On 13 March 2018, there was published in the Official Journal of the EU Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication.

The Delegated Regulation enters into force on 14 March 2018. It shall apply from 14 September 2019. However, paragraphs 3 and 5 of Article 30 (general obligations for access interfaces) shall apply from 14 March 2019.