Strong (or 'two factor') authentication is the security feature that confronts users when they initiate a bank transfer, for example. It should already have been applied in relation to e-commerce payments, but regulators have repeatedly agreed to kick that can down the road to allow online merchants to prepare. The latest UK deadline is 14 March 2022.
There are actually three potential factors to strong customer authentication, but only two need to be applied from Inherence (something the user is), Knowledge (something only the user knows) and Possession (something the user possesses).
In an effort to be helpful, the EBA opinion of June 2019 (paras 17-23) went into some detail as to what features satisfy each factor, with Inherence being perhaps the hardest to pin down since it's an area of fast-moving technological development in biometrics etc.
By refusing to say why it won't incorporate the guidance, the FCA is perhaps hedging its bets as to whether the EBA's view is outdated or will be rolled back. But not to say whether it agrees or disagrees is hardly helpful to those trying to develop and test a solution to go live by 14 March.
