{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2019-02-08","gaps":[],"covered":["EBA Q&A 2018_4053 — Q&A — Length of authentication codes [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4053-length-of-authentication-codes","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4053-length-of-authentication-codes","title":"EBA Q&A 2018_4053 — Q&A — Length of authentication codes [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4053-length-of-authentication-codes","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 8 February 2019","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4053","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"fbc320fbb05b4705","change_date":null,"nearest_versions":["2019-02-08"],"first_text_date":null,"correction_applies":false,"versions":["2019-02-08"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4053-length-of-authentication-codes/versions/2019-02-08","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4053-length-of-authentication-codes/versions/2019-02-08/rev/fbc320fbb05b4705","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4053-length-of-authentication-codes/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4053-length-of-authentication-codes/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 8 Feb 2019 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2019-02-08","question_submitted_on":"2018-06-28","locators":{"published_on":"EBA Q&A register entry 2018_4053, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4053, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4053","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4053-length-of-authentication-codes.md","body_sha256":"31e87965a1c3896045fa0e3aec738f04f37c547a12029c1a0102ee19310eda55"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2018_4053 — Q&A — Length of authentication codes [Final Q&A]\"\nshortTitle: \"EBA Q&A 2018_4053 — Q&A — Length of authentication codes [Final Q&A]\"\nanswer_id: EBA_QA_2018_4053\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 97 PSD2\"\ndate: 8 February 2019\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4053\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 8 February 2019\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4053\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2018_4053, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2019-02-08\"\n  question_submitted_on: \"2018-06-28\"\n  locators:\n    published_on: \"EBA Q&A register entry 2018_4053, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2018_4053, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 8 Feb 2019 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 8 February 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4053)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2018_4053 — Q&A — Length of authentication codes \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2018_4053 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 8 February 2019; question submitted 28 June 2018 |\n| **Legal basis** | Article 97 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Length of authentication codes**\n\n### Question\n\nIs a 3 decimal-digit authentication code, which (1) is unique per each transaction and (2) complies with the other security requirements set out in Article 4 RTS, compliant with the RTS?\n\n### Background\n\nThe RTS do not specify which length and entropy requirements apply to authentication codes resulting from the use of the authentication factors. The RTS entropy and key length requirements apply only to the authentication factors (Recital 6 RTS). There is no equivalent express requirement for authentication codes.\n\nWe believe that a 3 decimal-digit authentication code that (1) is unique for each transaction and (2) complies with the other security requirements set out in Article 4 RTS is sufficiently secure.\n\n***\n\n### Answer\n\nArticle 4(2) of the Commission Delegated Regulation (EU) 2018/389 states that no information on any of the two elements necessary for strong customer authentication can be derived from the disclosure of the authentication code; that no new authentication code should be generated based on the knowledge of any other authentication code previously generated and that such code cannot be forged. Article 4(3) and 4(4) of the Delegated Regulation provides further requirements on authentication codes. Recital 4 of the Delegated Regulation states that “authentication codes should be based on solutions such as generating and validating one-time passwords, digital signatures or other cryptographically underpinned validity assertions using keys or cryptographic material stored in the authentication elements, as long as the security requirements are fulfilled”. The Delegated Regulation does not specify the length for the authentication code. Accordingly, a three decimal-digit authentication code could be valid, providing that it complies with the requirements under the Delegated Regulation and in particular, that it is resistant against the risk of being forged in its entirety or by disclosure of any of the elements from which the code was generated.\n\nFurther, given that ‘the authentication code shall be only accepted once’ as stated in Article 4(1) phrase 2 of the Delegated Regulation meaning a 3-decimal digit authentication code would only give 1000 combinations, and since Article 4(3)(b) of the Delegated Regulation specifies the maximum of 5 failed authentication attempts, there is a higher probability of guessing the value of the authentication code.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4053)\n\n## Related Level 1 articles\n\n- [Article 97 — Authentication](../../../articles/97.md)\n"}