Payment services law

Your online shopping is now more secure

With the application of SCA, to be able to make online purchases with a card you will need:

A message/notification that we will send to your mobile phone.
Your access code or the biometrics (fingerprint/facial recognition) activated on your secure device.

What is SCA (Strong Customer Authentication)?

Stronger authentication is one of the main measures introduced by the European Directive 2015/2366 on payment services in the internal market, known as PSD2.

The aim of this measure is to strengthen security in online shopping. For this reason, in some caseswe will send a notification to your mobile phone, and you will have to identify yourself to confirm the operation.

These new security measures help to make your online payments even more secure, so you can do your shopping with complete peace of mind, which is why it is very important that we have all your details up to date.

What changes have been made to online shopping?

You used to receive a code in an SMS message to confirm certain operations. The new regulation will require you to identify yourself to confirm these purchases: thereby strengthening security.

However, the regulation stipulates some exceptions to be applied by the bank, to enable you to finalise the purchase without going through this process, and so occasionally you will not receive this message/notification when you make an online purchase.

As a customer, what do I have to do?

In order to continue shopping online, it is essential that your data in Banco Santander is up-to-date (telephone number associated with the Digital Banking contract and Online Banking access code), so that you can receive the message/notification that will allow you to identify yourself and authorise online purchases and/or access to the App and Online Banking.

So how do I do it?

First, you will have to have an active Digital Banking contract:

If you can't remember your access code, don't worry, you can retrieve your password here.
If you don't yet have an access code, register the Online Banking service to operate and buy on Internet, and cash in on a world of benefits wherever you are, get your access code.

If you have the Santander App, you can confirm your purchases with Santander Key* simply using your fingerprint or facial recognition

It's as easy to use as paying in bricks-and-mortar shops:

When you make a purchase that requires authentication, you will get a message on your mobile, tap it to access Santander Key.
Check the details of the purchase and, if they are right, confirm by validating with your fingerprint, facial recognition or password.

Much easier, right?

To enjoy the best online shopping experience, make sure you have the latest version of the Santander App, identify the device as secure and ensure notifications are activated. Otherwise, you will receive an SMS on your mobile phone with a link you will need to access to verify your identity by entering your online banking or Santander App access code.

You can also request your access code from Online Banking and gain access to all the advantages and facilities of operating on Internet. You can always contact our branch network for any tasks.

*To confirm the transactions using your fingerprint or facial recognition, you will need a mobile device with biometrics. If you don't have one, you can continue to perform transactions using your access code.

Find out how PSD2 affects you

From September 2019 you will also need your code and telephone number in order to access your Online Banking and the Santander App.

Your access code + A code that we will send to your mobile phone.

Find out about the new PSD2 regulation

PSD2 (the Second “Payment Services Directive”) is the European Union (EU) legislation that regulates the provision of payment services and electronic payment transactions.

This legislation is intended to ensure that payment service users benefit from the advantages offered by innovation and technology to make financial transactions even more secure.

One of the measures included in the law is Double Authentication or SCA.

What else should I know about PSD2?

Two new bodies are regulated under PSD2:

The “AISP” or “Account Information Service Providers”, that allow access, always with the client's authorisation, to their accounts, even if they are held at different banks, to see their activity, and to display this information in an aggregated form (in the same application or screen).
The “PISP” or “Payment Initiation Service Providers”, that allow a payment to be made from the consumer's account to the merchant's account.

PSD2 allows Banks to provide Account Aggregation and Payment Initiation services, but also allows other non-Banks (Third Party Providers or TPPs) to be Initiators/Aggregators.

If you engage TPPs, you will be giving them permission to access the activity of your accounts, or you will allow them to initiate a payment from one of your accounts, so it is very important that you always have confidence in whoever you hire to provide these services.

At Banco Santander we recommend that you read all the information before clicking and accepting the conditions.

Remember that giving access to your bank details can involve giving access to a lot of information about your life: what you spend money on, how much and when you spend it.

If you decide to allow access to your transactions, we cannot be responsible for any use that third parties make of your data.

Access to accounts by third party providers

In compliance with Royal Decree-Law 19/2018 of 23 November on payment services and other urgent measures in financial matters and following the specifications of the Commission Delegated Regulation 2018/389 of 27 November 2017 which supplements Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common secure open communication standards, Banco Santander as a payment service provider account manager, gives access to payment initiation service providers, account information providers and payment service providers that issue card-based payment instruments to their systems through a specific interface.

To facilitate the access of these third parties to the interface, dedicated areas are provided for Banco Santander and their International Branches, where they can access to:

The technical documentation of the specific interface in various formats.
A test facility to carry out functional and connection tests.

In addition, if assistance is required, a support team is available which can be contacted through the following channels:

Email (after downloading and completing this form). Depending on the type of incident, the following contacts are available:
For questions concerning the testing facility or Sandbox: psd2.sandbox.soporte@redsys.es.
For questions concerning the production facility: psd2.hub.soporte@redsys.es.
Telephone: 917 282 321, Monday to Saturday, 08.00h to 22.00h.

Statistics on performance and availability of the dedicated interface (PDF 86.08 KB).

Statistics on performance and availability of the dedicated interface - International Branches (PDF 29.4 KB).