<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2018-10-19","gaps":[],"covered":["EBA Q&A 2018_4089 — Q&A — Obligatory nature of the SCA and exemption based [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4089-obligatory-nature-of-the-sca-and-exemption-based-on","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4089-obligatory-nature-of-the-sca-and-exemption-based-on","title":"EBA Q&A 2018_4089 — Q&A — Obligatory nature of the SCA and exemption based [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4089-obligatory-nature-of-the-sca-and-exemption-based-on","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 19 October 2018","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4089","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"1fcbab0067f7db01","change_date":null,"nearest_versions":["2018-10-19"],"first_text_date":null,"correction_applies":false,"versions":["2018-10-19"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4089-obligatory-nature-of-the-sca-and-exemption-based-on/versions/2018-10-19","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4089-obligatory-nature-of-the-sca-and-exemption-based-on/versions/2018-10-19/rev/1fcbab0067f7db01","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4089-obligatory-nature-of-the-sca-and-exemption-based-on/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4089-obligatory-nature-of-the-sca-and-exemption-based-on/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 19 Oct 2018 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2018-10-19","question_submitted_on":"2018-07-10","locators":{"published_on":"EBA Q&A register entry 2018_4089, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4089, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2018_4089 — Q&A — Obligatory nature of the SCA and exemption based [Final Q&A]"
shortTitle: "EBA Q&A 2018_4089 — Q&A — Obligatory nature of the SCA and exemption based [Final Q&A]"
answer_id: EBA_QA_2018_4089
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "PSD2"
date: 19 October 2018
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4089
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 19 October 2018"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4089"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2018_4089, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2018-10-19"
  question_submitted_on: "2018-07-10"
  locators:
    published_on: "EBA Q&A register entry 2018_4089, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2018_4089, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 19 Oct 2018 [Final Q&A]**

*Final Q&A · EBA Q&A register, 19 October 2018 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4089)*

| | |
|---|---|
| **Full title** | EBA Q&A 2018_4089 — Q&A — Obligatory nature of the SCA and exemption based \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2018_4089 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 19 October 2018; question submitted 10 July 2018 |
| **Legal basis** | PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Obligatory nature of the SCA and exemption based on transaction risk analysis**

### Question

Does the exemption to the strong customer authentication (SCA) apply to any connection the payment service user (PSU) makes to his/her payment account(s), or only to the connections made through the use of third party processors (TPPs, such as AISPs or PISPs) via the interfaces (dedicated or not) set up by the bank with the TPPs, when a transaction risk analysis is performed and results on a low level of risk? That is, the connections made via the traditional online banking or the mobile application that the financial institution (the bank) provides to the final user are also eligible to a transaction risk analysis and, if a low level or risk is identified, apply exemption to the SCA? Or do the PSD2, and specifically the RTS on SCA and secure communication not apply to the traditional connections performed by the PSUs to their payment accounts via online banking or mobile application provided by the bank (ASPSP), and do they not mandate to apply transaction monitoring in such cases?

### Background

We, as a financial institution, are very clear that online transaction monitoring is mandatory when a PSU connects to his/her payment account to either access its payment account online, initiates an online payment transaction or carries out any action through a remote channel which may imply a risk of payment fraud or other abuses (according to Article 97 or PSD2). Also, it is very clear for us that, if the online monitoring results on a low level of risk for the operation are to be performed by the PSU, an exemption to the SCA may be applied.

However, it is not very clear for us what the rule is when the PSU directly connects to its payment account via the online banking webpage or the mobile application provided by the bank, and where no third party processor intervenes. In such case, it is not very clear for us if, that as a general rule, SCA is mandatory, and if online transaction monitoring resulting on low level of risk for the operation to be performed by the PSU may be used as an exemption to apply SCA to the operation.

As a security best practice, we understand that online transaction monitoring is necessary, but we do not know if that monitoring is not only a best practice but a mandatory requirement (by PSD2 and the RTS on SCA) also for the transactions performed by the PSU when he/she directly connects to his/her payment account via the online banking webpage or mobile application provided by the bank.

***

### Answer

Article 97(1) of PSD2 states that “a payment service provider applies strong customer authentication where the payer: (a) accesses its payment account online; (b) initiates an electronic payment transaction; (c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses”. PSD2 does not distinguish between payment transactions that may have been made using a payment initiation service provider or not.

Similarly the Commission Delegated Regulation (EU) 2018/389 does not distinguish whether a payment transactions has been made using a payment initiation service provider or not for the purpose of applying an exemption. In addition paragraph 36 in the EBA Opinion on the implementation of the regulatory technical standards (RTS) on strong customer authentication (SCA) and common and secure communication (CSC) (EBA-Op-2018-04, June 2018) further explains that “SCA has to be applied to access to payment account information and to every payment initiation, including within a session in which SCA was performed to access the account data, unless an exemption under the RTS applies”, irrespective of whether or not a payment initiation service provider has been used. Moreover, this EBA Opinion explains in paragraph 39 that “only the ASPSP can apply SCA or decide whether or not an exemption applies to a PSU’s payment account in the context of AIS and PIS”.

This means that whilst an exemption may apply to a payment transaction that has been initiated through a payment initiation service provider, the payment initiation service provider cannot decide whether or not an exemption applies. In the specific case of the exemption based on transaction risk analysis, the fraud rate therefore refers to the fraud rate of the Account Servicing Payment Service Providers (ASPSP). If that fraud rate is below the applicable threshold as described in Annex 1 of the Delegated regulation, the ASPSP may apply the exemption providing the other conditions set out in Article 18 of the Delegated Regulation are met.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4089)