{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2018-12-14","gaps":[],"covered":["EBA Q&A 2018_4048 — Q&A — Applicability of Strong Customer Authentication (SCA) [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4048-applicability-of-strong-customer-authentication-sca-to","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4048-applicability-of-strong-customer-authentication-sca-to","title":"EBA Q&A 2018_4048 — Q&A — Applicability of Strong Customer Authentication (SCA) [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4048-applicability-of-strong-customer-authentication-sca-to","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 14 December 2018","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4048","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"d0874c7c0c111082","change_date":null,"nearest_versions":["2018-12-14"],"first_text_date":null,"correction_applies":false,"versions":["2018-12-14"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4048-applicability-of-strong-customer-authentication-sca-to/versions/2018-12-14","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4048-applicability-of-strong-customer-authentication-sca-to/versions/2018-12-14/rev/d0874c7c0c111082","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4048-applicability-of-strong-customer-authentication-sca-to/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4048-applicability-of-strong-customer-authentication-sca-to/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 14 Dec 2018 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2018-12-14","question_submitted_on":"2018-06-28","locators":{"published_on":"EBA Q&A register entry 2018_4048, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4048, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4048","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4048-applicability-of-strong-customer-authentication-sca-to.md","body_sha256":"7757c4514570ec4e89bfdbf66f3109749232c6c48ca74fff6d860a5ac4dbad0a"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2018_4048 — Q&A — Applicability of Strong Customer Authentication (SCA) [Final Q&A]\"\nshortTitle: \"EBA Q&A 2018_4048 — Q&A — Applicability of Strong Customer Authentication (SCA) [Final Q&A]\"\nanswer_id: EBA_QA_2018_4048\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 97 PSD2\"\ndate: 14 December 2018\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4048\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 14 December 2018\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4048\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2018_4048, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2018-12-14\"\n  question_submitted_on: \"2018-06-28\"\n  locators:\n    published_on: \"EBA Q&A register entry 2018_4048, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2018_4048, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 14 Dec 2018 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 14 December 2018 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4048)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2018_4048 — Q&A — Applicability of Strong Customer Authentication (SCA) \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2018_4048 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 14 December 2018; question submitted 28 June 2018 |\n| **Legal basis** | Article 97 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Applicability of Strong Customer Authentication (SCA) to existing recurring payments solutions**\n\n### Question\n\nIs Strong Customer Authentication (SCA) required if the series of recurring transactions was initiated before the date of application of the RTS?\n\n### Background\n\nThe RTS set out an exemption for recurring transactions (Article 14 RTS). In particular, SCA is not required for series of transactions with the same amount and payee. SCA is, however, required “when a payer creates, amends, or initiates for the first time, a series of recurring transactions”.\n\nThe RTS do not clarify how this exemption will apply to existing recurring payments solutions once the RTS become applicable. In particular, the RTS do not clarify whether SCA is required for the first recurring transaction carried out after the date of RTS application if the series of recurring transactions was initiated before the date of RTS application.\n\nWe believe that a sensible approach would be that recurring payments solutions already in place on the day of RTS application (e.g. existing subscription arrangements) will not require SCA. This is because it is unpractical and technically very difficult to perform SCA for subsequent transactions, as the cardholder is not ‘on-session’. In addition, these transactions have proven to be low-risk.\n\n***\n\n### Answer\n\nIn accordance with Article 14(1) of the Commission Delegated Regulation (EU) 2018/389, payment service providers shall apply strong customer authentication (SCA) when a payer creates, amends, or initiates for the first time, a series of recurring transactions with the same amount and with the same payee.\n\nAccordingly, for a series of recurring transactions created before the application of the Delegated Regulation, SCA should be required only when there is an amendment to these recurring transactions.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4048)\n\n## Related Level 1 articles\n\n- [Article 97 — Authentication](../../../articles/97.md)\n"}