<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2019-12-20","gaps":[],"covered":["EBA Q&A 2018_4054 — Q&A — Confidentiality of the application cryptogram for EMV [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4054-confidentiality-of-the-application-cryptogram-for-emv","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4054-confidentiality-of-the-application-cryptogram-for-emv","title":"EBA Q&A 2018_4054 — Q&A — Confidentiality of the application cryptogram for EMV [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4054-confidentiality-of-the-application-cryptogram-for-emv","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 20 December 2019","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4054","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"d365e9464187e1a8","change_date":null,"nearest_versions":["2019-12-20"],"first_text_date":null,"correction_applies":false,"versions":["2019-12-20"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4054-confidentiality-of-the-application-cryptogram-for-emv/versions/2019-12-20","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4054-confidentiality-of-the-application-cryptogram-for-emv/versions/2019-12-20/rev/d365e9464187e1a8","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4054-confidentiality-of-the-application-cryptogram-for-emv/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4054-confidentiality-of-the-application-cryptogram-for-emv/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 20 Dec 2019 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2019-12-20","question_submitted_on":"2018-06-28","locators":{"published_on":"EBA Q&A register entry 2018_4054, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4054, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2018_4054 — Q&A — Confidentiality of the application cryptogram for EMV [Final Q&A]"
shortTitle: "EBA Q&A 2018_4054 — Q&A — Confidentiality of the application cryptogram for EMV [Final Q&A]"
answer_id: EBA_QA_2018_4054
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 97 PSD2"
date: 20 December 2019
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4054
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 20 December 2019"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4054"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2018_4054, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2019-12-20"
  question_submitted_on: "2018-06-28"
  locators:
    published_on: "EBA Q&A register entry 2018_4054, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2018_4054, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 20 Dec 2019 [Final Q&A]**

*Final Q&A · EBA Q&A register, 20 December 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4054)*

| | |
|---|---|
| **Full title** | EBA Q&A 2018_4054 — Q&A — Confidentiality of the application cryptogram for EMV \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2018_4054 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 20 December 2019; question submitted 28 June 2018 |
| **Legal basis** | Article 97 PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Confidentiality of the application cryptogram for EMV transactions**

### Question

Are EMV (Europay, MasterCard, Visa) transactions (for which the application cryptogram is not enciphered during its transmission) compliant with the RTS on strong customer authentication?

### Background

With EMV card transactions, the card generates an application cryptogram during a transaction. This cryptogram is sent to the card issuer in online authorization and clearing messages, and can be verified by the issuer to confirm the legitimacy of the transaction. Article 22 of the RTS appears to imply that the application cryptogram should be kept confidential as it states: “Payment service providers shall ensure the confidentiality and integrity of the personalised security credentials of the payment service user, including authentication codes, during all phases of the authentication”. However the EMV application cryptogram is not required to be protected in terms of confidentiality and this does not detract from the overall security provided by EMV transactions.

In our view, EMV transactions for which the application cryptogram is not enciphered during transmission are compliant with the RTS.

***

### Answer

In accordance with Article 22(1) of the Commission Delegated Regulation (EU) 2018/389 payment service providers are required to “ensure the confidentiality and integrity of the personalised security credentials of the payment service user, including authentication codes, during all phases of the authentication”.

In that regard, in the case where the issuer uses a cryptogram, which contains personalised security credentials, including authentication codes, the issuer would need to protect the confidentiality and integrity of the respective personalised security credentials in accordance with Article 22 of the Delegated Regulation, including during the transmission of the cryptogram. This also applies when the cryptogram is used as an authentication code.

The issuer is responsible for ensuring compliance with the requirements of Article 22 of the Delegated Regulation.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4054)

## Related Level 1 articles

- [Article 97 — Authentication](../../../articles/97.md)