and provide the necessary conditions for the implementation of the requirements laid down in this regulation.
4. The Bank of Albania's Supervision Department is responsible for observing the implementation of this decision.
5. The Governor's Office and the Research Department shall be responsible for the publication of this decision in the Official Journal of the Republic of Albania and in the Official Bulletin of the Bank of Albania, respectively. This decision shall enter into force 15 days following its publication in the Official Journal of the Republic of Albania. SECRETARY CHAIR Elvis ÇIBUKU Gent SEJKO

2 CHAPTER I GENERAL PROVISIONS Article 1 Object This Regulation establishes the requirements to be fulfilled by payment service providers, for the purpose of implementing security measures for: a) the application of the procedure of strong customer authentication, in accordance with article 90 of Law “On payment services”; b) the exemption from the application of the security requirements of strong customer authentication, based on the level of risk, the amount and the recurrence of the payment transaction and of the payment channel used for its execution; c) the protection of the confidentiality and the integrity of the payment service user's personalised security credentials; d) the establishment of common, open and secure standards for the communication between account servicing payment service providers, payment initiation service providers, account information service providers, payers, payees and other payment service providers in relation to the provision and use of payment services in application of Title IV of law “On payment services”. Article 2 Subjects This regulation shall apply on payment service providers, as referred to in article 3, paragraph 2 of law no.55, dated 30.04.2020 “On payment services”, which herein shall be referred to as law “On payment services”. Article 3 Legal basis This regulation is issued in compliance with article 3, paragraph 3, article 12, letter “a”, and article 43, letter “c” of law no. 8269, dated 23.12.1997 “On the Bank of Albania”, as amended; and articles 90 and 91 of law “On payment services”. Article 4 Definitions The terms used in this regulation shall have the same meaning as those defined in the law “On payment services”, law no. 9662, dated 18.12.2006 “On banks in the Republic of Albania”, as amended, which herein shall be referred to as the law “On banks”, and the law no. 107/2015 “On electronic identification and trust services”, as amended.

3 CHAPTER II GENERAL REQUIREMENTS ON AUTHENTICATION Article 5 General requirements on authentication

1. Payment service providers shall have transaction monitoring mechanisms in place that enable them to detect unauthorised or fraudulent payment transactions for the purpose of the implementation of the security measures referred to in letters “a” and “b” of article 1 of this regulation, and confirming the origin and integrity of electronic data. Those mechanisms shall be based on the analysis of payment transactions taking into account elements which are typical of the payment service user in the circumstances of a normal use of the personalised security credentials.
2. Payment service providers shall ensure that the transaction monitoring mechanisms take into account, at a minimum, the following risk-based factors: a) compromised or stolen authentication elements; b) the amount of each payment transaction; c) known fraud scenarios in the provision of payment services; d) signs of malware infection in any sessions of the authentication procedure; e) in case the access device or the software is provided by the payment service provider, a log of the use of the access device or the software provided to the payment service user and the abnormal use of the access device or the software. Article 6 Review of the security measures
3. The implementation of the security measures referred to in article 1 of this regulation shall be documented, periodically tested, evaluated and audited in accordance with the applicable legal framework of the payment service providers, by internal audit or external auditors with expertise in IT security and payments and operationally independent within or from the payment service provider.
4. The period between the audits referred to in paragraph 1 of this article, shall be determined taking into account the international auditing standards applicable to the payment service providers.
5. However, payment service providers that make use of the exemption referred to in article 22 of this regulation, shall be subject to an audit, at a minimum on a yearly basis, on the methodology, the model and the reported fraud rates. The auditor performing this audit shall have expertise in IT security and payments and be operationally independent within or from the payment service provider. During the first year of making use of the exemption under article 22 and at least every 3 years thereafter, or more frequently at the Bank of Albania’s request, this audit shall be carried out by an independent and qualified external auditor.
6. This audit shall present an evaluation and report on the compliance of the payment service provider's security measures with the requirements set out in this regulation. The entire report shall be made available to the Bank of Albania upon its request.

4 CHAPTER III SECURITY MEASURES FOR THE APPLICATION OF STRONG CUSTOMER AUTHENTICATION Article 7 Authentication code

1. Where payment service providers apply strong customer authentication in accordance with article 90, paragraph 1 of law “On payment services”, the authentication shall be based on two or more elements which are categorised as knowledge, possession and inherence and shall result in the generation of an authentication code.
2. The authentication code referred to in paragraph 1 of this article, shall be only accepted once by the payment service provider, when the payer uses the authentication code to access its payment account online, to initiate an electronic payment transaction or to carry out any action through a remote channel, which may imply a risk of payment fraud or other abuses.
3. For the purpose of paragraph 1 of this article, payment service providers shall adopt security measures ensuring that all the following requirements are met: a) no information on any of the elements referred to in paragraph 1 of this article can be derived from the disclosure of the authentication code; b) it is not possible to generate a new authentication code based on the knowledge of any other authentication code previously generated; c) the authentication code cannot be forged.
4. Payment service providers shall ensure that the authentication by means of generating an authentication code, includes all the following measures: a) where the authentication for remote access, remote electronic payments and any other actions through a remote channel which may imply a risk of payment fraud or other abuses has failed to generate an authentication code for the purposes of paragraph 1 of this article, it shall not be possible to identify which of the elements referred to in that paragraph was incorrect; b) the number of failed authentication attempts that can take place consecutively, after which the actions referred to in article 90, paragraph 1 of law “On payment services” shall be temporarily or permanently blocked, shall not exceed five within a given period of time; c) the communication sessions are protected against the capture of authentication data transmitted during the authentication and against manipulation by unauthorised parties in accordance with the requirements of chapter VI of this regulation; d) the maximum time without activity by the payer after being authenticated for accessing its payment account online shall not exceed 5 minutes.
5. Where the block referred to in paragraph 4, letter “b” of this article, is temporary, the duration of that block and the number of retries shall be established based on the characteristics of the service provided to the payer and all the relevant risks involved, taking into account, at a minimum, the factors referred to in article 5, paragraph 2 of this regulation. The payment service provider shall notify the payer before the block is made permanent. Where the block has been made permanent, a secure procedure shall be established allowing the payer to regain use of the blocked electronic payment instruments.

5 Article 8 Dynamic linking

1. Where payment service providers apply strong customer authentication in accordance with article 90, paragraph 2 of law “On payment services”, in addition to the requirements of article 7 of this regulation, they shall also adopt security measures that meet all the following requirements: a) the payer is made aware of the amount of the payment transaction and of the payee; b) the authentication code generated is specific to the amount of the payment transaction and the payee, agreed to by the payer when initiating the transaction; c) the authentication code accepted by the payment service provider corresponds to the original specific amount of the payment transaction and to the identity of the payee agreed to by the payer; d) any change to the amount or the payee results in the invalidation of the authentication code generated.
2. For the purposes of paragraph 1 of this article, payment service providers shall adopt security measures which ensure the confidentiality, authenticity and integrity of each of the following: a) the amount of the transaction and the payee throughout all of the phases of the authentication; b) the information displayed to the payer throughout all of the phases of the authentication, including the generation, transmission and use of the authentication code.
3. For the purposes of paragraph 1, letter “b” of this article and where payment service providers apply strong customer authentication in accordance with article 90, paragraph 2 of law “On payment services”, the following requirements for the authentication code shall apply: a) in relation to a card-based payment transaction for which the payer has given consent to the exact amount of the funds to be blocked, pursuant to article 68 of law “On payment services”, the authentication code shall be specific to the amount that the payer has given consent to be blocked and agreed to by the payer when initiating the transaction; b) in relation to payment transactions for which the payer has given consent to execute a batch of remote electronic payment transactions to one or several payees, the authentication code shall be specific to the total amount of the batch of payment transactions and to the specified payees. Article 9 Requirements of the elements categorised as “knowledge”
4. Payment service providers shall adopt measures to mitigate the risk that the elements of strong customer authentication categorised as “knowledge” are uncovered by, or disclosed to, unauthorised parties.
5. The use of those elements by the payer shall be subject to mitigation measures, in order to prevent their disclosure to unauthorised parties.

6 Article 10 Requirements of the elements categorised as “possession”

1. Payment service providers shall adopt measures to mitigate the risk that the elements of strong customer authentication categorised as “possession” are used by unauthorised parties.
2. The use of those elements by the payer shall be subject to measures designed to prevent replication of the elements. Article 11 Requirements on devices and software linked to elements categorised as “inherence”
3. Payment service providers shall adopt measures to mitigate the risk that the authentication elements categorised as “inherence” and read by access devices and software provided to the payer are uncovered by unauthorised parties. At a minimum, the payment service providers shall ensure that those access devices and software have a very low probability of an unauthorised party being authenticated as the payer.
4. The use by the payer of those elements shall be subject to measures ensuring that those devices and the software guarantee resistance against unauthorised use of the elements through access to the devices and the software. Article 12 Independence of the elements
5. Payment service providers shall ensure that the use of the elements of strong customer authentication, referred to in articles 9, 10 and 11 of this regulation, is subject to measures which ensure that, in terms of technology, algorithms and parameters, the breach of one of the elements does not compromise the reliability of the other elements.
6. Payment service providers shall adopt security measures, where any of the elements of strong customer authentication or the authentication code itself is used through a multi￾purpose device, to mitigate the risk which would result from that multi-purpose device being compromised.
7. For the purposes of paragraph 2 of this article, the measures shall include each of the following: a) the use of separated secure execution environments through the software installed inside the multi-purpose device; b) mechanisms to ensure that the software or device has not been altered by the payer or by a third party; c) where alterations have taken place, mechanisms to mitigate the consequences thereof.

7 CHAPTER IV EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION Article 13 Access to the payment account information directly with the account servicing payment service provider

1. Payment service providers may not to apply strong customer authentication, when requirements laid down in article 5 are fulfilled and with the exemption of cases provisioned in paragraph 2 of this article, when the payment service user is accessing its payment account online directly, provided that access is limited to at least one the following items online, without disclosure of sensitive payment data: a) the balance of one or more designated payment accounts; b) the payment transactions executed in the last 90 days, through one or more designated payment accounts.
2. By way of derogation from paragraph 1 of this article, payment service providers shall not be exempted from the application of strong customer authentication, where either of the following conditions is met: a) the payment service user is accessing online the information specified in paragraph 1 of this article for the first time; b) more than 180 days have elapsed since the last time the payment service user accessed online the information specified in paragraph 1 of this article and strong customer authentication was applied. Article 14 Access to the payment account information through an account information service provider
3. Payment service providers shall not apply strong customer authentication, with the exemption of cases provisioned in paragraph 2 of this article, where a payment service user is accessing its payment account online through an account information service provider, provided that access is limited to at least one of the following items online, without disclosure of sensitive payment data: a) the balance of one or more designated payment accounts; b) the payment transactions executed in the last 90 days, through one or more designated payment accounts.
4. By way of derogation from paragraph 1 of this article, payment service providers shall apply strong customer authentication, where either of the following conditions is met: a) the payment service user is accessing online the information specified in paragraph 1 of this article, for the first time through the account information service provider; b) more than 180 days have elapsed since the last time the payment service user accessed online the information specified in paragraph 1 of this article, through the account information service provider and strong customer authentication was applied.
5. By way of derogation from paragraph 1 of this article, payment service providers shall apply strong customer authentication, when a payment service user is accessing its payment account online through an account information service provider and the payment service provider has objectively justified and duly evidenced reasons relating

8 to unauthorised or fraudulent access to the payment account. In such a case, the payment service provider shall document and duly justify to the Bank of Albania, upon to its request, the reasons for applying strong customer authentication. 4. Account servicing payment service providers that offer a dedicated interface as referred to in article 35 of this regulation, shall not be required to implement the exemption referred to in paragraph 1 of this article for the purpose of the contingency mechanism referred to in article 37, paragraph 4, where they do not apply the exemption in article 13 of this regulation, in the direct interface used for authentication and communication with their payment service users. Article 15 Contactless payments at point of sale

1. Payment service providers may not apply strong customer authentication, subject to compliance with the requirements laid down in article 5 of this regulation, where the payer initiates a contactless electronic payment transaction, provided that the following conditions are met: a) the individual amount of the contactless electronic payment transaction does not exceed the equivalent amount in lek of 50 euros; and b) the cumulative amount of previous contactless electronic payment transactions initiated by means of a payment instrument with a contactless functionality from the date of the last application of strong customer authentication, does not exceed the equivalent amount in lek of 150 euros; or c) the number of consecutive contactless electronic payment transactions initiated via the payment instrument offering a contactless functionality since the last application of strong customer authentication, does not exceed five. Article 16 Unattended terminals for transport fares and parking fees Payment service providers may not apply strong customer authentication, subject to compliance with the requirements laid down in article 5 of this regulation, where the payer initiates an electronic payment transaction at an unattended payment terminal for the purpose of paying a transport fare/ticket or a parking fee. Article 17 Trusted beneficiaries
2. Payment service providers shall apply strong customer authentication when a payer creates or amends a list of trusted beneficiaries through the payer's account servicing payment service provider.
3. Payment service providers may not apply strong customer authentication, subject to compliance with the general authentication requirements, where the payer initiates a payment transaction and the payee is included in a list of trusted beneficiaries, previously created by the payer.

9 Article 18 Recurring transactions

1. Payment service providers shall apply strong customer authentication when a payer creates, amends, or initiates for the first time, a series of recurring transactions with the same amount and with the same payee.
2. Payment service providers may not apply strong customer authentication, subject to compliance with the general authentication requirements, for the initiation of all subsequent payment transactions included in the series of payment transactions referred to in paragraph 1 of this article. Article 19 Credit transfers between accounts held by the same natural or legal person Payment service providers may not apply strong customer authentication, subject to compliance with the requirements laid down in article 5, where the payer initiates a credit transfer in circumstances where the payer and the payee are the same natural or legal person and both payment accounts are held by the same account servicing payment service provider. Article 20 Low-value transactions
3. Payment service providers may not apply strong customer authentication, where the payer initiates a remote electronic payment transaction, provided that the following conditions are met: a) the amount of the remote electronic payment transaction does not exceed the equivalent amount in lek of 30 euros; and b) the cumulative amount of previous remote electronic payment transactions initiated by the payer since the last application of strong customer authentication, does not exceed the equivalent amount in lek of 100 euros; or c) the number of previous remote electronic payment transactions initiated by the payer since the last application of strong customer authentication, does not exceed five consecutive individual remote electronic payment transactions. Article 21 Secure corporate payment processes and protocols Payment service providers may not apply strong customer authentication, in respect of legal persons initiating electronic payment transactions through the use of dedicated payment processes or protocols, that are only made available to payers who are not consumers, where the Bank of Albania assesses that those processes or protocols guarantee at least equivalent levels of security to those provided for by law “On payment services”. Article 22 Transaction risk analysis
4. Payment service providers may not apply strong customer authentication, when the payer initiates a remote electronic payment transaction identified by the payment service provider as posing a low level of risk according to the transaction monitoring mechanisms referred to in article 5 and in paragraph 2, letter “c” of this article.

10 2. An electronic payment transaction referred to in paragraph 1 of this article shall be considered as posing a low level of risk, where all the following conditions are met: a) the fraud rate for that type of transaction, reported by the payment service provider and calculated in accordance with article 23 of this regulation, is equivalent to or below the reference fraud rates specified in the table set out in the Annex 1 of this regulation for “remote electronic card-based payments” and “remote electronic credit transfers”; b) the amount of the transaction does not exceed the relevant exemption threshold value (“ETV”) specified in Annex 1 of this regulation; c) payment service providers as a result of performing a real time risk analysis have not identified any of the following: i. abnormal spending or behavioural pattern of the payer; ii. unusual information about the payer's device/software access; iii. signs of malware infection in any session of the authentication procedure; iv. known fraud scenario in the provision of payment services; v. abnormal location of the payer; vi. high-risk location of the payee. 3. Payment service providers that intend to exempt electronic remote payment transactions from strong customer authentication on the ground that they pose a low risk, shall take into account at a minimum, the following risk-based factors: a) the previous spending patterns of the individual payment service user; b) the payment transaction history of each of the payment service provider's payment service users; c) the location of the payer and of the payee at the time of the payment transaction in cases where the access device or the software is provided by the payment service provider; d) the identification of abnormal payment patterns of the payment service user in relation to the user's payment transaction history. 4. The payment service provider shall combine all those risk-based factors, as provided in paragraph 3 of this article, into an aggregated risk assessment for each individual transaction, to determine whether a specific payment should be allowed without strong customer authentication. Article 23 Calculation of fraud rates

1. The payment service provider, for each type of transaction provisioned in Annex 1 of this regulation, shall ensure that the overall fraud rates covering both payment transactions authenticated through strong customer authentication and those executed under any of the exemptions referred to in articles 17 to 22 of this regulation, are equivalent to, or lower than, the reference fraud rate for the same type of payment transaction indicated in Annex 1 of this regulation.
2. The overall fraud rate for each type of transaction shall be calculated as the total value of unauthorised or fraudulent remote electronic transactions, whether the funds have been recovered or not, divided by the total value of all remote transactions for the same type of transactions, whether authenticated with the application of strong customer

11 authentication or executed under any exemption referred to in articles 17 to 22 of this regulation, on a rolling quarterly basis (90 days). 3. The calculation of the fraud rates and resulting figures shall be assessed by the audit review, referred to in article 6, paragraph 3 of this regulation, which shall ensure that they are complete and accurate. 4. The methodology and any model, used by the payment service provider to calculate the fraud rates, as well as the fraud rates themselves, shall be adequately documented and made available to the Bank of Albania, upon its request. Article 24 Cessation of exemptions based on transaction risk analysis

1. Payment service providers that make use of the exemption referred to in article 22 of this regulation, shall immediately report to the Bank of Albania where one of their monitored fraud rates, for any type of payment transactions provisioned in Annex 1 of this regulation, exceeds the applicable reference fraud rate and shall provide to the Bank of Albania a description of the measures that they intend to adopt to restore compliance of their monitored fraud rate with the applicable reference fraud rates.
2. Payment service providers shall immediately cease to make use of the exemption referred to in article 22 of this regulation, for any type of payment transactions indicated in Annex 1 of this regulation, in the specific exemption threshold range where their monitored fraud rate exceeds for two consecutive quarters the reference fraud rate applicable for that payment instrument or type of payment transaction in that exemption threshold range.
3. Following the cessation of the exemption referred to in article 22 of this regulation, in accordance with paragraph 2 of this article, payment service providers shall not use that exemption again, until their calculated fraud rate equals to, or is below, the reference fraud rates applicable for that type of payment transaction in that exemption threshold range for one quarter.
4. Where payment service providers intend to make use again of the exemption referred to in article 22 of this regulation, before making use again of the exemption, they shall notify the Bank of Albania in a reasonable timeframe and shall provide evidence of the restoration of compliance of their monitored fraud rate with the applicable reference fraud rate for that exemption threshold range, in accordance with paragraph 3 of this article. Article 25 Monitoring
5. In order to make use of the exemptions set out in articles 13 to 22 of this regulation, payment service providers shall record and monitor the following data for each type of payment transactions, with a breakdown for both remote and non-remote payment transactions, at least on a quarterly basis: a) the total value of unauthorised or fraudulent payment transactions, in accordance with article 57, paragraph 4 of law “On payment services”, the total value of all payment transactions and the resulting fraud rate, including a breakdown of payment transactions initiated through strong customer authentication and under each of the exemptions;

12 b) the average transaction value, including a breakdown of payment transactions initiated through strong customer authentication and under each of the exemptions; c) the number of payment transactions where each of the exemptions was applied and their percentage in respect of the total number of payment transactions. 2. Payment service providers shall make available to the Bank of Albania, upon its request, the results of the monitoring in accordance with paragraph 1 of this article. CHAPTER V CONFIDENTIALITY AND INTEGRITY OF THE PAYMENT SERVICE USERS’ PERSONALISED SECURITY CREDENTIALS Article 26 General requirements

1. Payment service providers shall ensure the confidentiality and integrity of the personalised security credentials of the payment service user, including authentication codes, during all phases of the authentication.
2. For the purposes of paragraph 1 of this article, payment service providers shall ensure that each of the following requirements is met: a) personalised security credentials are masked when displayed and are not readable in their full extent when input by the payment service user during the authentication; b) personalised security credentials in data format, as well as cryptographic materials related to the encryption of the personalised security credentials are not stored in plain text; c) secret cryptographic material is protected from unauthorised disclosure.
3. Payment service providers shall fully document the process related to the management of cryptographic material used to encrypt or otherwise render unreadable the personalised security credentials.
4. Payment service providers shall ensure that the processing and routing of personalised security credentials and of the authentication codes generated in accordance with Chapter III of this regulation, take place in secure environments in accordance with strong and widely recognised standards. Article 27 Creation and transmission of personalised security credentials
5. Payment service providers shall ensure that the creation of personalised security credentials is performed in a secure environment.
6. Payment service providers shall take the necessary measures to mitigate the risks of unauthorised use of the personalised security credentials and of the authentication devices and software, following their loss, theft or copying before their delivery to the payer.

13 Article 28 Association with the payment service user

1. Payment service providers shall ensure that only the payment service user is associated, in a secure manner, with the personalised security credentials, the authentication devices and software.
2. For the purposes of paragraph 1 of this article, payment service providers shall ensure that each of the following requirements is met: a) the association of the payment service user's identity with personalised security credentials, authentication devices and software is carried out in secure environments under the payment service provider's responsibility, comprising at least the payment service provider's premises, the internet environment provided by the payment service provider or other similar secure websites used by the payment service provider and its automated teller machine (ATM) services, and taking into account risks associated with devices and underlying components used during the association process that are not under the responsibility of the payment service provider; b) the association by means of a remote channel of the payment service user's identity with the personalised security credentials and with authentication devices or software is performed using strong customer authentication. Article 29 Delivery of credentials, authentication devices and software
3. Payment service providers shall ensure that the delivery of personalised security credentials, authentication devices and software to the payment service user is carried out in a secure manner, designed to address the risks related to their unauthorised use due to their loss, theft or copying.
4. For the purposes of paragraph 1 of this article, payment service providers shall at least apply the following measures: a) effective and secure delivery mechanisms, ensuring that the personalised security credentials, authentication devices and software are delivered to the legitimate payment service user; b) mechanisms that allow the payment service provider to verify the authenticity of the authentication software delivered to the payment services user, by means of the internet; c) arrangements ensuring that, where the delivery of personalised security credentials is executed outside the premises of the payment service provider or through a remote channel: i. no unauthorised party can obtain more than one feature of the personalised security credentials, the authentication devices or software when delivered through the same channel; ii. the delivered personalised security credentials, authentication devices or software require activation before usage; d) arrangements ensuring that, in cases where the personalised security credentials, the authentication devices or software have to be activated before their first use, the activation shall take place in a secure environment in accordance with the association procedures referred to in article 28 of this regulation.

14 3. Payment service providers shall inform the legitimate payment service user on the importance of personalised security credentials confidentiality from third parties. Article 30 Renewal of personalised security credentials Payment service providers shall ensure that the renewal or re-activation of personalised security credentials are in compliance with the procedures for the creation, association and delivery of the credentials and of the authentication devices, as provisioned in articles 27, 28 and 29 of this regulation. Article 31 Destruction, deactivation and revocation Payment service providers shall ensure that they have effective processes in place to apply each of the following security measures: a) the secure destruction, deactivation or revocation of the personalised security credentials, authentication devices and software; b) where the payment service provider distributes reusable authentication devices and software, the secure re-use of a device or software is established, documented and implemented before making it available to another payment services user; c) the deactivation or revocation of information related to personalised security credentials stored in the payment service provider's systems and databases and, where relevant, in public repositories. CHAPTER VI COMMON, OPEN AND SECURE STANDARDS OF COMMUNICATION SECTION I GENERAL REQUIREMENTS FOR COMMUNICATION Article 32 Requirements for secure electronic identification procedures

1. Payment service providers shall ensure secure electronic identification, in accordance with the stipulations laid down in the legislation on electronic identification and trust services, when communicating between the payer's device and the payee's acceptance devices for electronic payments, including but not limited to payment terminals.
2. Payment service providers shall ensure that the risks of misdirection of communication to unauthorised parties in mobile applications and other payment services users’ interfaces offering electronic payment services are effectively mitigated. Article 33 Traceability
3. Payment service providers shall have processes in place which ensure that all payment transactions and other interactions with the payment services user, with other payment service providers and with other entities, including merchants, in the context of the

15 provision of the payment service are traceable, ensuring knowledge ex post of all events relevant to the electronic transaction in all the various stages. 2. For the purposes of paragraph 1 of this article, payment service providers shall ensure that any communication session established with the payment services user, other payment service providers and other entities, including merchants, relies on each of the following: a) a unique identifier of the session; b) security mechanisms for the detailed logging of the transaction, including transaction number, timestamps and all relevant transaction data; c) qualified timestamps, as provided for in the legislation on electronic identification and trust services, which shall be based on a unified time-reference system and which shall be synchronised according to an official time signal. SECTION II SPECIFIC REQUIREMENTS FOR THE COMMON, OPEN AND SECURE STANDARDS OF COMMUNICATION Article 34 General obligations for access interfaces

1. Account servicing payment service providers that offer to a payer a payment account that is accessible online, shall have in place at least one interface which meets each of the following requirements: a) account information service providers, payment initiation service providers and payment service providers issuing card-based payment instruments are able to identify themselves towards the account servicing payment service provider; b) account information service providers are able to communicate securely to request and receive information on one or more designated payment accounts and associated payment transactions; c) payment initiation service providers are able to communicate securely to initiate a payment order from the payer's payment account and receive all information on the initiation of the payment transaction and all information accessible to the account servicing payment service providers regarding the execution of the payment transaction.
2. For the purposes of authentication of the payment service user, the interface referred to in paragraph 1 of this article, shall allow the account information service provider and the payment initiation service provider to rely on all the authentication procedures provided by the account servicing payment service provider to the payment service user.
3. The interface as referred to in paragraph 1 of this article shall at least meet all of the following requirements: a) a payment initiation service provider or an account information service provider shall be able to instruct the account servicing payment service provider to start the authentication based on the consent of the payment service user; b) communication sessions between the account servicing payment service provider, the account information service provider, the payment initiation service provider

16 and any payment service user concerned, shall be established and maintained throughout the authentication; c) the integrity and confidentiality of the personalised security credentials and of authentication codes transmitted by or through the payment initiation service provider or the account information service provider, shall be ensured. 4. Account servicing payment service providers shall ensure that their interfaces follow standards of communication applicable in the European Union. 5. Account servicing payment service providers shall also ensure that the technical specification of any of the interfaces is documented specifying a set of protocols and tools needed by payment initiation service providers, account information service providers and payment service providers issuing card-based payment instruments for allowing their software and applications to interoperate with the systems of the account servicing payment service providers. 6. Account servicing payment service providers, at least 6 months before the target date for the market launch of the access interface, shall make the documentation available, at no charge, upon request by licenced or registered payment initiation service providers, account information service providers and payment service providers issuing card-based payment instruments, or payment service providers that have applied to the Bank of Albania for the relevant licence or registration, and shall make a summary of the documentation publicly available on their website. 7. In addition to paragraphs 4-6 of this article, account servicing payment service providers shall ensure that, except for emergency situations, arising out of natural disasters, human error or intended interventions, any change to the technical specification of their interface is made available to licenced or registered payment initiation service providers, account information service providers and payment service providers issuing card-based payment instruments, or payment service providers that have applied to the Bank of Albania for the relevant licence or registration, in advance as soon as possible and not less than 3 months before the change is implemented. 8. Payment service providers shall document emergency situations where changes were implemented and make the documentation available to the Bank of Albania, upon its request. 9. Account servicing payment service providers shall make available a testing facility, including support, for connection and functional testing, to enable licenced or registered payment initiation service providers, payment service providers issuing card￾based payment instruments and account information service providers, or payment service providers that have applied to the Bank of Albania for the relevant licence or registration, to test their software and applications used for offering a payment service to users. This testing facility should be made available at least 6 months before the target date for the market launch of the access interface. However, no sensitive information shall be shared through the testing facility. 10. The Bank of Albania monitors the account servicing payment service providers to comply at all times with the obligations included in these standards in relation to the interface(s) that they put in place. In the event that an account servicing payment services provider fails to comply with the requirements for interfaces laid down in these standards, the Bank of Albania shall monitor that the provision of payment initiation service and account information service is not prevented or disrupted, to the extent that

17 the respective providers of such services comply with the conditions defined under article 37, paragraph 5 of this regulation. Article 35 Access interface options Account servicing payment service providers shall establish the interface(s) referred to in article 34 of this regulation, by means of a dedicated interface or by allowing the use by the payment service providers referred to in article 34, paragraph 1 of this regulation, of the interfaces used for authentication and communication with the account servicing payment service provider's payment services users. Article 36 Obligations for a dedicated interface

1. Subject to compliance with article 34 and 35 of this regulation, account servicing payment service providers that have put in place a dedicated interface shall ensure that the dedicated interface offers at all times the same level of availability and performance, including support, as the interfaces made available to the payment service user for directly accessing its payment account online.
2. Account servicing payment service providers that have established (put in place) a dedicated interface shall define transparent key performance indicators and service level targets, at least as stringent as those set for the interface used by their payment service users, both in terms of availability and of data provided in accordance with article 40 of this regulation. Those interfaces, indicators and targets shall be monitored by the Bank of Albania and tested by account servicing payment service providers through stress-tests.
3. Account servicing payment service providers that have put in place a dedicated interface shall ensure that this interface does not create obstacles to the provision of payment initiation and account information services. Such obstacles, may include, among others, preventing the use by payment service providers referred to in article 34, paragraph 1 of this regulation, of the credentials issued by account servicing payment service providers to their customers, imposing redirection to the account servicing payment service provider's authentication or other functions, requiring additional licencing and registrations in addition to those provided for in articles 13 and 16 of law “On payment services”, or requiring additional checks of the consent given by payment service users to providers of payment initiation and account information services.
4. For the purposes of paragraphs 1 and 2 of this article, account servicing payment service providers shall monitor the availability and performance of the dedicated interface. Account servicing payment service providers shall publish on their website quarterly statistics on the availability and performance of the dedicated interface and of the interface used by its payment service users. Article 37 Contingency measures for a dedicated interface
5. Account servicing payment service providers shall include, in the design of the dedicated interface, a strategy and plans for contingency measures for the event that the interface does not perform in compliance with article 36 of this regulation, that

18 there is unplanned unavailability of the interface or that there is a systems’ breakdown. Unplanned unavailability or a systems’ breakdown may be presumed to have arisen when five consecutive requests for access to information for the provision of payment initiation services or account information services, are not replied to within 30 seconds. 2. Contingency measures shall include communication plans to inform payment service providers making use of the dedicated interface of measures to restore the system and a description of the immediately available alternative options payment service providers may have during this time. 3. Both the account servicing payment service provider and the payment service providers referred to in article 34, paragraph 1 of this regulation, shall report to the Bank of Albania without delay, problems with dedicated interfaces as described in paragraph 1 of this article. 4. As part of a contingency mechanism, payment service providers referred to in article 34, paragraph 1 of this regulation, shall be allowed to make use of the interfaces made available to the payment service users for the authentication and communication with their account servicing payment service provider, until the dedicated interface is restored to the level of availability and performance provided for in article 36 of this regulation. 5. Referred to the mechanism provided in paragraph 4 of this article, account servicing payment service providers shall ensure that the payment service providers referred to in article 34, paragraph 1 of this regulation, can be identified and can rely on the authentication procedures, provided by the account servicing payment service provider to the payment service users. Where the payment service providers referred to in article 34, paragraph 1 of this regulation, make use of the interface referred to in paragraph 4 of this article, they shall: a) take the necessary measures to ensure that they do not access, store or process data for purposes other than for the provision of the service as requested by the payment service user; b) continue to comply with the obligations following from article 59, paragraph 3 and article 60, paragraph 2 of law “On payment services”; c) log the data that are accessed through the interface operated by the account servicing payment service provider for its payment service users, and provide the log files to the Bank of Albania, upon its request and without undue delay; d) make available to the Bank of Albania, upon its request and without undue delay, the reasons on the use of the interface made available to the payment service users for directly accessing its payment account online; e) inform the account servicing payment service provider accordingly. 6. The Bank of Albania, may exempt the account servicing payment service providers that have opted for a dedicated interface from the obligation to set up the contingency mechanism described under paragraph 4 of this article, where the dedicated interface meets all of the following conditions: a) it complies with all the obligations for dedicated interfaces as set out in article 36 of this regulation; b) it has been designed and tested in accordance with article 34, paragraph 9 to the satisfaction of the payment service providers referred to therein;

19 c) it has been widely used for at least 3 months by payment service providers to offer account information services, payment initiation services and to provide confirmation on the availability of funds for card-based payments; d) any problem related to the dedicated interface has been resolved without undue delay. 7. The Bank of Albania shall revoke the exemption referred to in paragraph 6 of this article, where the conditions provisioned in letters “a” and “d” are not met by the account servicing payment service providers for more than 2 consecutive calendar weeks. The Bank of Albania shall ensure that the account servicing payment service providers establish, within the shortest possible time and at the latest within 2 months, the contingency mechanism referred to in paragraph 4 of this article. Article 38 Qualified electronic certificates

1. For the purpose of secure electronic identification, as referred to in article 34, paragraph 1, letter “a” of this regulation, payment service providers shall rely on qualified certificates for electronic seals or for website authentication, as referred to in the legislation on electronic identification and trust services.
2. For the purposes of this regulation, the unique identification number or the registration number as registered in the official records, provisioned in the legislation on electronic identification and trust services, shall be the licence or the decision’s number of the payment service provider issuing card-based payment instruments, the account information service provider and payment initiation service provider, including account servicing payment service providers providing such services, registered in the public register of the Bank of Albania, pursuant to article 16 of law “On payment services” and to article 128 of the law “On banks”.
3. For the purposes of this regulation, qualified certificates for electronic seals or for website authentication referred to in paragraph 1 of this article, shall comply with the requirements set forth in the legislation on electronic identification and trust services, and include in a language customary in the sphere of international finance, additional specific attributes in relation to each of the following: a) the role of the payment service provider, which maybe one or more of the following: i. account servicing; ii. payment initiation; iii. account information; iv. issuing of card-based payment instruments; b) the Bank of Albania, as the authority where the payment service provider is registered.
4. The attributes referred to in paragraph 3 of this article, shall not affect the interoperability and recognition of qualified certificates for electronic seals or website authentication.

20 Article 39 Security of communication session

1. Account servicing payment service providers, payment service providers issuing card￾based payment instruments, account information service providers and payment initiation service providers shall ensure that, when exchanging data by means of the internet, a secure encryption is applied between the communicating parties throughout the respective communication session, in order to safeguard the confidentiality and the integrity of the data, using strong and widely recognised encryption techniques.
2. Payment service providers issuing card-based payment instruments, account information service providers and payment initiation service providers shall keep the access sessions offered by account servicing payment service providers, as short as possible, and they shall actively terminate any such session, as soon as the requested action has been completed.
3. When maintaining parallel network sessions with the account servicing payment service provider, the account information service providers and payment initiation service providers shall ensure that those sessions are securely linked to relevant sessions established with the payment service user(s), in order to prevent the possibility that any message or information communicated between them could be misrouted.
4. Account information service providers, payment initiation service providers and payment service providers issuing card-based payment instruments with the account servicing payment service provider shall contain unambiguous references to each of the following items: a) the payment service users and the corresponding communication session, in order to distinguish several requests from the same payment service user; b) for payment initiation services, the uniquely identified payment transaction initiated; c) for confirmation on the availability of funds, the uniquely identified request related to the amount necessary for the execution of the card-based payment transactions.
5. Account servicing payment service providers, account information service providers, payment initiation service providers and payment service providers issuing card-based payment instruments shall ensure that, where they communicate personalised security credentials and authentication codes, these are not readable, directly or indirectly, by any staff at any time.
6. In case of loss of confidentiality of personalised security credentials under their sphere of competence, those providers as referred to in article 5 of this regulation, shall inform without undue delay the payment services user associated with them and the issuer of the personalised security credentials. Article 40 Data exchange
7. Account servicing payment service providers shall fulfill the following requirements: a) they shall provide account information service providers, with the same information from designated payment accounts and associated payment transactions, made available to the payment service user, when the latter directly requesting access to the account information, provided that this information does not include sensitive payment data;

21 b) they shall, immediately after receipt of the payment order, provide payment initiation service providers with the same information on the initiation and execution of the payment transaction, provided or made available to the payment service user, when the transaction is initiated directly by the latter; c) they shall provide immediately upon request, payment service providers with a confirmation in a simple “yes” or “no” format, whether the amount necessary for the execution of a payment transaction is available on the payment account of the payer. 2. In case of an unexpected error or cybernetic incident occurring during the process of identification, authentication, or the exchange of the data elements, the account servicing payment service provider shall send a notification message to the payment initiation service provider or the account information service provider and the payment service provider issuing card-based payment instruments, which explains the reason for the unexpected error or cybernetic incident. 3. Where the account servicing payment service provider offers a dedicated interface in accordance with article 36 of this regulation, the interface shall provide for notification messages concerning unexpected errors or cybernetic incident to be communicated by any payment service provider that detects the error or incident, to other payment service providers participating in the communication session. 4. Account information service providers shall have in place suitable and effective mechanisms that prevent access to information other than from designated payment accounts and associated payment transactions, in accordance with the user’s explicit consent. 5. Payment initiation service providers shall provide account servicing payment service providers with the same information as requested from the payment service user, when initiating the payment transaction directly. 6. Account information service providers shall be able to access information from designated payment accounts and associated payment transactions held by account servicing payment service providers, for the purposes of performing the account information service in either of the following circumstances: a) whenever the payment service user is actively requesting such information; b) where the payment service user does not actively request such information, no more than four times in a 24-hour period, unless a higher frequency is agreed between the account information service provider and the account servicing payment service provider, with the payment service user’s consent. CHAPTER VII SUPERVISORY REQUIREMENTS Article 41 Supervisory measures The Bank of Albania, in case of failure to comply with the obligations laid down in this regulation, shall implement the supervisory and/or punishing measures, laid down in articles 25 and chapter I of Title V of the law “On payment services”.

22 Article 42 Entry into force This regulation shall enter into force on 1 January 2024. CHAIRMAN OF THE SUPERVISORY COUNCIL Gent SEJKO

23 Annex 1 Exemption threshold value (‘ETV’) Reference fraud rate (%) for: Remote electronic card￾based payments Remote electronic credit transfers Equivalent value in lek of the amount 500 euros 0.01 0,005 Equivalent value in lek of the amount 250 euros 0.06 0.01 Equivalent value in lek of the amount 100 euros 0.13 0,015