<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2018-10-05","gaps":[],"covered":["EBA Q&A 2018_4039 — Q&A — Qualification of SMS OTP as an authentication factor [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4039-qualification-of-sms-otp-as-an-authentication-factor","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4039-qualification-of-sms-otp-as-an-authentication-factor","title":"EBA Q&A 2018_4039 — Q&A — Qualification of SMS OTP as an authentication factor [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4039-qualification-of-sms-otp-as-an-authentication-factor","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 5 October 2018","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4039","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"eac8e78730bb2a84","change_date":null,"nearest_versions":["2018-10-05"],"first_text_date":null,"correction_applies":false,"versions":["2018-10-05"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4039-qualification-of-sms-otp-as-an-authentication-factor/versions/2018-10-05","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4039-qualification-of-sms-otp-as-an-authentication-factor/versions/2018-10-05/rev/eac8e78730bb2a84","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4039-qualification-of-sms-otp-as-an-authentication-factor/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4039-qualification-of-sms-otp-as-an-authentication-factor/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 5 Oct 2018 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2018-10-05","question_submitted_on":"2018-06-28","locators":{"published_on":"EBA Q&A register entry 2018_4039, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4039, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2018_4039 — Q&A — Qualification of SMS OTP as an authentication factor [Final Q&A]"
shortTitle: "EBA Q&A 2018_4039 — Q&A — Qualification of SMS OTP as an authentication factor [Final Q&A]"
answer_id: EBA_QA_2018_4039
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 97 PSD2"
date: 5 October 2018
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4039
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 5 October 2018"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4039"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2018_4039, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2018-10-05"
  question_submitted_on: "2018-06-28"
  locators:
    published_on: "EBA Q&A register entry 2018_4039, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2018_4039, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 5 Oct 2018 [Final Q&A]**

*Final Q&A · EBA Q&A register, 5 October 2018 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4039)*

| | |
|---|---|
| **Full title** | EBA Q&A 2018_4039 — Q&A — Qualification of SMS OTP as an authentication factor \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2018_4039 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 5 October 2018; question submitted 28 June 2018 |
| **Legal basis** | Article 97 PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Qualification of SMS OTP as an authentication factor**

### Question

Please clarify whether a One-Time Password (OTP) sent via SMS to a mobile phone qualifies as an ownership factor (“something only the user possesses”), and shall be subject to Article 7 of the RTS on strong customer authentication and secure communication.

### Background

The SMS OTP qualifies as an ownership factor (“something only the user possesses”) because it is received on a device that the cardholder owns and that has been securely associated with the cardholder by the issuer.

This ensures a valid alternative authentication method for cardholders without a smartphone with biometric capabilities.

***

### Answer

Paragraph 35 of the EBA opinion on the implementation of the Commission Delegated Regulation (EU) 2018/389 (Regulatory Technical Standards on Strong customer authentication and secure communication) clarifies that “For a device to be considered possession, there needs to be a reliable means to confirm possession through the generation or receipt of a dynamic validation element on the device”.

In this context, a one-time password sent via SMS would constitute a possession element and should therefore comply with the requirements under Article 7 of the Delegated Regulation, provided that its use is ‘subject to measures designed to prevent replication of the elements’, as required under Article 7(2) of this Delegated Regulation. The possession element would not be the SMS itself, but rather, typically, the SIM-card associated with the respective mobile number.

In addition, regardless of whether a strong customer authentication element is possession, knowledge or inherence, Article 22(1) of the Delegated Regulation requires that “payment service providers shall ensure the confidentiality and integrity of the personalised security credentials of the payment service user, including authentication codes, during all phases of the authentication” and Article 22(4) of the Delegated Regulation states that “payment service providers shall ensure that the processing and routing of personalised security credentials and of the authentication codes generated in accordance with Chapter II take place in secure environments in accordance with strong and widely recognised industry standards”.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4039)

## Related Level 1 articles

- [Article 97 — Authentication](../../../articles/97.md)