{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2018-10-05","gaps":[],"covered":["EBA Q&A 2018_4090 — Q&A — Does transaction monitoring need to be real time? [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4090-does-transaction-monitoring-need-to-be-real-time","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4090-does-transaction-monitoring-need-to-be-real-time","title":"EBA Q&A 2018_4090 — Q&A — Does transaction monitoring need to be real time? [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4090-does-transaction-monitoring-need-to-be-real-time","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 5 October 2018","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4090","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"8c752c1257d609dd","change_date":null,"nearest_versions":["2018-10-05"],"first_text_date":null,"correction_applies":false,"versions":["2018-10-05"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4090-does-transaction-monitoring-need-to-be-real-time/versions/2018-10-05","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4090-does-transaction-monitoring-need-to-be-real-time/versions/2018-10-05/rev/8c752c1257d609dd","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4090-does-transaction-monitoring-need-to-be-real-time/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4090-does-transaction-monitoring-need-to-be-real-time/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 5 Oct 2018 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2018-10-05","question_submitted_on":"2018-07-10","locators":{"published_on":"EBA Q&A register entry 2018_4090, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4090, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4090","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4090-does-transaction-monitoring-need-to-be-real-time.md","body_sha256":"4825b3d66fe09f7e3386811bade123bdc1f05474f178bc16f477de1ff853d73e"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2018_4090 — Q&A — Does transaction monitoring need to be real time? [Final Q&A]\"\nshortTitle: \"EBA Q&A 2018_4090 — Q&A — Does transaction monitoring need to be real time? [Final Q&A]\"\nanswer_id: EBA_QA_2018_4090\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"PSD2\"\ndate: 5 October 2018\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4090\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 5 October 2018\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4090\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2018_4090, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2018-10-05\"\n  question_submitted_on: \"2018-07-10\"\n  locators:\n    published_on: \"EBA Q&A register entry 2018_4090, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2018_4090, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 5 Oct 2018 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 5 October 2018 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4090)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2018_4090 — Q&A — Does transaction monitoring need to be real time? \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2018_4090 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 5 October 2018; question submitted 10 July 2018 |\n| **Legal basis** | PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Does transaction monitoring need to be real time?**\n\n### Question\n\nArticle 2(1) of the RTS stipulates that \"payment service providers shall have transaction monitoring mechanisms in place that enable them to detect unauthorised or fraudulent payment transactions...\" and Article 2(2) explains the minimum requirements.\n\nHowever, Article 2 does not specify timing aspects of the transaction monitoring.\n\nIs it correct to conclude that the transaction monitoring described in Article 2 does not need to be real time?\n\n### Background\n\nThe RTS aims at reducing the risk of payment fraud to a minimal level. The main measure to achieve this goal is to apply SCA. Article 18 allows not to apply SCA for payment transactions posing a low level of risk and describes real time risk analysis as a condition for not applying SCA for these transactions.\n\nIn this context, the real time risk analysis is understood acceptable alternative measure to SCA to mitigate the risk of payment fraud. The transaction monitoring described in Article 2 aims at detecting unauthorised or fraudulent payment transactions. The transaction monitoring is to be applied in addition to SCA.\n\nHowever, article 2 does not specify timing aspects of the transaction monitoring. In combination, Articles 2 and 18 can be understood in two ways:\n\n1) In general, the risk of payment fraud needs to be addressed by two strong measures – SCA and real time monitoring. In the exceptional case of low risk transactions, one measure (real time risk analysis) is sufficient.\n\n2) The risk of payment fraud is to be adequately addressed. In general, this is achieved by applying SCA and supported by transaction monitoring. The transaction monitoring does not need to be real time since SCA already provides strong protection. In the exceptional case of low risk transactions, real time risk assessment is seen to be sufficient to mitigate the risk of payment fraud.\n\n***\n\n### Answer\n\nArticle 2(1) of the Commission Delegated Regulation (EU) 2018/389 (RTS on Strong customer authentication and secure communication) requires that “Payment service providers shall have transaction monitoring mechanisms in place that enable them to detect unauthorised or fraudulent payment transactions” and Article 2(2) refers to “transaction monitoring mechanisms” for the purpose of the Delegated Regulation.\n\nFurther, Article 18(1) of the RTS on the transaction risk analysis exemption requires not only for PSPs to have “transaction monitoring mechanisms referred to in Article 2” in place but also Article 18(2)(c) of the RTS requires PSPs to perform a “real time risk analysis”.\n\nAccordingly, for payments service providers to be able to benefit from the transaction risk analysis exemption under Article 18 of the RTS, they have to go beyond the general monitoring requirements required under Article 2 of these RTS and have mechanisms in place that enable “real time risk monitoring”, in other words a monitoring before the transaction is authorised. The general monitoring mechanism under Article 2 of these RTS does not require enabling ‘real time risk monitoring’ and is usually carried out “after” the execution of the payment transaction.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4090)\n"}