Protocol No.
P-AL-001
Sigil
Entry
Issued
2026-05-26

Protocol 01 of 08 · Banking

ApprovedSMSPush

PSD2 SCA: low-latency OTP delivery for online banking in Albania

Albanian banks (BKT, Raiffeisen Albania, Credins, Intesa Sanpaolo Bank Albania, OTP Bank Albania) enforce PSD2 SCA for online transactions. 4notify dispatches OTP through tier-1 international gateway with preserved alphanumeric sender ID and P50 <3s across all three Albanian carriers.

Duty

An OTP that doesn't reach the user within 30s causes transaction abandonment and often switch to a competitor. At peak hours (payroll, end-of-month transfers), delays compound on grey routes.

Legal framework

Direktiva PSD2 + RTS 2018/389 SCA

Two independent factors required; every failure must be logged for Bank of Albania inspection.

Ligji 73/2017 — Shërbimet e pagesave

Provider duty to enforce SCA on remote electronic transactions.

AKEP — Rregullore për SMS A2P

Alphanumeric sender ID allowed; abuse (spoofing) is sanctioned with suspension.

Steps

Premium tier-1 routing

OTPs routed over tier-1 premium gateway — never a grey route. Alphanumeric sender ID preserved, DLRs return within 2s.

Automatic carrier detection

HLR lookup before dispatch classifies number into Vodafone AL / One AL / ALBtelecom. Per-carrier statistics in dashboard.

TTL and one-time use

Every OTP issued with 5-minute TTL and one-time use. After use or expiry, token marked 'consumed' in vault.

Push fallback for bank apps

If user has bank's official app installed, OTP sent as encrypted push first. SMS routed only if push fails.

Code

bash
curl -X POST https://api.4notify.net/v1/otp \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "purpose": "psd2_sca",
    "recipient": {
      "phone": "+355692345678",
      "push_token": "fcm:abc..."
    },
    "session_id": "TRX-AL-2026-39402",
    "transaction": {
      "amount": 12500,
      "currency": "ALL",
      "merchant": "CONAD TIRANA"
    },
    "ttl_seconds": 300,
    "channels_priority": ["push", "sms"]
  }'