There was a bunch of stuff to do with this in the first payment service directive, most of which was enforced around 2012-2013

https://en.wikipedia.org/wiki/Payment_Services_Directive

PSD2 has requirements on "strong customer authentication" basically requiring 2-factor, that were meant to come into force on Saturday the 14th of September just passed, but ended up being delayed at the last minute in most countries.