In these YouTube videos Challenge-Respond Mode and Sign Mode the customer enters a challenge into the CAP device before generating a one time password. Why not just generate the one time password directly?
I think this is to ensure that the response entered into the website is a fresh(ish) one. If the one time password was generated directly then it could be used at any point in the future, the server has no way of checking when it was generated. By providing the challenge to the card it means that the response generated can only be used for the transaction with the matching challenge.
Here's an example of an attack that takes advantage of the fact that a challenge isn't used for all online transaction or logging into your bank account:
It's taken from Optimised to Fail: Card Readers for Online Banking by Ross Anderson, a paper that talks about the CAP protocol and its various vulnerabilities. His group have many other interesting papers as does their site on Chip and PIN.