{
  "url": "https://openlegislation.uk/eu-regulation-2018-389/article-24",
  "json_url": "https://openlegislation.uk/eu-regulation-2018-389/article-24.json",
  "legislation": "eur/2018/389",
  "legislation_title": "Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication (Text with EEA relevance)",
  "legislation_url": "https://openlegislation.uk/eu-regulation-2018-389",
  "path": "article/24",
  "kind": "article",
  "number": "24",
  "heading": "Association with the payment service user",
  "text": "1. Payment service providers shall ensure that only the payment service user is associated, in a secure manner, with the personalised security credentials, the authentication devices and the software.\n2. For the purpose of paragraph 1, payment service providers shall ensure that each of the following requirements is met:\n(a) the association of the payment service user's identity with personalised security credentials, authentication devices and software is carried out in secure environments under the payment service provider's responsibility comprising at least the payment service provider's premises, the internet environment provided by the payment service provider or other similar secure websites used by the payment service provider and its automated teller machine services, and taking into account risks associated with devices and underlying components used during the association process that are not under the responsibility of the payment service provider;\n(b) the association by means of a remote channel of the payment service user's identity with the personalised security credentials and with authentication devices or software is performed using strong customer authentication.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eur/2018/389/article/24",
    "retrieved_at": "2026-11-01T14:44:14.007205+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}