{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2019-07-19","gaps":[],"covered":["EBA Q&A 2018_4055 — Q&A — Confidentiality of offline PIN [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4055-confidentiality-of-offline-pin","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4055-confidentiality-of-offline-pin","title":"EBA Q&A 2018_4055 — Q&A — Confidentiality of offline PIN [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4055-confidentiality-of-offline-pin","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 19 July 2019","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4055","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"796fe97b65f02f70","change_date":null,"nearest_versions":["2019-07-19"],"first_text_date":null,"correction_applies":false,"versions":["2019-07-19"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4055-confidentiality-of-offline-pin/versions/2019-07-19","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4055-confidentiality-of-offline-pin/versions/2019-07-19/rev/796fe97b65f02f70","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4055-confidentiality-of-offline-pin/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4055-confidentiality-of-offline-pin/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 19 Jul 2019 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2019-07-19","question_submitted_on":"2018-06-28","locators":{"published_on":"EBA Q&A register entry 2018_4055, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4055, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4055","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4055-confidentiality-of-offline-pin.md","body_sha256":"5437a938921c48bc3e1dc3875802311fb63682bfd3be0c4c47a6ee01bbfeda15"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2018_4055 — Q&A — Confidentiality of offline PIN [Final Q&A]\"\nshortTitle: \"EBA Q&A 2018_4055 — Q&A — Confidentiality of offline PIN [Final Q&A]\"\nanswer_id: EBA_QA_2018_4055\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 97 PSD2\"\ndate: 19 July 2019\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4055\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 19 July 2019\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4055\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2018_4055, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2019-07-19\"\n  question_submitted_on: \"2018-06-28\"\n  locators:\n    published_on: \"EBA Q&A register entry 2018_4055, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2018_4055, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 19 Jul 2019 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 19 July 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4055)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2018_4055 — Q&A — Confidentiality of offline PIN \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2018_4055 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 19 July 2019; question submitted 28 June 2018 |\n| **Legal basis** | Article 97 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Confidentiality of offline PIN**\n\n### Question\n\nShould the PIN transmitted offline from a terminal to an Europay, MasterCard and Visa (EMV) card always be enciphered?\n\n### Background\n\nShould the PIN transmitted offline from a terminal to an Europay, MasterCard and Visa (EMV) card always be enciphered?\n\nThe EMV specification allows PIN validation to be performed offline between the card and the terminal. The PIN is stored securely on the chip itself. When the cardholder enters the PIN on the terminal, the PIN is transmitted to the EMV card for validation. The transmission of the PIN from the terminal to the card may be enciphered or in plain text.\n\nThe EBA has already stated that \"in an EMV chip offline transaction, either the PIN is verified offline (i.e. just between the chip and the terminal) or the transaction itself is authorised offline – usually within certain value limits. If the PIN is given, the offline transaction could be SCA compliant.” (Question 273 of Feedback Table annexed to the final draft RTS of February 23, 2017.)\n\nThe question is whether a PIN may be transmitted from the terminal to the card in plain text or should always be enciphered.\n\nOur view is that a PIN may be transmitted from the terminal to the card in plain text under certain conditions. The conditions are that the PIN is sufficiently long (e.g., 4 or 5 digits) and complies with the RTS entropy requirements (e.g., 0000 is not allowed) and that the cardholder enters the PIN via a PCI-compliant PIN Entry Device. PCI-compliant PIN Entry Devices allow for a secure transmission of the PIN even if the PIN is transmitted in plaintext. This is because, according to the PCI Security Standards, PIN Entry Devices must comply with several physical and logical security requirements.\n\n***\n\n### Answer\n\nA PIN that is transmitted and verified offline constitutes a personalised security credential (PSC) and therefore is subject to the requirements of Chapter IV of the Commission Delegated Regulation (EU) 2018/389. In particular, Article 22(1) of the Delegated Regulation states that payment service providers (PSPs) “shall ensure the confidentiality and integrity of the personalised security credentials of the payment service user”. Article 22(4) of the Delegated Regulation, in turn, requires that PSPs “shall ensure that the processing and routing of personalised security credentials and of the authentication codes generated in accordance with Chapter II take place in secure environments in accordance with strong and widely recognised industry standards.”\n\nIn addition, Article 6(1) of the Delegated Regulation states that “payment service providers shall adopt measures to mitigate the risk that the elements of strong customer authentication categorised as knowledge are uncovered by, or disclosed to, unauthorized parties.” Article 6(2) of the Delegated Regulation further states that “the use by the payer of those elements shall be subject to mitigation measures in order to prevent their disclosure to unauthorised parties.”\n\nIn relation to the above, the transmission and verification of the PIN offline would need to be carried out in a secure environment ensuring confidentiality and integrity of the Personalised security credential (PSC), which may, but is not necessarily required to, include encryption. Nevertheless, in the case where a PSP does not use encryption, said PSP should assess the risks arising from transmitting the PIN in plain text between the terminal and the card, and if needed, implement corresponding security measures to mitigate these risks.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4055)\n\n## Related Level 1 articles\n\n- [Article 97 — Authentication](../../../articles/97.md)\n"}