Skip to content

Amended Uniform Security Rules for Consumers

Published on:

The revised Payment Services Directive (PSD2) has been in force in the Netherlands since 19 February 2019. As a result, the Dutch banks’ Uniform Security Rules for Consumers had to be amended in consultation with the Dutch Consumers’ Association.

The Uniform Security Rules have applied since 2014 and were drawn up by the banks in consultation with the Dutch Consumers’ Association. These collective security rules apply to electronic banking and payments and replaced the individual rules that banks had used until 2014.

Key amendments

No personal-liability amount

Under the new Uniform Security Rules, the payer is no longer subject to a personal-liability amount for an unauthorised payment transaction. The original rules specified an amount of €150, as required by PSD1. PSD2 reduced this amount for payers to €50. Dutch law abolished it altogether, however, so it has also been removed from the Uniform Security Rules.

Using online banking security codes with third parties

Under PSD2, a payment account holder—a bank customer—may in certain cases enter their bank’s online banking security codes on the website or in the app of a third party authorised by De Nederlandsche Bank (DNB) , in order to use a payment initiation service or an account information service. Whether security codes actually need to be entered with a third party differs from bank to bank. The Uniform Security Rules may therefore also differ between banks on this point.

PSD2 allows non-bank financial service providers—third parties—to offer bank customers new types of services for their payment accounts: account information services and payment initiation services. To provide these services in the Netherlands, a provider must be authorised by DNB . If a bank customer wants to use these services, they give the third party access to their payment account to initiate a payment, in the case of a payment initiation service, or retrieve account information, in the case of an account information service. A bank may also offer these services to its own customers for payment accounts held with other banks.

Two versions of the Uniform Security Rules have been drawn up to clarify whether and when an account holder may enter their bank’s online banking security codes on a third party’s website or in its app. The Dutch Payments Association also publishes a third version of the Uniform Security Rules that clearly shows the differences between the two versions.

Each bank uses only one of the two versions of the Uniform Security Rules for its own retail customers. An individual bank may change the wording and add explanations, provided that it does not make any fundamental changes to the original rules. Each bank’s Uniform Security Rules (in Dutch) remain easy for retail customers to recognise and find.

You can read the Uniform Security Rules here:

Related articles