{
  "url": "https://openlegislation.uk/eu-regulation-2018-389",
  "json_url": "https://openlegislation.uk/eu-regulation-2018-389.json",
  "id": "eur/2018/389",
  "title": "Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication (Text with EEA relevance)",
  "short_title": "Regulation (EU) 2018/389 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council…",
  "long_title": "Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication (Text with EEA relevance)",
  "citation": "EU Regulation 2018/389",
  "type": "eur",
  "year": "2018",
  "number": "389",
  "version": "current",
  "date": "2017-11-27",
  "revised": false,
  "valid_from": null,
  "extent": "E+W+S+N.I.",
  "unapplied_effects": 1,
  "provisions": [
    {
      "path": "introduction",
      "kind": "introduction",
      "number": null,
      "heading": "Introductory text",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/introduction",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": null
    },
    {
      "path": "chapter/I",
      "kind": "chapter",
      "number": "I",
      "heading": "GENERAL PROVISIONS",
      "url": null,
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": null
    },
    {
      "path": "article/1",
      "kind": "article",
      "number": "1",
      "heading": "Subject matter",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-1",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/I"
    },
    {
      "path": "article/2",
      "kind": "article",
      "number": "2",
      "heading": "General authentication requirements",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-2",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/I"
    },
    {
      "path": "article/3",
      "kind": "article",
      "number": "3",
      "heading": "Review of the security measures",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-3",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/I"
    },
    {
      "path": "chapter/II",
      "kind": "chapter",
      "number": "II",
      "heading": "SECURITY MEASURES FOR THE APPLICATION OF STRONG CUSTOMER AUTHENTICATION",
      "url": null,
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": null
    },
    {
      "path": "article/4",
      "kind": "article",
      "number": "4",
      "heading": "Authentication code",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-4",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/II"
    },
    {
      "path": "article/5",
      "kind": "article",
      "number": "5",
      "heading": "Dynamic linking",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-5",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/II"
    },
    {
      "path": "article/6",
      "kind": "article",
      "number": "6",
      "heading": "Requirements of the elements categorised as knowledge",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-6",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/II"
    },
    {
      "path": "article/7",
      "kind": "article",
      "number": "7",
      "heading": "Requirements of the elements categorised as possession",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-7",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/II"
    },
    {
      "path": "article/8",
      "kind": "article",
      "number": "8",
      "heading": "Requirements of devices and software linked to elements categorised as inherence",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-8",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/II"
    },
    {
      "path": "article/9",
      "kind": "article",
      "number": "9",
      "heading": "Independence of the elements",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-9",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/II"
    },
    {
      "path": "chapter/III",
      "kind": "chapter",
      "number": "III",
      "heading": "EXEMPTIONS FROM STRONG CUSTOMER AUTHENTICATION",
      "url": null,
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": null
    },
    {
      "path": "article/10",
      "kind": "article",
      "number": "10",
      "heading": "Payment account information",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-10",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/III"
    },
    {
      "path": "article/11",
      "kind": "article",
      "number": "11",
      "heading": "Contactless payments at point of sale",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-11",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/III"
    },
    {
      "path": "article/12",
      "kind": "article",
      "number": "12",
      "heading": "Unattended terminals for transport fares and parking fees",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-12",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/III"
    },
    {
      "path": "article/13",
      "kind": "article",
      "number": "13",
      "heading": "Trusted beneficiaries",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-13",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/III"
    },
    {
      "path": "article/14",
      "kind": "article",
      "number": "14",
      "heading": "Recurring transactions",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-14",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/III"
    },
    {
      "path": "article/15",
      "kind": "article",
      "number": "15",
      "heading": "Credit transfers between accounts held by the same natural or legal person",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-15",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/III"
    },
    {
      "path": "article/16",
      "kind": "article",
      "number": "16",
      "heading": "Low-value transactions",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-16",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/III"
    },
    {
      "path": "article/17",
      "kind": "article",
      "number": "17",
      "heading": "Secure corporate payment processes and protocols",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-17",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/III"
    },
    {
      "path": "article/18",
      "kind": "article",
      "number": "18",
      "heading": "Transaction risk analysis",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-18",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/III"
    },
    {
      "path": "article/19",
      "kind": "article",
      "number": "19",
      "heading": "Calculation of fraud rates",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-19",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/III"
    },
    {
      "path": "article/20",
      "kind": "article",
      "number": "20",
      "heading": "Cessation of exemptions based on transaction risk analysis",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-20",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/III"
    },
    {
      "path": "article/21",
      "kind": "article",
      "number": "21",
      "heading": "Monitoring",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-21",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/III"
    },
    {
      "path": "chapter/IV",
      "kind": "chapter",
      "number": "IV",
      "heading": "CONFIDENTIALITY AND INTEGRITY OF THE PAYMENT SERVICE USERS' PERSONALISED SECURITY CREDENTIALS",
      "url": null,
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": null
    },
    {
      "path": "article/22",
      "kind": "article",
      "number": "22",
      "heading": "General requirements",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-22",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/IV"
    },
    {
      "path": "article/23",
      "kind": "article",
      "number": "23",
      "heading": "Creation and transmission of credentials",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-23",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/IV"
    },
    {
      "path": "article/24",
      "kind": "article",
      "number": "24",
      "heading": "Association with the payment service user",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-24",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/IV"
    },
    {
      "path": "article/25",
      "kind": "article",
      "number": "25",
      "heading": "Delivery of credentials, authentication devices and software",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-25",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/IV"
    },
    {
      "path": "article/26",
      "kind": "article",
      "number": "26",
      "heading": "Renewal of personalised security credentials",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-26",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/IV"
    },
    {
      "path": "article/27",
      "kind": "article",
      "number": "27",
      "heading": "Destruction, deactivation and revocation",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-27",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/IV"
    },
    {
      "path": "chapter/V",
      "kind": "chapter",
      "number": "V",
      "heading": "COMMON AND SECURE OPEN STANDARDS OF COMMUNICATION",
      "url": null,
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": null
    },
    {
      "path": "chapter/V/section/1",
      "kind": "section",
      "number": "1",
      "heading": "General requirements for communication",
      "url": null,
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/V"
    },
    {
      "path": "article/28",
      "kind": "article",
      "number": "28",
      "heading": "Requirements for identification",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-28",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/V/section/1"
    },
    {
      "path": "article/29",
      "kind": "article",
      "number": "29",
      "heading": "Traceability",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-29",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/V/section/1"
    },
    {
      "path": "chapter/V/section/2",
      "kind": "section",
      "number": "2",
      "heading": "Specific requirements for the common and secure open standards of communication",
      "url": null,
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/V"
    },
    {
      "path": "article/30",
      "kind": "article",
      "number": "30",
      "heading": "General obligations for access interfaces",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-30",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/V/section/2"
    },
    {
      "path": "article/31",
      "kind": "article",
      "number": "31",
      "heading": "Access interface options",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-31",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/V/section/2"
    },
    {
      "path": "article/32",
      "kind": "article",
      "number": "32",
      "heading": "Obligations for a dedicated interface",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-32",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/V/section/2"
    },
    {
      "path": "article/33",
      "kind": "article",
      "number": "33",
      "heading": "Contingency measures for a dedicated interface",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-33",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/V/section/2"
    },
    {
      "path": "article/34",
      "kind": "article",
      "number": "34",
      "heading": "Certificates",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-34",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/V/section/2"
    },
    {
      "path": "article/35",
      "kind": "article",
      "number": "35",
      "heading": "Security of communication session",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-35",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/V/section/2"
    },
    {
      "path": "article/36",
      "kind": "article",
      "number": "36",
      "heading": "Data exchanges",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-36",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/V/section/2"
    },
    {
      "path": "chapter/VI",
      "kind": "chapter",
      "number": "VI",
      "heading": "FINAL PROVISIONS",
      "url": null,
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": null
    },
    {
      "path": "article/37",
      "kind": "article",
      "number": "37",
      "heading": "Review",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-37",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/VI"
    },
    {
      "path": "article/38",
      "kind": "article",
      "number": "38",
      "heading": "Entry into force",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/article-38",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "chapter/VI"
    },
    {
      "path": "signature",
      "kind": "signature",
      "number": null,
      "heading": "Signature",
      "url": "https://openlegislation.uk/eu-regulation-2018-389/signature",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": null
    },
    {
      "path": "annex",
      "kind": "annex",
      "number": null,
      "heading": null,
      "url": "https://openlegislation.uk/eu-regulation-2018-389/annex",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": null
    }
  ],
  "outstanding_effects": [
    {
      "type": "revoked",
      "affected_provisions": "Regulation",
      "affecting": "ukpga/2023/29",
      "affecting_title": "Financial Services and Markets Act 2023",
      "affecting_provisions": "Sch. 1 Pt. 3"
    }
  ],
  "made_under": [],
  "changes_made_to": 3,
  "changes_made_to_url": "https://openlegislation.uk/eu-regulation-2018-389/changes.json",
  "changes_made_by": 0,
  "changes_made_by_url": "https://openlegislation.uk/eu-regulation-2018-389/changes/by-it.json",
  "instruments_made_under": 0,
  "instruments_made_under_url": "https://openlegislation.uk/eu-regulation-2018-389/instruments.json",
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eur/2018/389",
    "retrieved_at": "2026-11-01T14:44:14.007205+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}