You may have noticed a recent change when logging into your online banking space. Where you previously had to enter an identifier, a password, and then validate a code received via SMS, some regional banks now offer a shortened process. This simplification of authentication relies on new technical solutions and a rapidly evolving regulatory framework, with concrete consequences on how you access your accounts and validate your payments.
b.connect: a shared infrastructure among French banks
The most visible change has a name: b.connect. This service was designed by five major French banking groups (BNP Paribas, Groupe BPCE, Crédit Agricole, Crédit Mutuel, and Société Générale). Its principle: to replace the entry of a password on merchant sites with a one-click authentication button.
Specifically, when you pay online at a partner merchant, b.connect uses an artificial intelligence engine that analyzes your habits (IP address, device used, connection time). In the majority of cases, no additional action is required. Validation occurs transparently, without opening your banking app.
For customers of regional networks affiliated with these groups, such as Banque Populaire or regional Crédit Agricole, the rollout is gradual. Banque Populaire’s information page specifies that about eight out of ten connections are made directly. The remaining two require validation via the Sécur’Pass app.
The password does not completely disappear, but it is used much less frequently. To better understand the specific modalities for each institution, you can access the Guide Banque website which details the processes by establishment.
A point often overlooked: b.connect is operated and hosted in France. This choice of digital sovereignty distinguishes this initiative from American solutions like Apple Pay or Google Pay, which rely on foreign infrastructures.
Strong authentication and simplified processes: how the two coexist
You may be wondering if simplifying the connection means lowering security standards. The short answer: no.
The European DSP2 regulation mandates what is called strong authentication for sensitive operations. It relies on the combination of at least two of the following three factors:
- An element you know: a PIN code or password
- An element you possess: your phone, a physical card, or a dedicated device
- An element that characterizes you: a fingerprint or facial recognition
Strong authentication remains mandatory for transfers, adding a beneficiary, or increasing a card limit. Checking your balance or recent transactions does not automatically trigger this level of control.
What b.connect changes is not the level of security required by law. It’s the user journey. The AI engine assesses the risk of each transaction in real-time. When the risk is deemed low (usual purchase, recognized device), validation occurs without visible intervention. When the risk is higher, the banking app takes over.
The case of online payments at merchants
On a partner e-commerce site, the b.connect button replaces the classic login-password-SMS code sequence. The merchant no longer needs to store your credentials. The risk associated with password theft through replay is significantly reduced, as the password is simply no longer transmitted to the merchant site.
Digital divide and clients without smartphones: what the regulation provides
Regional banks have among their clientele elderly people, residents of rural areas, or individuals who are not very familiar with digital tools. For them, a process relying solely on a mobile app poses a real access problem.
The DSP2 does not mandate the use of a specific mobile application. It requires strong authentication but leaves the choice of technical means. Some banks offer physical devices that generate codes, while others provide a system via voice call.
The future European regulation on payment services anticipates at least one method suitable for people without smartphones. The political agreement reached in November 2025 also includes people with disabilities and those who are not comfortable with digital technology. The effective implementation of these provisions is not expected before 2027-2028.
In the meantime, local agencies remain the main safety net. A customer who cannot use Sécur’Pass or an equivalent device can generally go to an agency to carry out their sensitive operations. However, this solution has its limits when agencies close or reduce their hours.
What changes concretely for clients of regional banks
Rather than a list of promises, here are the tangible changes to note:
- Fewer passwords to remember: logging into partner merchant sites no longer requires creating an account with an identifier and password
- A faster validation of online purchases, with reduced friction time on the vast majority of transactions
- The maintenance of strong authentication via the banking app for high-risk operations (transfers, limit changes, adding beneficiaries)
- Data hosting in France, under French banking governance
The rollout is expected among several dozen partner brands by the end of 2026. Actual adoption will depend on the ability of regional banks to train their clients, especially those who have never used a banking mobile app.
The simplification of authentication does not mean less security. It redistributes the verification steps to make them less visible when the risk is low and more present when it increases. For clients of regional banks, the most concrete change will likely be no longer having to search for their phone to validate a purchase of a few euros online.
