{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-03-12","gaps":[],"covered":["EBA Q&A 2018_4077 — Q&A — On the use and storage of Personalised Security [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4077-on-the-use-and-storage-of-personalised-security-credentials","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4077-on-the-use-and-storage-of-personalised-security-credentials","title":"EBA Q&A 2018_4077 — Q&A — On the use and storage of Personalised Security [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4077-on-the-use-and-storage-of-personalised-security-credentials","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 12 March 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4077","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"884a6d7ef1a3350a","change_date":null,"nearest_versions":["2021-03-12"],"first_text_date":null,"correction_applies":false,"versions":["2021-03-12"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4077-on-the-use-and-storage-of-personalised-security-credentials/versions/2021-03-12","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4077-on-the-use-and-storage-of-personalised-security-credentials/versions/2021-03-12/rev/884a6d7ef1a3350a","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4077-on-the-use-and-storage-of-personalised-security-credentials/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4077-on-the-use-and-storage-of-personalised-security-credentials/relations","source_line":"Answer prepared by the European Commission, published in the EBA Q&A tool · not legislation · published 12 Mar 2021 [Final Q&A]","attribution":{"prepared_by":"European Commission","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-03-12","question_submitted_on":"2018-07-04","locators":{"published_on":"EBA Q&A register entry 2018_4077, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4077, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4077","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4077-on-the-use-and-storage-of-personalised-security-credentials.md","body_sha256":"fcba13a6a6285bb90f5c652f501922d833d9bfb4e1b1af211303aa9071bd91ed"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2018_4077 — Q&A — On the use and storage of Personalised Security [Final Q&A]\"\nshortTitle: \"EBA Q&A 2018_4077 — Q&A — On the use and storage of Personalised Security [Final Q&A]\"\nanswer_id: EBA_QA_2018_4077\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 97 PSD2\"\ndate: 12 March 2021\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4077\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 12 March 2021\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4077\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"European Commission\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the European Commission because it is a matter of interpretation of Union law.\"\n    locator: \"EBA Q&A register entry 2018_4077, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2021-03-12\"\n  question_submitted_on: \"2018-07-04\"\n  locators:\n    published_on: \"EBA Q&A register entry 2018_4077, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2018_4077, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer prepared by the European Commission, published in the EBA Q&A tool · not legislation · published 12 Mar 2021 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 12 March 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4077)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2018_4077 — Q&A — On the use and storage of Personalised Security \\[Final Q&A\\] |\n| **Prepared by** | European Commission |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2018_4077 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 12 March 2021; question submitted 4 July 2018 |\n| **Legal basis** | Article 97 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**On the use and storage of Personalised Security Credentials (PSC)**\n\n### Question\n\nDo third party providers (TPPs) have the right to ask for payment service users (PSUs)' Personalised Security Credentials (PSC)?\n\nDo TPPs have the right to store PSUs' PSC ?\n\n### Background\n\nThree articles (Article 22.2 of the RTS, Articles 66 and 67 of PSD2) define obligations related to the storage and use of PSCs by TPPs, i.e.:\n\nArticle 22.2 of the RTS :\n\n« 2.For the purpose of paragraph 1, payment service providers shall ensure that each of the following requirements is met: \\[...\\] (b) personalised security credentials in data format, as well as cryptographic materials related to the encryption of the personalised security credentials are not stored in plain text; \\[...\\] »\n\nArticle 66\n\n« Rules on access to payment account in the case of payment initiation services (PIS)\n\n\\[...\\]\n\n3. The payment initiation service provider shall:\n\n\\[...\\]\n\n(e) not store sensitive payment data of the payment service user;\n\n(f) not request from the payment service user any data other than those necessary to provide the payment initiation service;\n\n\\[...\\]\n\nArticle 67\n\n« Rules on access to and use of payment account information in the case of account information services\n\n\\[...\\]\n\n2. The account information service provider shall:\n\n\\[...\\]\n\n(e) not request sensitive payment data linked to the payment accounts;\n\n(f) not use, access or store any data for purposes other than for performing the account information service explicitly requested by the payment service user, in accordance with data protection rules.\n\n\\[...\\]\n\nWe understand from the following articles that:\n\nPIS will be transmitting encrypted authentication codes/PSC of the user to the Account Servicing Payment Service Provider (ASPSP), i.e. they will be accessible to PIS, but not read by the PIS. Accordingly, the PIS will also not be able to use the transmitted authentication code/PSC for any other purposes than the payment initiation of a concrete payment transaction, and will therefore not be able to store the PSCs at all (even if encrypted).\n\nAccount Information Service (AIS) will get the encrypted/tokenized PSC/authentication codes that will be transmitted through safe and efficient channels to ASPSP; however no reading of PSC is needed by the AIS in order to perform the necessary services.\n\n***\n\n### Answer\n\nPayment initiation service providers (PISPs) have the right to ask for payment service users (PSUs)' personalised security credentials (PSCs) only if this is necessary to provide the payment initiation service (Article 66(3)(f) Directive 2015/2366/EU (PSD2)) and subject to the explicit consent of the PSU. In accordance with Article 66(3)(e) PSD2, PISPs have no right to store the PSU's PSC.\n\nOn the basis of Article 67(2)(f) PSD2, account information service providers (AISPs) may use and store the PSU's PSCs only if this is necessary to perform the account information service explicitly requested by the PSU and only if transmitted and stored in the encrypted form and without reading them in accordance with Article 22 of the Commission Delegated Regulation (EU) 2018/389. This storage should not be used to circumvent the application of strong customer authentication as per Article 97 PSD2 and Article 10 of the Commission Delegated Regulation (EU) 2018/389 (rule for 90 day-re-authentication). Furthermore, the provision in Article 67(2)(b) obliges AISPs not to make the PSC accessible to other parties.\n\nThe PSU's PSCs must be secured at all times, according to the rules laid down in PSD2 and the Commission Delegated Regulation (EU) 2018/389.\n\nDisclaimer:\n\nThe answers clarify provisions already contained in the applicable legislation. They do not extend in any way the rights and obligations deriving from such legislation nor do they introduce any additional requirements for the concerned operators and competent authorities. The answers are merely intended to assist natural or legal persons, including competent authorities and Union institutions and bodies in clarifying the application or implementation of the relevant legal provisions. Only the Court of Justice of the European Union is competent to authoritatively interpret Union law. The views expressed in the internal Commission Decision cannot prejudge the position that the European Commission might take before the Union and national courts.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4077)\n\n## Related Level 1 articles\n\n- [Article 97 — Authentication](../../../articles/97.md)\n"}