# Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication (Text with EEA relevance), Article 23: Creation and transmission of credentials

Extent: E+W+S+N.I.

Payment service providers shall ensure that the creation of personalised security credentials is performed in a secure environment.
They shall mitigate the risks of unauthorised use of the personalised security credentials and of the authentication devices and software following their loss, theft or copying before their delivery to the payer.

---
Source: https://www.legislation.gov.uk/eur/2018/389/article/23 (the official version)
Page: https://openlegislation.uk/eu-regulation-2018-389/article-23
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.