<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2018-12-21","gaps":[],"covered":["EBA Q&A 2018_4068 — Q&A — Exemption from strong customer authentication (SCA) [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4068-exemption-from-strong-customer-authentication-sca-for","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4068-exemption-from-strong-customer-authentication-sca-for","title":"EBA Q&A 2018_4068 — Q&A — Exemption from strong customer authentication (SCA) [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4068-exemption-from-strong-customer-authentication-sca-for","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 21 December 2018","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4068","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"1c4d9f2399fc3f26","change_date":null,"nearest_versions":["2018-12-21"],"first_text_date":null,"correction_applies":false,"versions":["2018-12-21"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4068-exemption-from-strong-customer-authentication-sca-for/versions/2018-12-21","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4068-exemption-from-strong-customer-authentication-sca-for/versions/2018-12-21/rev/1c4d9f2399fc3f26","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4068-exemption-from-strong-customer-authentication-sca-for/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4068-exemption-from-strong-customer-authentication-sca-for/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 21 Dec 2018 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2018-12-21","question_submitted_on":"2018-07-03","locators":{"published_on":"EBA Q&A register entry 2018_4068, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4068, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2018_4068 — Q&A — Exemption from strong customer authentication (SCA) [Final Q&A]"
shortTitle: "EBA Q&A 2018_4068 — Q&A — Exemption from strong customer authentication (SCA) [Final Q&A]"
answer_id: EBA_QA_2018_4068
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 97(1) PSD2"
date: 21 December 2018
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4068
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 21 December 2018"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4068"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2018_4068, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2018-12-21"
  question_submitted_on: "2018-07-03"
  locators:
    published_on: "EBA Q&A register entry 2018_4068, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2018_4068, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 21 Dec 2018 [Final Q&A]**

*Final Q&A · EBA Q&A register, 21 December 2018 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4068)*

| | |
|---|---|
| **Full title** | EBA Q&A 2018_4068 — Q&A — Exemption from strong customer authentication (SCA) \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2018_4068 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 21 December 2018; question submitted 3 July 2018 |
| **Legal basis** | Article 97(1) PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Exemption from strong customer authentication (SCA) for payment account information in combination with accessing account information online in web browser**

### Question

Is it acceptable to abstain from applying the 5-minute-rule when the strong customer authentication (SCA)-exemption for payment account information is in use?

### Background

To be able to trade online securities the user have to know about the balance of his account, so he can decide whether or not he will trade.

For this process the user uses a web api, that will stay online for more than five minutes to be able to trade direct without delay by a new authentication.

It is our understanding of RTS Article 4 (3) d), that given authentication runs off in browser-based application, if user has no activity by online access to his payment accounts. After that the authentication has to be renewed. In browser-based application this means, that the affected functionalities should be deactivated. The session has expired and for further actions a new authentication is required.

The fixed time is impractical in our opinion.

The actual available funds on payment account are constantly displayed in browser-based application for trading securities. The related payment account belongs to the securities account of the user. The payment account is used for clearing transactions on the security account (referring to Question 2018-4023). The user observes trends of securities and wants to be able to act without hesitation in our browser based application. Observing trends of securities often needs more time than five minutes. So we want to avoid, that the user has to renew his authentication for online access to his payment account, when he wants to check his funds for placing an order.

By using the exemption from SCA for payment account information (RTS Art. 10) we (ASPSP) shall be allowed not to apply SCA where the conditions mentioned in RTS are accordingly met. Applying this exemption leads in our opinion to the fact, that we do not have to deactivate the display of payment account information in browser-based application when the user has no activity for five or more minutes. We think, there is no difference between accessing payment account information for example through AISP to accessing it in browser-based application. The channels used for

accessing payment account information are not marked to be relevant for applying exemption from SCA in RTS. So, if user is not accessing payment account information for the first time and the last authentication using SCA is not 90 days or more ago, the payment account information can be displayed independently from activity by the user in the application. When applying SCA for log in the browser-based application the payment account information can constantly displayed, because counting the days starts new with log in every time.

Accessing remittance form can act independent to payment account information in sense ot the five-minute-rule an requires authentication after more than five minutes inactivity. Our focus are the payment account information for displaying them to the user.

***

### Answer

Article 4(3)(d) of the Commission Delegated Regulation (EU) 2018/389 states that payment service providers (PSPs) shall ensure that the authentication by means of generating an authentication code includes, inter alia, a maximum time of 5 minutes without activity by the payer after being authenticated for accessing its payment account online. The scope of Article 4 is limited to the cases where strong customer authentication (SCA) is applied. The 5-minute inactivity rule would not apply where account information access benefits from an exemption under Article 10 of the Delegated Regulation because the last time SCA was applied was less than 90 days ago and it otherwise complies with data limitation under this Article.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4068)

## Related Level 1 articles

- [Article 97 — Authentication](../../../articles/97.md)