--- title: "Payment Service Directive (PSD2): What are the challenges for mobile security?" description: The PSD2 aims at harmonizing the protection of electronic payments and consumers' financial data while promoting innovation and offering better experience to users. It applies to banks, payment service providers (PSP) and any other company that handles banking data. image: https://blog.pradeo.com/hubfs/psd2-application-self-protection-rasp2.jpg --- [![pradeo\_logo\_color](https://blog.pradeo.com/hs-fs/hubfs/pradeo_logo_color.png?width=220&height=33&name=pradeo_logo_color.png "pradeo_logo_color")](https://pradeo.com) - Solutions - [Mobile Threat Defense](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Secure Private Store](https://pradeo.com/en/solutions/mobile-device-security/secure-private-store/) - [Mobile Application Compliance Audit](https://pradeo.com/en/solutions/mobile-application-security/application-compliance-audit/) - [Runtime Application Self Protection](https://pradeo.com/en/solutions/mobile-application-security/rasp/) - [Shielding](https://pradeo.com/en/solutions/mobile-application-security/application-shielding/) - [Application Security Testing](https://pradeo.com/en/solutions/mobile-application-security/application-security-testing/) - Use cases - [Cybersecurity in MDM/ UEM](https://pradeo.com/en/use-cases/cybersecurity-in-mdm-uem/) - [Securing mobile devices](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Securing Mobile Applications](https://pradeo.com/en/solutions/mobile-application-security/application-security-testing/) - [Malware / leakware protection](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Phishing protection](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Ensuring compliance for applications](https://pradeo.com/en/compliance/) - [Ensuring compliance for mobile fleet](https://pradeo.com/en/compliance/) - [Securing BYOD](https://pradeo.com/en/solutions/mobile-device-security/secure-private-store/) - [Become partner](https://pradeo.com/become-partner/) - Resources - [Solution briefs](https://pradeo.com/en/resources/?solution-briefs) - [Customer Cases](https://pradeo.com/en/resources/?customer-cases) - [Integration briefs](https://pradeo.com/en/resources/?integration-briefs) - [White Papers](https://pradeo.com/en/resources/?white-papers) - [Analyst reports & guides](https://pradeo.com/en/resources/?analyst-reports-guides) - [On demand webcast](https://pradeo.com/en/resources/?webcasts-on-demand) - [About us](https://pradeo.com/en/about/) - [Blog](https://blog.pradeo.com/) - [Contact](https://pradeo.com/contact/) - en - [**FR**](https://blog.pradeo.com/fr) - [**DE**](https://blog.pradeo.com/de) ### Topics - Select a Topic ### Stay up to date SUBSCRIBE TO OUR BLOG ### Stay up to date [Cybersecurity](https://blog.pradeo.com/topic/cybersecurity) # Payment Service Directive (PSD2): What are the challenges for mobile security? ![Picture of Roxane Suau](https://blog.pradeo.com/hubfs/roxane-suau.jpg) By [Roxane Suau](https://blog.pradeo.com/author/roxane-suau) on July, 2 2019 [mailto:?subject=Take%20a%20look%20at%20this%20article](mailto:?subject=Take%20a%20look%20at%20this%20article) ![psd2-application-self-protection-rasp2](https://blog.pradeo.com/hubfs/psd2-application-self-protection-rasp2.jpg) ## What is the PSD2? The second Payment Service Directive (PSD2) and its associated [Regulatory Technical Standards](http://ec.europa.eu/finance/docs/level-2-measures/psd2-rts-2017-7782_en.pdf) (RTS) have been published by the European Banking Authority and validated by the European Parliament in early 2018. This directive aims at harmonizing the protection of electronic payments and consumers' financial data while promoting innovation and offering better experience to users. It applies to banks, payment service providers (PSP) and any other company that handles banking data.   ## Open-banking API The PSD2 requires European banks to develop their own open-banking APIs in order to standardize the flows between their information systems and third-party providers. The APIs of the banks had to be ready by March 2019 in order to undergo a period of 6 months of tests during which their performances will be sifted.    ## Precise security obligations Two complementary security principles appear among the security measures imposed by Articles 4, 7, 8 and 9 of the RTS: strong authentication and secure execution environment.  Financial service providers, including banks, must implement [authentication](https://blog.pradeo.com/sms-otp-authentication-not-safe) based on a minimum of two factors and a one-time password. In order to ensure strong authentication, the confidentiality of the code and the prevention of fraudulent access are required. The PSD2 highlights the fact that authentication is reliable only when it is ensured that the communication can not be intercepted and that the data request sender is the user itself, and not a malware. ![psd2-application-self-protection-rasp2](https://blog.pradeo.com/hs-fs/hubfs/psd2-application-self-protection-rasp2.jpg?width=681&name=psd2-application-self-protection-rasp2.jpg) To ensure strong authentication, the PSD2 requires to [secure the execution environment](https://www.pradeo.com/en-US/in-app-protection) by controlling the security of users' endpoints.   ## How to secure mobile applications execution environment?  In order to ensure the integrity of users' devices, mobile applications handling banking data and enabling financial transactions must integrate a security module that will analyze their execution environment. [Runtime Application Self-Protection (RASP)](https://blog.pradeo.com/technology-runtime-application-self-protection-rasp) technology, available as an SDK to embed within mobile applications, provides real-time diagnostics of users’ terminal integrity and conditions access to APIs accordingly. In the context of PSD2, which aims, among other things, at protecting highly distributed mobile applications, in-app protection is the key to the reliability of strong authentication.   ---   **Discover PRADEO SECURITY solution suite:** - **[App Self-Protection](https://www.pradeo.com/en-US/in-app-protection) ** - **[App Security Testing](https://www.pradeo.com/en-US/application-security-testing)** - **[Mobile Threat Protection](https://www.pradeo.com/en-US/mobile-threat-protection)**   ###### About The Author [More from this author](https://blog.pradeo.com/author/roxane-suau) ![](https://blog.pradeo.com/hs-fs/hubfs/roxane-suau.jpg?height=100&name=roxane-suau.jpg) ###### Roxane Suau #### Recommended articles [![The FBI warns of an espionage campaign targeting mobile devices](https://blog.pradeo.com/hubfs/Template%20article%20(17)-1.png)](https://blog.pradeo.com/the-fbi-warns-against-an-espionage-campaign-targeting-mobile-devices) ###### [The FBI warns of an espionage campaign targeting mobile devices](https://blog.pradeo.com/the-fbi-warns-against-an-espionage-campaign-targeting-mobile-devices) \- January 22, 2026 [![Quishing: when a QR code becomes a trap](https://blog.pradeo.com/hubfs/image%20(6).png)](https://blog.pradeo.com/quishing-when-qr-code-becomes-trap) ###### [Quishing: when a QR code becomes a trap](https://blog.pradeo.com/quishing-when-qr-code-becomes-trap) \- December 18, 2025 [![Herodotus: a banking trojan that exposes the limits of an antivirus](https://blog.pradeo.com/hubfs/Template%20article%20(5)-2.png)](https://blog.pradeo.com/herodotus-a-banking-trojan-that-exposes-the-limits-of-an-antivirus) ###### [Herodotus: a banking trojan that exposes the limits of an antivirus](https://blog.pradeo.com/herodotus-a-banking-trojan-that-exposes-the-limits-of-an-antivirus) \- November 6, 2025 ### Popular articles ### Stay up to date ### Recent articles ### Articles récents [Fence integrates Pradeo's technology to secure its clients' mobile fleets](https://blog.pradeo.com/fence-integrates-pradeos-technology-to-secure-its-clients-mobile-fleets-1) \- 2 July, 2019 [RedHook: the banking trojan that grants itself system-level access on Android](https://blog.pradeo.com/redhook-the-banking-trojan-that-grants-itself-system-level-access-on-android) \- 2 July, 2019 [What Google's latest report reveals about mobile threats](https://blog.pradeo.com/what-googles-latest-report-reveals-about-mobile-threats) \- 2 July, 2019 [Android: The 4th zero-day vulnerability patched in six months](https://blog.pradeo.com/android-the-4th-zero-day-vulnerability-patched-in-six-months-1) \- 2 July, 2019 [Vibe Coding: when AI-generated code multiplies vulnerabilities](https://blog.pradeo.com/vibe-coding-when-ai-generated-code-multiplies-vulnerabilities) \- 2 July, 2019 ### Topics - [Mobile Security (56)](https://blog.pradeo.com/topic/mobile-security) - [Mobile Application Security (46)](https://blog.pradeo.com/topic/mobile-application-security) - [Expertise (31)](https://blog.pradeo.com/topic/expertise) - [Security Alert (30)](https://blog.pradeo.com/topic/security-alert) - [Cybersecurity (29)](https://blog.pradeo.com/topic/cybersecurity) - [News (28)](https://blog.pradeo.com/topic/news) - [Partners (25)](https://blog.pradeo.com/topic/partners) - [Corporate (12)](https://blog.pradeo.com/topic/corporate) - [Events (4)](https://blog.pradeo.com/topic/events) - [Actualité (2)](https://blog.pradeo.com/topic/actualité) - [predictions (2)](https://blog.pradeo.com/topic/predictions) - [cyberattack (1)](https://blog.pradeo.com/topic/cyberattack) see all [![New Call-to-action](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/2378615/ad3111b0-9454-41ff-91f4-9eee95b1f08f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/2378615/ad3111b0-9454-41ff-91f4-9eee95b1f08f) ### Get in touch with mobile security experts [Contact us](https://www.pradeo.com/en-US/contact-us) [![](https://blog.pradeo.com/hs-fs/hubfs/pradeo_logo_white_square.png?width=90&height=74&name=pradeo_logo_white_square.png)](https://pradeo.com) European leader in mobile security, Pradeo protects business mobile devices and applications. [Read More](https://www.pradeo.com/en-US/) - [Resources](https://www.pradeo.com/en-US/pradeo-ressources#white_papers) - [UEM security](https://www.pradeo.com/en-US/uem-mdm-security) - [Use cases](https://www.pradeo.com/en-US/pradeo-ressources#use-case) - [Data protection](https://www.pradeo.com/en-US/mobile-data-privacy-regulation) - [Contact us](https://www.pradeo.com/en-US/contact-us) - [Mobile Threat Defense](https://www.pradeo.com/en-US/mobile-threat-defense) - [Mobile Application Security Testing](https://www.pradeo.com/en-US/application-security-testing) - [In-App Protection](https://www.pradeo.com/en-US/in-app-protection) - [Secure Private Store](https://www.pradeo.com/en-US/private-app-store) - [Mobile Threat Intelligence](https://www.pradeo.com/en-US/mobile-threat-intelligence#perso-threat-intelligence) ![email.svg](https://cdn2.hubspot.net/hubfs/3067823/awwal/email.svg "email.svg") [contact@pradeo.com](mailto:contact@pradeo.com) Copyright @ 2022. All Right Reserved. - - - ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Roxane Suau" }, "dateModified" : "January 27, 2021, 2:22:54 PM", "datePublished" : "2019-07-02 08:13:55", "description" : "The PSD2 aims at harmonizing the protection of electronic payments and consumers' financial data while promoting innovation and offering better experience to users. It applies to banks, payment service providers (PSP) and any other company that handles banking data.", "headline" : "Payment Service Directive (PSD2): What are the challenges for mobile security?", "image" : { "@type" : "ImageObject", "url" : "https://cdn2.hubspot.net/hubfs/2378615/psd2-application-self-protection-rasp2.jpg" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://2378615.fs1.hubspotusercontent-eu1.net/hubfs/2378615/Logo%20Pradeo%20D%C3%A9grad%C3%A9%20Long%20Couleurs.svg" }, "name" : "Pradeo" } } ```