PSD2 certificate compliance

What you need to know about
PSD2 certificate compliance
A new regulatory standard in the EU mandates additional
security measures for banks and Payment Service Providers,
including the use of special Qualified digital certificates.

PSD2 certificate compliance

What is the revised Payment
Services Directive (PSD2)?
As part of a long-time effort to increase the security,
privacy and reliability of electronic payments crossing
the borders of EU nations, the European Commission
developed the revised Payment Services Directive (EUDirective 2015/2366, also known as PSD2) which cameinto effect in January 2018.
The directive is intended to…
• Contribute to a more integrated and efficient European
payments market• Create a level playing field for Payment Service
Providers (PSPs) across the EU• Make electronic payments more secure• Provide more consistent consumer protection

digital certificates, the validation of their holders’identity, and the operation of the Qualified Trust Service
Providers (TSPs) that issue them.
Certificates issued by Qualified TSPs in accordancewith eIDAS standards are known as “QualifiedCertificates,” and provide special status in certain legaland regulatory contexts across the EU.

Why do I need Qualified
certificates for PSD2?
Under PSD2 digital certificates are used to identify
banks and PSPs, to verify the roles for which they
are licensed, to encrypt communications, and, insome cases, to provide tamperproof seals on data ortransactions.

banks and PSPs doing business in the EU.

Due to the sensitivity of financial services transactions,the PSD2 Regulatory Technical Standards (RTS) specify
that only eIDAS certificates issued by a Qualified
Trust Service Provider (TSP) may be used for theidentification of PSPs.

What are eIDAS Qualified
Certificates?

Is DigiCert + QuoVadis accredited toprovide Qualified Certificates?

PSD2 covers many facets of the electronic payments
market, but notably introduces enhanced privacy andonline security measures that must be implemented byeIDAS (EU Regulation 910/2014) is a set of EU
regulatory standards that defines requirements for

DigiCert’s European subsidiary QuoVadis is a eIDAS
Qualified TSP operating in the Netherlands and inBelgium, as well as in Switzerland.

PSD2 certificate compliance

What kind of Qualified certificatesare issued by DigiCert + QuoVadis?
DigiCert + QuoVadis issues Qualified Certificates fore-signature and e-seal, Qualified Web Authentication
Certificates (TLS/SSL), and Qualified Time Stamps.
DigiCert + QuoVadis also provide the specific Qualified
Certificates required for PSD2.

What types of certificates do
I need for PSD2 compliance?

Qualified Certificate for Website
Authentication (QWAC) used with Transport
Layer Security (TLS) protocol such as is definedin IETF RFC 5246 or IETF RFC 8446 to protect
data in peer-to-peer communications and toidentify who controls the end points.
Qualified Certificate for Electronic Seals(QSealC) create e-seals used to protect dataor documents using standards such as ETSI’s
PAdES, CAdES or XAdES, and assert their origin
from a legal entity.

PSD2 specifies two types of digital certificate for securecommunications:

What types of certificates do I need for
PSD2 compliance?
Each type of PSD2 Certificate offers different protection depending on the use case.

QWAC TLS/SSL

e-Seal / QSealC

Where is it used?

Identifies end points, protects data
during communication

Identifies origin of document ordata and makes it tamperproof
in communication and storage

What are the security
features?

Confidentiality, authentication, andintegrity

Authentication and integrity

Provides legal evidential
value for transactions?

NoYes under eIDAS

Is data protected when
passed through anintermediary?

Protects in direct peer-to-peer
communications

End-to-end, even if passed
through intermediaryPSD2 certificate compliance

The EBA’s RTS describes different scenarios that PSPs
can consider in their use of certificates for securecommunication. For example, Article 34 of the RTS
describes a secure option with parallel protectionof both the payment transactions data and theircommunications channels:
Using QWACs to assert the PSPs’ identity
and roles to each other and to communicate
securely using TLS encryption; andUsing QSealCs to ensure that the application
data submitted originates from a particular PSP
and has not been tampered with.
Banks providing APIs for real-time access to customer
information by licensed third-party vendors will typicallyspecify which PSD2 certificates they require to be usedby PSPs. PSPs will typically require both.

Are there special requirements forprivate key management?
Though in many cases eIDAS requires the use of a
Qualified Signature Creation Device (QSCD) to protect
private keys, special cryptographic hardware is not
required for either QWAC or QSealC certificates under
PSD2.
Instead, PSD2 allows Advanced e-seals under the eIDAS
definitions, created using the QSealC certificates.

What are the timelines for PSD2
Certificates?
Phase 1: March 2019
In this initial phase, a PSD2 test environment
must be provided in which even non-licensed
third-party vendors can identify themselveswith test certificates and access test
accounts.
DigiCert + QuoVadis are able to issue test
PSD2 Certificates, with simplified registration,
for these purposes.

Phase 2: June 2019
In this phase, banks must open their live
system with real customer accounts forlicensed third-party vendors with production
PSD2 Certificates.
Financial institutions that are unable to meetthese deadlines must implement a fallback
solution according to EU 2018/389 Article 33(6).
DigiCert + QuoVadis are ready to issue
production Qualified PSD2 Certificates, which
involve more detailed validation of identity
information of the PSP and its Authorised
Representatives.
Phase 3: September 2019
Financial institutions are committed to full,live operation in compliance with PSD2requirements.

How can I get a test PSD2Certificate?
Test certificates may be obtained by filling out theform on www.digicert.com/psd2-compliance-securitysolutions/. These certificates are created from a test
hierarchy that must be added to the test systems’
trusted root certificate store.

PSD2 certificate compliance

What will I need to register for a
PSD2 Certificate?

The PSP roles defined in the ETSI TS 119 495 standard
for PSD2 include:
PSP_AI Account information service

In general, the validation steps for PSD2 Certificates

PSP_PI Payment initiation service

are similar to those required for Extended Validation(EV) TLS. However, the eIDAS Qualified standards

PSP_AS Account services

place additional emphasis on identity verification,

PSP_IC Issuing of card-based payment
instruments

which typically requires face-to-face validation of thecertificate holder’s official documents by the QualifiedTSP.

Is there a standard relevant toPSD2 Certificates?

Because PSD2 Certificates are issued to companies,
the individual whose identity will be validated must be

A new ETSI standard (ETSI TS 119 495) builds ona known Authorised Representative for the company,

the other eIDAS Qualified standards to define thesuch as a director noted in an official Trade Register.

TSP policies and certificate profiles that meet PSD2

That Authorised Representative may then approve other

RTS requirements. This includes defining fields forpersonnel, such as IT staff, to interact with the TSP incertificates to identify:

managing the digital certificate lifecycle.

the National Competent Authority (NCA) orfinancial regulator where the PSP is registered

NOTE: The face-to-face validation process for
Authorised Representatives may be facilitated using
accredited European Notaries.

the Authorisation Number issued to the PSP bythe NCA

The PSP applicant will need to identify the country of

the regulated PSD2 roles for which the PSP islicensed by the NCA

their National Competent Authority (NCA) or financialregulator. The Qualified TSP will confirm the PSP’slicense and roles before issuing the certificates.

DigiCert proposed Ballot SC17 in the CA/Browser
Forum which enables PSD2 and other organisational
identifier fields to be added to Extended Validation (EV)TLS certificates.

4For more information, contact DigiCert + QuoVadis
at +31 30 232 43 20 or email Psd2@quovadisglobal.com© 2019 DigiCert, Inc. All rights reserved. DigiCert is a registered trademark of DigiCert, Inc. in the USA and elsewhere.
All other trademarks and registered trademarks are the property of their respective owners.