RTS

Definition

RTS (Regulatory Technical Standards) are binding technical standards drafted by the EBA and adopted by the Commission as a delegated regulation.

Where the directive sets out the "what", the RTS set out the "how", in a legally enforceable way.

RTS vs guidelines vs Q&A

The EBA produces three types of text with very different force:

• RTS — binding rules, adopted by the Commission and directly applicable; failing to comply exposes you to sanctions.
• Guidelines — recommended best practices, subject to NCAs' "comply or explain": highly influential, but not binding.
• Q&A and opinions — non-binding clarifications that shape interpretation.

The adoption process

1. Mandate: the directive (e.g. PSD2, Art. 98) asks the EBA to draft an RTS.
2. Public consultation: the EBA publishes a draft and the industry responds over 2–3 months.
3. Submission: the EBA finalises it and sends it to the Commission.
4. Adoption: the Commission adopts it as a delegated regulation, published in the OJEU, unless the Parliament or Council objects.

Expect 2–3 years between the mandate and effective application.

The key PSD2 RTS

• RTS-SCA (2018/389, applicable since September 2019): strong authentication, dynamic linking, exemptions, and common and secure communication (CSC) between TPPs and ASPSPs.
• Fraud RTS: the quarterly fraud-reporting template.
• Passporting RTS: notification from one NCA to another.
• PSP grouping RTS: cooperation conditions.

What RTS do not do

• They do not create obligations beyond the directive's mandate.
• They do not replace the directive: they specify it, they do not rewrite it.
• They are not negotiable: they are a regulation, applicable as is.
• They do not cover everything: for the grey areas, you need the guidelines, Q&A and NCA positions.

In the PSD2 ecosystem

The RTS are the operational toolbox: to know how to implement PSD2 (and soon PSD3 + PSR), it is in the RTS that you find the authoritative answer, not in the directive, which is deliberately higher-level.

Concrete examples

• RTS-SCA and checkout: it is what mandated 3DS2 over 3DS1 and defined the TRA exemptions that PSPs (Stripe, Adyen, Worldline) leverage for conversion.
• AISP renewal: the 2022 amendment to the RTS-SCA moved consent renewal from 90 to 180 days, improving retention for the likes of Bankin' and Linxo.
• Fraud reporting: any PSP above a certain volume sends its NCA a standardised file under the RTS — a data volume to plan for in architecture.
• Anticipating PSD3: following EBA consultations as soon as they launch lets you influence future RTS before they are set in stone.
• Monitoring: the EBA's "Single Rulebook" centralises all RTS, guidelines and Q&A in force.