What laws?
I'll update if I remember the name.
https://en.wikipedia.org/wiki/Payment_Services_Directive
PSD2 has requirements on "strong customer authentication" basically requiring 2-factor, that were meant to come into force on Saturday the 14th of September just passed, but ended up being delayed at the last minute in most countries.