The Anti-Malware Requirement in PSD2

PSD2’s Regulatory Technical Standards require all parties involved in financial transactions—especially Account Servicing Payment Service Providers (ASPSPs) and Third-Party Providers (TPPs)—to detect and mitigate “signs of malware infection” during transaction and authentication sessions. Credential-stealing malware is treated as a major driver of transaction fraud risk, and the RTS mandates that transaction monitoring mechanisms explicitly account for malware signals alongside other risk-based factors such as compromised authentication elements, transaction amount, and known fraud scenarios.

Meeting the requirement implies deploying anti-malware capabilities across the full transaction environment, not only in traditional bank infrastructure but also in newer PSD2 components. Existing enterprise anti-malware and endpoint/server security controls are commonly present in core banking and transaction processing systems, online banking web tiers, and ATM/POS devices. However, full compliance requires extending these protections to PSD2-compliant API gateways (including those aligned to Open Banking Project or Berlin Group XS2A standards) and to mobile banking/payment applications. API gateway protection is presented as straightforward because gateways typically run on operating systems or cloud environments that already support anti-malware tooling.

A critical implication of monitoring “any sessions of the authentication procedure” is that malware risk must also be evaluated on Payment Service User (PSU) devices. This creates pressure for anti-malware presence and scan status to be measurable at the client side and reportable to bank/TPP risk systems. Risk-adaptive (adaptive) multi-factor authentication is positioned as the decision layer that consumes malware posture and other signals (e.g., IP address, geolocation, device health), raising risk scores when protection is missing or outdated, and triggering Strong Customer Authentication or transaction blocking depending on policy.

• PSD2 RTS requires transaction monitoring mechanisms to consider “signs of malware infection in any sessions of the authentication procedure.”
• Transaction monitoring must account for lists of compromised or stolen authentication elements.
• Transaction monitoring must account for the amount of each payment transaction.
• Transaction monitoring must account for known fraud scenarios in the provision of payment services.
• Among Android devices, the largest percentage of malware types target mobile banking apps for credential theft.
• Many financial institutions already use enterprise anti-malware and endpoint/server security solutions at critical infrastructure points.
• Core banking and transaction processing systems are identified as locations where anti-malware tools should be deployed.
• Web-based online banking infrastructure is identified as a location where anti-malware tools should be deployed.
• ATMs and Point-of-Sale systems are identified as locations where anti-malware tools should be deployed.
• PSD2-compliant API gateways and mobile banking/payment apps are highlighted as areas requiring anti-malware coverage for full compliance.

• “Payment service providers shall ensure that the transaction monitoring mechanisms takes into account, at a minimum, each of the following risk-based factors: lists of compromised or stolen authentication elements; the amount of each payment transaction; known fraud scenarios in the provision of payment services; signs of malware infection in any sessions of the authentication procedure.”
• “Malware, particularly of the credential stealing variety, is a significant problem in the realm of financial transactions.”
• “Anti-malware solutions must be in operation at all relevant points within the environment (from client to transaction processing systems) to determine whether malware is a risk.”
• “Protecting the API gateways that are being or will be implemented to satisfy those requirements under PSD2 is a fairly straightforward task.”
• “PSU devices also need to have anti-malware solutions installed.”
• “A lack of anti-malware capability or outdated anti-malware will increase the overall transaction risk score.”
• “AA solutions generally provide multiple authentication methods including: username/ password, Knowledge-Based Authentication, OTP, social logins, mobile apps, mobile biometrics, USB keys, SmartCards, and User Behavioral Analysis (UBA).”
• “AA products usually can evaluate other environmental risk factors, including requesting device IP address, geo-location, geo-velocity, and device health.”
• “Malware can also hijack sessions or use unsecured credentials for replay attacks.”
• “Banks and TPPs may also consider working with anti-malware vendors to package anti-malware functionality alongside their mobile banking and payment apps.”