{
  "url": "https://openlegislation.uk/eu-regulation-2018-389/article-7",
  "json_url": "https://openlegislation.uk/eu-regulation-2018-389/article-7.json",
  "legislation": "eur/2018/389",
  "legislation_title": "Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication (Text with EEA relevance)",
  "legislation_url": "https://openlegislation.uk/eu-regulation-2018-389",
  "path": "article/7",
  "kind": "article",
  "number": "7",
  "heading": "Requirements of the elements categorised as possession",
  "text": "1. Payment service providers shall adopt measures to mitigate the risk that the elements of strong customer authentication categorised as possession are used by unauthorised parties.\n2. The use by the payer of those elements shall be subject to measures designed to prevent replication of the elements.",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eur/2018/389/article/7",
    "retrieved_at": "2026-11-01T14:44:14.007205+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}