Digital and Innovation: Channels, Payments and Operational Resilience
What this domain tests
Digital and Innovation covers channel design, payment security, operational resilience and outsourcing. The exam expects you to separate customer-facing innovation from the controls that still apply: PSD2 strong customer authentication, DORA, the Consumer Protection Code and outsourcing rules.
Core rules
- Strong customer authentication needs two independent elements from knowledge, possession and inherence. Exemptions include low-value contactless payments, recurring same-amount payments to the same payee and secure corporate payment processes; firms must still monitor fraud.
- DORA requires ICT risk management, incident classification and reporting, resilience testing, a register of third-party providers and concentration-risk analysis.
- Material outsourcing needs a written agreement, exit plan, supervisory access and, where required, notification to the Central Bank of Ireland. Accountability stays with the bank.
- Distance marketing and digital onboarding must still deliver clear fees, cancellation rights and accessibility for vulnerable customers.
- Innovation sandboxes may relax testing constraints, not the underlying rules.
Worked example
A bank launches mobile onboarding using a password plus a one-time code sent to the same phone. That is knowledge plus possession, but the phone is a single device and number porting weakens it. Adding a biometric or using a separate authenticator strengthens the second factor. If the authentication vendor fails for six hours, the bank classifies the incident under DORA, activates a fallback, notifies the regulator if thresholds are met and tells affected customers.
Traps
- Applying strong authentication only at login and not at payment initiation.
- Treating open banking as free data.
- Believing outsourcing delegates responsibility.
- Assuming a sandbox waives conduct rules.