it used to by the bank, now the minimum security is defined by the Payment Services Directive

which is quite specific