Payment Security & Regulatory Assurance
Independent PSD2 SCA Compliance Audit for
EU/EEA Payment Institutions
Regulator-legible proof that your Strong Customer Authentication implementation meets PSD2 Article 97 and RTS (EU) 2018/389, before your inspection date.
Looking for TRA-exemption assurance specifically? Jump to the TRA audit →
CyAdvisoled by Andrey Gubarev, Founder & vCISOCISM, CDPSE, SABSA
Is your SCA implementation regulator-ready?
An independent, external audit report is evidence your regulator and your own board weigh differently from an internal self-assessment. Article 3 of RTS (EU) 2018/389 itself requires an SCA assessor to be operationally independent of the team whose work is being reviewed. The team that built and runs your authentication cannot also be the independent judge of it, however thorough that internal review was.
Why not just extend your existing auditor’s scope? A broader IT-audit or financial-audit engagement typically treats SCA as one line item inside a wider scope of work. That gap tends to surface two ways: a generic attestation instead of a clause-by-clause compliance record, or a delivery timeline that does not fit the compressed window before an inspection. Article 3 asks for a reviewer who holds technical-security and payments expertise together, at clause level, not a generalist auditor with a payments chapter.
This is a newly formalized practice, built on our team’s years of combined operating experience across payments, technical security and financial-sector regulation, brought together specifically for this audit. We are not lawyers reading PSD2, and we are not penetration testers checking an application: we assess how your implementation meets the regulator’s requirement, technically, the same combination Article 3 of RTS (EU) 2018/389 itself asks of an SCA assessor. Independent assessment by professionals with expertise in IT security and payments, each requirement assessed by the same reviewer end to end, not handed between a legal reviewer and a separate technical tester.
Nine domains, one reviewer per requirement
Each domain below is assessed against RTS (EU) 2018/389 by the same reviewer, technical and regulatory together, so nothing falls into the gap between a legal read of the rule and a technical read of your system.
-
SCA Architecture: your overall authentication design and how it maps to your in-scope payment flows.
-
Authentication Elements: knowledge, possession and inherence factors, each verified independently against RTS Articles 4-8.
-
Independence of Elements: whether a breach of one authentication factor could compromise the reliability of another (RTS Article 9).
-
Authentication Code: generation, format and one-time-use properties of your SCA authentication code.
-
Dynamic Linking: whether the authentication code is tied to the exact transaction amount and payee (RTS Article 5).
-
Device & Mobile Security: device-binding, secure-element and OS-level controls, and mobile-channel authentication integrity.
-
SCA Exemptions: whether your currently claimed exemptions are actually applicable and correctly evidenced (RTS Articles 10-18). If exemption usage, and Transaction Risk Analysis specifically, is your primary concern rather than one item among several, see PSD2 TRA Independent Audit below: a separate, narrower engagement built for exactly that case.
-
Transaction Monitoring & Fraud: the fraud-detection and risk-monitoring controls that support your SCA and exemption decisions.
-
Open Banking / APIs: PISP/AISP-facing interface security and how SCA carries through your API surface.
What you receive from the SCA audit
-
Independent Audit Report: the formal, regulator-legible document.
-
PSD2 SCA Compliance Matrix: Requirement, Regulatory reference, Evidence, Assessment, Finding, one row per in-scope requirement, each status Compliant, Partially Compliant, Non-Compliant, or Not Applicable. No in-scope requirement is left with an implicit or ambiguous status.
-
Findings & Risk Assessment: every gap stated explicitly, with its risk framing.
-
Remediation Plan: a credible, evidenced plan for every Partially or Non-Compliant finding.
-
Re-test: an independent re-test confirming closure of remediated findings before your inspection date, where a material finding was logged.
-
Final Compliance Opinion: the document you can hand directly to your inspector and to your own board, without further preparation.
Protecting a Transaction Risk Analysis exemption is a different job from a full SCA audit
If your checkout or payment flow relies on the Transaction Risk Analysis exemption under RTS (EU) 2018/389 Article 18, and keeping that exemption without a forced step-up to full SCA is your primary concern, this is a distinct, narrower engagement, not a line item inside the nine-domain audit above.
We independently assess whether your TRA exemption usage, and the risk-scoring model behind it, meet RTS audit requirements: fraud-rate thresholds by transaction-value band, the integrity of your monitoring mechanism, and the evidentiary trail Article 18 exemption usage requires. In certain cases, RTS contemplates review by an independent and qualified external auditor for TRA exemption usage; this engagement is scoped specifically to satisfy that requirement, not offered as a generic add-on to a broader SCA review.
You receive an Independent TRA Audit Report, built to support your case with your acquiring bank, card scheme or regulator, aimed at keeping your exemption’s applicability without a forced step-up to full SCA.
Who we work with
EU/EEA-licensed banks, Electronic Money Institutions, Payment Institutions and other PSD2-obliged payment service providers. Five moments most often bring an institution to this audit:
- Your national competent authority (NCA) has signalled, formally or informally, an upcoming inspection or thematic SCA review, typically 4-12 weeks out.
- You have materially changed your authentication architecture, a new mobile SDK, a new biometric factor, a re-platform, or you are launching a new mobile or payment product.
- Your governance policy calls for periodic independent assurance alongside your existing ISO 27001, SOC 2 or penetration-testing cadence.
- You rely on SCA exemptions, Transaction Risk Analysis in particular, and need independent confirmation they still hold (see PSD2 TRA Independent Audit above).
- You have already received a supervisory finding or warning related to SCA and need it closed, verified and documented before a deadline.
If your compliance or security team has already run its own review, that work becomes the starting evidence package for this engagement, not a discarded first draft. This is a second, independent pair of eyes before your regulator arrives, not a verdict on the work already done.
Our approach
Six steps, agreed and time-boxed against your inspection date from the first conversation.
-
1
Scope
We agree in writing which entities, channels, authentication flows and claimed exemptions are in scope, against a timeline that lands before your inspection date. This first conversation is where you get visibility and control before committing any evidence-assembly effort, not a sales pitch.
Talk to us about your scope → -
2
Evidence
Your team compiles architecture documentation, configuration evidence, policies, logs and exemption models, coordinated through a single evidence-request checklist and one point of contact. Nothing is requested twice.
-
3
Technical & Regulatory Assessment
The same reviewer evaluates your evidence against RTS requirements and EBA interpretations, technical merits and regulatory-alignment merits together.
-
4
Findings
Every in-scope requirement receives an explicit Compliance Matrix status. Nothing is left ambiguous or assumed compliant by default.
-
5
Audit Report
A formal report and Final Compliance Opinion, delivered in a format your supervisor can act on at first read.
-
6
Remediation & Re-test
Where needed: findings are closed and independently re-tested before your inspection date, or a credible, evidenced remediation plan is on file if closure is not realistically achievable in time.
Why us
-
Regulatory knowledge: PSD2, RTS (EU) 2018/389, EBA guidance and Q&A, and the wider EU financial-sector regulatory framework.
-
Payments expertise: payment processing, EMI/PI architecture, SEPA, card schemes, Open Banking, PISP/AISP flows, fraud and Transaction Risk Analysis.
-
Security expertise: authentication design, cryptography, mobile security, API security, identity and access management, secure architecture.
-
Independence: the team assessing your implementation is operationally independent of the team that built or runs it, for every engagement, by design.
Our practice is calibrated by our founder, Andrey Gubarev (CISM, SABSA, CDPSE), a two-time former CISO at EU-licensed fintechs.
Compared to your other options:
- An internal self-assessment cannot demonstrate the operational independence Article 3 itself requires, however careful it is.
- A generalist audit or IT-audit engagement typically treats SCA as one line item inside a wider scope, and rarely fields reviewers who hold payments and technical-security expertise together at clause level.
- Waiting until your regulator specifically requests evidence removes the lead time you need to fix anything before your inspection date.
The regulatory framework this audit works against
PSD2 (Directive (EU) 2015/2366) Article 97 requires payment service providers to apply Strong Customer Authentication whenever a payer initiates a payment or accesses their account. Commission Delegated Regulation (EU) 2018/389, the RTS on SCA and Common and Secure Communication, sets out the detailed technical requirements this audit assesses: independent authentication elements, dynamic linking, exemption conditions, and the assessor’s own required independence (Article 3). The European Banking Authority’s guidance and Q&A interpret these requirements in practice, and national competent authorities across the EU/EEA supervise compliance with them.
The EU payments regulatory framework is moving. A provisional political agreement between the Council and the European Parliament on a new Payment Services Regulation and PSD3 was reached in November 2025. Our methodology is built to extend to PSD3/PSR requirements as they take effect: this audit is not a one-time, PSD2-only exercise. See our DORA vs PSD2/PSD3 guide for the full regime comparison.
Last reviewed 19 August 2026. Every claim above maps to primary regulatory text, confirm the current application status with counsel.
Show the sources
-
Directive (EU) 2015/2366: PSD2, EUR-Lex, Article 97. Requires Strong Customer Authentication whenever a payer initiates a payment or accesses their account.
-
Commission Delegated Regulation (EU) 2018/389, the RTS on SCA and Common and Secure Communication. Sets out the independent authentication elements, dynamic linking, exemption conditions and the assessor’s own required independence (Article 3) this audit assesses.
-
European Parliament: Payment services deal, more protection from online fraud and hidden fees (21 November 2025). The provisional political agreement on the new Payment Services Regulation and PSD3 referenced above; confirm current Official Journal publication and application-date status directly before treating any draft detail as live law.
Subject matter, not a credential claim. CyAdviso is independent of, and not endorsed by, these bodies. Confirm the application to your entity with counsel and the relevant NCA.
Request an Audit
Tell us about your inspection date, your architecture change, or the exemption you rely on. The first conversation is a scope discussion, not a commitment, and costs you nothing to find out whether your timeline still works. No price is published here because every engagement is scoped to your institution; you will have a clear, written scope before you commit to anything.
Or email info@cyadviso.com · No commitment. No sales pressure.