--- title: "EBA Q&A 2018_4052 — Q&A — EMV cards and EMV terminals supporting online [Final Q&A]" shortTitle: "EBA Q&A 2018_4052 — Q&A — EMV cards and EMV terminals supporting online [Final Q&A]" answer_id: EBA_QA_2018_4052 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 97 PSD2" date: 26 October 2018 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4052 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 26 October 2018" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4052" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2018_4052, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2018-10-26" question_submitted_on: "2018-06-28" locators: published_on: "EBA Q&A register entry 2018_4052, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2018_4052, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 26 Oct 2018 [Final Q&A]** *Final Q&A · EBA Q&A register, 26 October 2018 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4052)* | | | |---|---| | **Full title** | EBA Q&A 2018_4052 — Q&A — EMV cards and EMV terminals supporting online \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2018_4052 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 26 October 2018; question submitted 28 June 2018 | | **Legal basis** | Article 97 PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **EMV cards and EMV terminals supporting online authentication** ### Question Is there a need for Europay, MasterCard, Visa (EMV) cards and EMV terminals supporting online authentication in compliance with the RTS to support also offline authentication? ### Background This question relates to the practical application of the RTS to EMV cards and EMV terminals supporting online authentication in the context of a contact EMV transaction. Most EMV terminal types are online with offline capabilities. Online authentication means that cards are authenticated in real-time by the issuer. More specifically, the card generates a dynamic application cryptogram and the transaction is always sent online to the issuer for validation. The issuer authorises the transaction only if the dynamic application cryptogram and the PIN are valid. Conversely, offline authentication uses data from the card to allow the terminal to authenticate the card. There are three levels of offline authentication: (1) Static Data Authentication (SDA), (2) Dynamic Data Authentication (DDA), and (3) Combined Data Authentication (CDA). Offline authentication is used when it is not possible to send the transaction online in real-time to the issuer (e.g., transit). Some EMV terminals (for example ATMs) are online only and do not support offline authentication. In this case, the infrastructure is a real-time online only environment. It is not possible to authenticate the transaction offline. This means that the card generates a dynamic application cryptogram and the transaction is always sent online to the issuer for validation. The issuer authorises the transaction only if the dynamic application cryptogram and the PIN are valid.EMV cards supporting online only authentication do not allow transactions offline. We believe that there is no need for contact EMV cards and EMV terminals that allow only for online authentication to be changed. This is because the RTS do not require EMV cards and EMV terminals to support also offline authentication if they already support an online authentication that is compliant with the RTS. *** ### Answer The Commission Delegated Regulation (EU) 2018/389 does not specify whether in the case of card payments, payment cards and terminals should support offline authentication. Further, this Regulation does not distinguish between online and offline authentication, therefore the requirements regarding Strong Customer Authentication (SCA) apply irrespective of the operating framework. This means that Payment Service Providers (PSPs) shall apply SCA to all electronic payment transactions (including dynamic linking for remote transactions), unless they choose to apply an exemption (for instance the exemption for unattended terminals for transport fares and parking fees in Article 12 of the Regulation). The decision, whether EMV cards and EMV terminals support offline authorisation, in addition to online authorisation, is up to the respective payment services providers. However, if they choose to use also an offline environment, this has to support SCA, as long as the environment is not exclusively used for payments to which an exemption under the RTS apply. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4052) ## Related Level 1 articles - [Article 97 — Authentication](../../../articles/97.md)