Why it is mandatory
The second Payment Services Directive (PSD2, Directive (EU) 2015/2366) opened access to bank accounts to authorised third parties: payment initiation and account information service providers. The regulatory technical standards on strong customer authentication and secure communication, Delegated Regulation (EU) 2018/389, define how these third parties and banks identify each other.
Article 34 of that regulation requires payment service providers to rely on qualified certificates for electronic seals (QSealC) or qualified certificates for website authentication (QWAC), both under eIDAS, and requires the certificate to include the provider’s registration number and role. It has applied since 14 September 2019.
What a PSD2 QWAC adds
ETSI TS 119 495 defines the profile. On top of everything a QWAC contains, a PSD2 QWAC carries a dedicated statement with:
- The provider’s authorised roles, one or more:
PSP_AS: account servicing (banks and other providers that hold accounts);PSP_PI: payment initiation;PSP_AI: account information;PSP_IC: issuing of card-based payment instruments.
- The competent authority that authorised the provider, by name and identifier. In Portugal, Banco de Portugal.
- The authorisation number, in the
organizationIdentifierfield, formatted asPSD+ country + authority + number: for example,PSDPT-BP-….
The qualified provider checks this data against the competent authority’s public register or the European Banking Authority’s central register before issuing.
QWAC or QSealC?
| PSD2 QWAC | PSD2 QSealC | |
|---|---|---|
| Protects | The channel: identifies the parties in the TLS connection | The message: seals requests and responses |
| Where it acts | Transport layer (TLS, often mutual) | Application layer (signing HTTP requests) |
| Evidence afterwards | No signed record of the message remains | Yes, the seal travels with the data |
| Typical use | Connecting to the bank’s APIs | Signing requests in standards such as the Berlin Group’s NextGenPSD2 |
PSD2 accepts either, but many banks ask for both: the QWAC for the connection and the QSealC to sign requests. Always check the API documentation of each bank you are connecting to.
2026: the end of client authentication in public TLS certificates
In PSD2 APIs, the QWAC is often used in mutual TLS: the third party presents its certificate to the bank as a client. For that, the certificate needs the clientAuth extended key usage.
The Chrome root programme now requires hierarchies dedicated to TLS server authentication only, and Certification Authorities stopped issuing public TLS certificates with clientAuth from 15 June 2026. The effect on PSD2:
- a PSD2 QWAC issued from a hierarchy accepted by browsers can no longer serve as a client certificate;
- PSD2 QWACs for mutual TLS now come from qualified hierarchies outside browser root programmes, under ETSI TS 119 495, which Implementing Regulation 2025/2527 provides for use “outside the context of a web-browser”;
- anyone using the same certificate on the public website and on APIs should separate the two.
Check where your PSD2 QWAC is used (as server, as client, or both), whether it has clientAuth, and what each bank accepts. We go through this with you before ordering.
Who needs a PSD2 QWAC
- Banks and other account servicing providers (
PSP_AS) exposing APIs to third parties. - Payment initiation (
PSP_PI) and account information (PSP_AI) service providers, authorised or registered by the competent authority. - Issuers of card-based payment instruments (
PSP_IC). - Payment and e-money institutions with those roles.
Only providers that are already authorised or registered can request a PSD2 QWAC. Platforms that access APIs through a licensed aggregator usually rely on the aggregator’s certificate.
Documents and timelines
Besides the documents for a standard QWAC (company registry extract, identification of the legal representative and, where applicable, a power of attorney), the qualified provider confirms the PSD2 authorisation and roles in the public register. Issuance usually takes 3 to 7 business days once all documents are in. See Get a QWAC.