Payment service providers shall ensure that the creation of personalised security credentials is performed in a secure environment.
They shall mitigate the risks of unauthorised use of the personalised security credentials and of the authentication devices and software following their loss, theft or copying before their delivery to the payer.