Payment Services and Gatekeepers: Outsourcing Agreements for Strong Customer Authentication to Critical Technical Service Providers (CUADERNOS DE DERECHO TRANSNACIONAL)

Summary

• The article examines how payment services interact with digital markets, including the loyalty strategies of gatekeepers that integrate payments into their processes.p.1
• Strong customer authentication requires at least two independent elements: knowledge, possession or inherence (biometrics).p.4
• A payment provider that does not apply mandatory strong customer authentication bears full liability towards the user for incorrectly executed transactions.p.4
• The new payment rules allow strong customer authentication to be delegated to an entity other than the account-holding institution or the payment service provider.p.6
• DORA classifies strong customer authentication as an essential function and allows supervisors such as the EBA to designate technical service providers as critical.p.10
• Apple was fined half a million euros for blocking steering under the Digital Markets Act and ordered to allow external links and alternative payments in the EU.p.18

Key insights

1. Delegating strong customer authentication to technical providers such as pass-through digital wallet operators is a recurring market practice that the draft payment regulation sought to give legal certainty.p.7
2. The text dated 17 April 2026 keeps the outsourcing article title but is significantly shorter and simpler than the original presented in 2023.p.8
3. DORA treats strong customer authentication as an essential function rather than an ordinary technical service, so technology providers face specific obligations.p.10
4. Under DORA, authorities such as the EBA can designate certain technical providers as critical, placing them under direct supervision by financial regulators.p.11
5. Banks cannot treat outsourcing as a transfer of risk to technology firms, only as a transfer of technical execution; final responsibility stays with the payment service provider.p.12
6. Behavioural biometrics, which tracks how devices are held and how users type, lets institutions block transactions that deviate from usual behaviour.p.13
7. Supervisors, in particular the EBA, are concerned about dependence on a small number of technical providers, among them gatekeepers.p.14
8. The authentication system is deemed unavailable when five consecutive access requests fail or receive no response within 30 seconds, obliging the provider to continue the service through its own system.p.20