Recital 1

(1)Article 10 of Commission Delegated Regulation (EU) 2018/389 ² provides for an exemption from the requirement laid down in Article 97 of Directive (EU) 2015/2366 to apply strong customer authentication where a payment service user is accessing the balance and the recent transactions of a payment account without disclosure of sensitive payment data. In that case, payment service providers are allowed not to apply strong customer authentication for accessing the account information, provided that strong customer authentication was applied when the account information was accessed for the first time, and at least every 90 days after that.