If there is a difference between the presentation of the text below and in the PDF document, the PDF document prevails.

No. 1360/2023
28 November 2023

RULES

on strong customer authentication and common and secure open standards for communication in payment services.

Article 1. Scope.

These Rules apply to payment service providers under the Act on Payment Services, No. 114/2021.

Article 2. Strong customer authentication and secure communication.

Payment service providers shall comply with the provisions of Commission Delegated Regulation (EU) 2018/389, in connection with strong customer authentication and secure communication, cf. point (c) of the second paragraph of Article 65, point (c) of the second paragraph of Article 67, the second paragraph of Article 69, the fourth paragraph of Article 70, the first paragraph of Article 72, point (c) of the first paragraph of Article 99 and Article 101 of the Act on Payment Services, No. 114/2021, cf. Article 3.

Article 3. Implementation of regulations.

With reference to Article 2, the following regulations enter into force in this country:

• Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication, which was incorporated into the EEA Agreement by Decision of the EEA Joint Committee No. 159/2020 of 23 October 2020. The Regulation is published in the EEA Supplement to the Official Journal of the European Union No. 66 of 14 October 2021, pp. 66-87.

• Commission Delegated Regulation (EU) 2022/2360 of 3 August 2022 amending the regulatory technical standards laid down in Delegated Regulation (EU) 2018/389 as regards the 90-day exemption for account access, which was incorporated into the EEA Agreement by Decision of the EEA Joint Committee No. 158/2023 of 13 June 2023. The Regulation is published in the EEA Supplement to the Official Journal of the European Union No. 83 of 16 November 2023, pp. 118-121.

Article 4. Entry into force.

These Rules, which are laid down under the authority of the second paragraph of Article 114 of the Act on Payment Services, No. 114/2021, enter into force immediately. Upon their entry into force, Rules No. 1220/2021 on strong customer authentication and common and secure open standards for communication in payment services shall be repealed.

Central Bank of Iceland, 28 November 2023.

	Ásgeir Jónsson	Kristín Logadóttir
	governor.	managing director.

Part B - Publication: 12 December 2023