(3)In order to ensure proper balance between the objectives of Directive (EU) 2015/2366 of enhancing security, facilitating innovation and enhancing competition in the internal market, it is necessary to further specify the application of the exemption set out in Article 10 of Delegated Regulation (EU) 2018/389, for cases where the account information is accessed through an account information service provider. Accordingly, in such a case, payment service providers should not be allowed to choose whether or not to apply strong customer authentication, and the exemption should be made mandatory, subject to conditions that aim to ensure that the safety and security of the payment service users’ data is being met.