{"id":1748,"date":"2019-10-23T18:07:00","date_gmt":"2019-10-23T16:07:00","guid":{"rendered":"https:\/\/www.betaalvereniging.nl\/en\/?p=1748"},"modified":"2026-08-06T23:37:08","modified_gmt":"2026-08-06T21:37:08","slug":"audit-sca-csc-under-psd2","status":"publish","type":"post","link":"https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/","title":{"rendered":"Oh no! How do I audit SCA and CSC under PSD2?"},"content":{"rendered":"\n<p class=\"has-intro-font-size wp-block-paragraph\">NOREA, the Dutch Payments Association and the Dutch Banking Association offer practical guidance for IT audits of strong customer authentication (SCA) and common and secure communication (CSC) under PSD2.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"683\" src=\"https:\/\/www.betaalvereniging.nl\/en\/wp-content\/uploads\/sites\/4\/2025\/09\/man-laptop-peinzend-1024x683.png\" alt=\"Man reviewing a document while sitting behind a laptop.\" class=\"wp-image-1750\" srcset=\"https:\/\/www.betaalvereniging.nl\/en\/wp-content\/uploads\/sites\/4\/2025\/09\/man-laptop-peinzend-1024x683.png 1024w, https:\/\/www.betaalvereniging.nl\/en\/wp-content\/uploads\/sites\/4\/2025\/09\/man-laptop-peinzend-300x200.png 300w, https:\/\/www.betaalvereniging.nl\/en\/wp-content\/uploads\/sites\/4\/2025\/09\/man-laptop-peinzend-768x512.png 768w, https:\/\/www.betaalvereniging.nl\/en\/wp-content\/uploads\/sites\/4\/2025\/09\/man-laptop-peinzend.png 1225w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The Payments Knowledge Group of NOREA (<a href=\"https:\/\/www.norea.nl\/\">the professional association of IT auditors in the Netherlands (in Dutch) <span class=\"icon inline-block ml-1 w-[0.875em]\" aria-hidden=\"true\"><svg aria-hidden=\"true\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"32\" height=\"32\" fill=\"#000000\" viewBox=\"0 0 256 256\"><path d=\"M228,104a12,12,0,0,1-24,0V69l-59.51,59.51a12,12,0,0,1-17-17L187,52H152a12,12,0,0,1,0-24h64a12,12,0,0,1,12,12Zm-44,24a12,12,0,0,0-12,12v64H52V84h64a12,12,0,0,0,0-24H48A20,20,0,0,0,28,80V208a20,20,0,0,0,20,20H176a20,20,0,0,0,20-20V140A12,12,0,0,0,184,128Z\"><\/path><\/svg><\/span><\/a>), the Dutch Payments Association and the Dutch Banking Association (<a href=\"https:\/\/www.nvb.nl\/\">NVB (in Dutch) <span class=\"icon inline-block ml-1 w-[0.875em]\" aria-hidden=\"true\"><svg aria-hidden=\"true\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"32\" height=\"32\" fill=\"#000000\" viewBox=\"0 0 256 256\"><path d=\"M228,104a12,12,0,0,1-24,0V69l-59.51,59.51a12,12,0,0,1-17-17L187,52H152a12,12,0,0,1,0-24h64a12,12,0,0,1,12,12Zm-44,24a12,12,0,0,0-12,12v64H52V84h64a12,12,0,0,0,0-24H48A20,20,0,0,0,28,80V208a20,20,0,0,0,20,20H176a20,20,0,0,0,20-20V140A12,12,0,0,0,184,128Z\"><\/path><\/svg><\/span><\/a>) have <a href=\"https:\/\/www.norea.nl\/nieuws\/6240\/handreiking-auditaanpak-psd2-gepubliceerd\">published guidance on an audit approach (in Dutch) <span class=\"icon inline-block ml-1 w-[0.875em]\" aria-hidden=\"true\"><svg aria-hidden=\"true\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"32\" height=\"32\" fill=\"#000000\" viewBox=\"0 0 256 256\"><path d=\"M228,104a12,12,0,0,1-24,0V69l-59.51,59.51a12,12,0,0,1-17-17L187,52H152a12,12,0,0,1,0-24h64a12,12,0,0,1,12,12Zm-44,24a12,12,0,0,0-12,12v64H52V84h64a12,12,0,0,0,0-24H48A20,20,0,0,0,28,80V208a20,20,0,0,0,20,20H176a20,20,0,0,0,20-20V140A12,12,0,0,0,184,128Z\"><\/path><\/svg><\/span><\/a> for SCA (<em>Strong Customer Authentication<\/em>) and CSC (<em>Common &amp; Secure Communication<\/em>) under PSD2 (<em>Revised Payment Services Directive<\/em>).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guidance is an initial <em>minimum viable product<\/em>: practical advice developed in the summer of 2019 following consultation with IT auditors and stakeholders. It helps auditors follow a widely agreed, harmonised and workable audit approach that is aligned with legal requirements. The recommendations in the guidance are endorsed by the financial institutions consulted and can also be used by other organisations that must comply with PSD2. It supports a flexible approach that reuses previous audit work and can be adapted easily if the requirements change.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.norea.nl\/nieuws\/6240\/handreiking-auditaanpak-psd2-gepubliceerd\"><em>Read the full guidance from NOREA, the Dutch Payments Association and the Dutch Banking Association (in Dutch)\u2026<\/em> <span class=\"icon inline-block ml-1 w-[0.875em]\" aria-hidden=\"true\"><svg aria-hidden=\"true\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"32\" height=\"32\" fill=\"#000000\" viewBox=\"0 0 256 256\"><path d=\"M228,104a12,12,0,0,1-24,0V69l-59.51,59.51a12,12,0,0,1-17-17L187,52H152a12,12,0,0,1,0-24h64a12,12,0,0,1,12,12Zm-44,24a12,12,0,0,0-12,12v64H52V84h64a12,12,0,0,0,0-24H48A20,20,0,0,0,28,80V208a20,20,0,0,0,20,20H176a20,20,0,0,0,20-20V140A12,12,0,0,0,184,128Z\"><\/path><\/svg><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Practical guidance for auditing strong customer authentication and common and secure communication under PSD2, developed by NOREA and the Dutch banking sector.<\/p>\n","protected":false},"author":7,"featured_media":1746,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"editor_notices":[],"footnotes":""},"categories":[57,20],"btv_subject_tax":[10,13],"class_list":["post-1748","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-consultation","category-news","btv_subject_tax-digital-identity","btv_subject_tax-european-legislation"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin  - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Auditaanpak voor SCA en CSC onder PSD2: Handleiding - Dutch Payments Association<\/title>\n<meta name=\"description\" content=\"Leer over de auditaanpak voor SCA en CSC onder PSD2, een praktische richtlijn samengesteld door NOREA en de Betaalvereniging.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Oh no! How do I audit SCA and CSC under PSD2?\" \/>\n<meta property=\"og:description\" content=\"Leer over de auditaanpak voor SCA en CSC onder PSD2, een praktische richtlijn samengesteld door NOREA en de Betaalvereniging.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/\" \/>\n<meta property=\"og:site_name\" content=\"Dutch Payments Association\" \/>\n<meta property=\"article:published_time\" content=\"2019-10-23T16:07:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-06T21:37:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.betaalvereniging.nl\/en\/wp-content\/uploads\/sites\/4\/2019\/11\/VBNL_bankpasphishing_2230947791.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"500\" \/>\n\t<meta property=\"og:image:height\" content=\"334\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@NLbetalen\" \/>\n<meta name=\"twitter:site\" content=\"@NLbetalen\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/news\\\/audit-sca-csc-under-psd2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/news\\\/audit-sca-csc-under-psd2\\\/\"},\"author\":{\"name\":\"\",\"@id\":\"\"},\"headline\":\"Oh no! How do I audit SCA and CSC under PSD2?\",\"datePublished\":\"2019-10-23T16:07:00+00:00\",\"dateModified\":\"2026-08-06T21:37:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/news\\\/audit-sca-csc-under-psd2\\\/\"},\"wordCount\":196,\"image\":{\"@id\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/news\\\/audit-sca-csc-under-psd2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/4\\\/2019\\\/11\\\/VBNL_bankpasphishing_2230947791.jpg\",\"articleSection\":[\"Consultation\",\"News\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/news\\\/audit-sca-csc-under-psd2\\\/\",\"url\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/news\\\/audit-sca-csc-under-psd2\\\/\",\"name\":\"Auditaanpak voor SCA en CSC onder PSD2: Handleiding - Dutch Payments Association\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/news\\\/audit-sca-csc-under-psd2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/news\\\/audit-sca-csc-under-psd2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/4\\\/2019\\\/11\\\/VBNL_bankpasphishing_2230947791.jpg\",\"datePublished\":\"2019-10-23T16:07:00+00:00\",\"dateModified\":\"2026-08-06T21:37:08+00:00\",\"author\":{\"@id\":\"\"},\"description\":\"Leer over de auditaanpak voor SCA en CSC onder PSD2, een praktische richtlijn samengesteld door NOREA en de Betaalvereniging.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/news\\\/audit-sca-csc-under-psd2\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/news\\\/audit-sca-csc-under-psd2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/news\\\/audit-sca-csc-under-psd2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/4\\\/2019\\\/11\\\/VBNL_bankpasphishing_2230947791.jpg\",\"contentUrl\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/4\\\/2019\\\/11\\\/VBNL_bankpasphishing_2230947791.jpg\",\"width\":500,\"height\":334,\"caption\":\"Stack of payment cards on keyboard being pierced by a fishing hook as a symbol of online fraud and phishing.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/news\\\/audit-sca-csc-under-psd2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Oh no! How do I audit SCA and CSC under PSD2?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/\",\"name\":\"Dutch Payments Association\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"\",\"url\":\"https:\\\/\\\/www.betaalvereniging.nl\\\/en\\\/news\\\/author\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Auditaanpak voor SCA en CSC onder PSD2: Handleiding - Dutch Payments Association","description":"Leer over de auditaanpak voor SCA en CSC onder PSD2, een praktische richtlijn samengesteld door NOREA en de Betaalvereniging.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/","og_locale":"en_US","og_type":"article","og_title":"Oh no! How do I audit SCA and CSC under PSD2?","og_description":"Leer over de auditaanpak voor SCA en CSC onder PSD2, een praktische richtlijn samengesteld door NOREA en de Betaalvereniging.","og_url":"https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/","og_site_name":"Dutch Payments Association","article_published_time":"2019-10-23T16:07:00+00:00","article_modified_time":"2026-08-06T21:37:08+00:00","og_image":[{"width":500,"height":334,"url":"https:\/\/www.betaalvereniging.nl\/en\/wp-content\/uploads\/sites\/4\/2019\/11\/VBNL_bankpasphishing_2230947791.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_creator":"@NLbetalen","twitter_site":"@NLbetalen","twitter_misc":{"Written by":"","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/#article","isPartOf":{"@id":"https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/"},"author":{"name":"","@id":""},"headline":"Oh no! How do I audit SCA and CSC under PSD2?","datePublished":"2019-10-23T16:07:00+00:00","dateModified":"2026-08-06T21:37:08+00:00","mainEntityOfPage":{"@id":"https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/"},"wordCount":196,"image":{"@id":"https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/#primaryimage"},"thumbnailUrl":"https:\/\/www.betaalvereniging.nl\/en\/wp-content\/uploads\/sites\/4\/2019\/11\/VBNL_bankpasphishing_2230947791.jpg","articleSection":["Consultation","News"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/","url":"https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/","name":"Auditaanpak voor SCA en CSC onder PSD2: Handleiding - Dutch Payments Association","isPartOf":{"@id":"https:\/\/www.betaalvereniging.nl\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/#primaryimage"},"image":{"@id":"https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/#primaryimage"},"thumbnailUrl":"https:\/\/www.betaalvereniging.nl\/en\/wp-content\/uploads\/sites\/4\/2019\/11\/VBNL_bankpasphishing_2230947791.jpg","datePublished":"2019-10-23T16:07:00+00:00","dateModified":"2026-08-06T21:37:08+00:00","author":{"@id":""},"description":"Leer over de auditaanpak voor SCA en CSC onder PSD2, een praktische richtlijn samengesteld door NOREA en de Betaalvereniging.","breadcrumb":{"@id":"https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/#primaryimage","url":"https:\/\/www.betaalvereniging.nl\/en\/wp-content\/uploads\/sites\/4\/2019\/11\/VBNL_bankpasphishing_2230947791.jpg","contentUrl":"https:\/\/www.betaalvereniging.nl\/en\/wp-content\/uploads\/sites\/4\/2019\/11\/VBNL_bankpasphishing_2230947791.jpg","width":500,"height":334,"caption":"Stack of payment cards on keyboard being pierced by a fishing hook as a symbol of online fraud and phishing."},{"@type":"BreadcrumbList","@id":"https:\/\/www.betaalvereniging.nl\/en\/news\/audit-sca-csc-under-psd2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.betaalvereniging.nl\/en\/"},{"@type":"ListItem","position":2,"name":"Oh no! How do I audit SCA and CSC under PSD2?"}]},{"@type":"WebSite","@id":"https:\/\/www.betaalvereniging.nl\/en\/#website","url":"https:\/\/www.betaalvereniging.nl\/en\/","name":"Dutch Payments Association","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.betaalvereniging.nl\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"","url":"https:\/\/www.betaalvereniging.nl\/en\/news\/author\/"}]}},"_links":{"self":[{"href":"https:\/\/www.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/posts\/1748","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/www.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/comments?post=1748"}],"version-history":[{"count":3,"href":"https:\/\/www.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/posts\/1748\/revisions"}],"predecessor-version":[{"id":5630,"href":"https:\/\/www.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/posts\/1748\/revisions\/5630"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/media\/1746"}],"wp:attachment":[{"href":"https:\/\/www.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/media?parent=1748"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/categories?post=1748"},{"taxonomy":"btv_subject_tax","embeddable":true,"href":"https:\/\/www.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/btv_subject_tax?post=1748"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}