Enforce strong customer authentication
Security and data protection: Enforce strong customer authentication. Starts when: Every payment or access. Steps: Require two factors; Device binding; Exemptions logged. Done when: Each payment receipt cites the SCA event. Rules that apply: PSRs 2017 reg 100; SCA RTS.