<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2019-12-20","gaps":[],"covered":["EBA Q&A 2018_4110 — Q&A — Data authentication standards [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4110-data-authentication-standards","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4110-data-authentication-standards","title":"EBA Q&A 2018_4110 — Q&A — Data authentication standards [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4110-data-authentication-standards","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 20 December 2019","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4110","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"6b8f571448f75212","change_date":null,"nearest_versions":["2019-12-20"],"first_text_date":null,"correction_applies":false,"versions":["2019-12-20"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4110-data-authentication-standards/versions/2019-12-20","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4110-data-authentication-standards/versions/2019-12-20/rev/6b8f571448f75212","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4110-data-authentication-standards/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4110-data-authentication-standards/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 20 Dec 2019 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2019-12-20","question_submitted_on":"2018-07-13","locators":{"published_on":"EBA Q&A register entry 2018_4110, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4110, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2018_4110 — Q&A — Data authentication standards [Final Q&A]"
shortTitle: "EBA Q&A 2018_4110 — Q&A — Data authentication standards [Final Q&A]"
answer_id: EBA_QA_2018_4110
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 97(2) PSD2"
date: 20 December 2019
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4110
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 20 December 2019"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4110"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2018_4110, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2019-12-20"
  question_submitted_on: "2018-07-13"
  locators:
    published_on: "EBA Q&A register entry 2018_4110, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2018_4110, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 20 Dec 2019 [Final Q&A]**

*Final Q&A · EBA Q&A register, 20 December 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4110)*

| | |
|---|---|
| **Full title** | EBA Q&A 2018_4110 — Q&A — Data authentication standards \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2018_4110 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 20 December 2019; question submitted 13 July 2018 |
| **Legal basis** | Article 97(2) PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Data authentication standards**

### Question

Does a non-remote card payment transaction with a secure, dynamic data authentication of the card (DDA or higher), based on ISO/IEC 7816 (for contact cards) and ISO/IEC 14443 (for contactless card) used with a static PIN meet the requirements of Article 4 of the RTS on Strong Customer Authentication (SCA)?

### Background

Considering the published comments by EMVCo dated from 2016 and the EBA analysis from 2017 (see comment 272 of the Final Report of the RTS on SCA, dated 23 February 2017), EBA is asked to provide clarity that all face-to-face card transactions using the global EMV DDA or CDA standard fulfill all requirements for authentication codes of Article 4 of the Regulatory Technical Standards of Strong Customer Authentication and Common and Secure Communication.

Without such a confirmation, the practical impact would be that more than 5 000 PSPs (card issuers and acquirers) in Europa have to prove the compliance of these standards with the RTS with their own technical and legal experts individually when being audited.

While it is well understood that EBA does not see SDA being compliant with the RTS, we believe it is neither feasible nor intended to burden all European PSPs with proving that DDA and CDA is in line with RTS individually.

***

### Answer

The authentication of the payment card based on combined data authentication (CDA) and dynamic data authentication (DDA), as currently observed in the market, could meet the requirements of the elements categorised as possession under Article 7 of the Commission Delegated Regulation (EU) 2018/389 for non-remote card-based payment transactions.

Moreover, CDA and DDA can be used for the generation of the authentication code, which should be compliant with the requirements of Article 4 of the Delegated Regulation.

In line with the requirements of the Delegated Regulation, issuers should identify in their solutions which messages/data fields (or a combination of them) generate the “authentication code” and the dynamic element to prove the possession.

In addition, as clarified in Table 3 of the EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06), a static PIN could constitute a ‘knowledge’ element.

It should be noted that card set-ups designed by issuers, other than those relying on CDA/DDA, could be compliant with the requirements of the Delegated Regulation.

Finally, it should be noted that it is for each payment service provider to identify which are the authentication elements and authentication codes of their solutions and to prove that they meet the requirements of the Delegated Regulation.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4110)

## Related Level 1 articles

- [Article 97 — Authentication](../../../articles/97.md)