Payment service providers shall be allowed not to apply strong customer authentication, subject to compliance with the requirements laid down in Article 2, where a payment service user is accessing its payment account online directly, provided that access is limited to one of the following items online without disclosure of sensitive payment data:
(a)
the balance of one or more designated payment accounts;
(b)
the payment transactions executed in the last 90 days through one or more designated payment accounts.