{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2018-12-21","gaps":[],"covered":["EBA Q&A 2018_4120 — Q&A — Exemptions from Strong Customer Authentication (SCA) [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4120-exemptions-from-strong-customer-authentication-sca-trusted","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4120-exemptions-from-strong-customer-authentication-sca-trusted","title":"EBA Q&A 2018_4120 — Q&A — Exemptions from Strong Customer Authentication (SCA) [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4120-exemptions-from-strong-customer-authentication-sca-trusted","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 21 December 2018","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4120","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"5faf6e25ca9dcf75","change_date":null,"nearest_versions":["2018-12-21"],"first_text_date":null,"correction_applies":false,"versions":["2018-12-21"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4120-exemptions-from-strong-customer-authentication-sca-trusted/versions/2018-12-21","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4120-exemptions-from-strong-customer-authentication-sca-trusted/versions/2018-12-21/rev/5faf6e25ca9dcf75","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4120-exemptions-from-strong-customer-authentication-sca-trusted/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4120-exemptions-from-strong-customer-authentication-sca-trusted/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 21 Dec 2018 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2018-12-21","question_submitted_on":"2018-07-16","locators":{"published_on":"EBA Q&A register entry 2018_4120, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4120, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4120","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4120-exemptions-from-strong-customer-authentication-sca-trusted.md","body_sha256":"f43f061e1c433b2c33409fba8ad027bcb4c31884e2690ef02f19e2a62ae0c67e"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2018_4120 — Q&A — Exemptions from Strong Customer Authentication (SCA) [Final Q&A]\"\nshortTitle: \"EBA Q&A 2018_4120 — Q&A — Exemptions from Strong Customer Authentication (SCA) [Final Q&A]\"\nanswer_id: EBA_QA_2018_4120\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 98(1) PSD2\"\ndate: 21 December 2018\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4120\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 21 December 2018\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4120\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2018_4120, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2018-12-21\"\n  question_submitted_on: \"2018-07-16\"\n  locators:\n    published_on: \"EBA Q&A register entry 2018_4120, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2018_4120, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 21 Dec 2018 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 21 December 2018 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4120)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2018_4120 — Q&A — Exemptions from Strong Customer Authentication (SCA) \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2018_4120 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 21 December 2018; question submitted 16 July 2018 |\n| **Legal basis** | Article 98(1) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Exemptions from Strong Customer Authentication (SCA): trusted beneficiaries**\n\n### Question\n\nShould a Payment Service User (PSU) recreate a list of trusted beneficiaries that was already approved in accordance with the EBA Guidelines on the security of internet payments?\n\n### Background\n\nArticle 13 of the RTS on strong customer authentication and common secure communication creates an exemption from strong customer authentication based on the list of trusted beneficiaries.\n\n***\n\n### Answer\n\nIn accordance with Article 13(1) of the Commission Delegated Regulation (EU) 2018/389, \"payment service providers shall apply strong customer authentication (SCA) where a payer creates or amends a list of trusted beneficiaries through the payer’s account servicing payment service provider.\"\n\nAccordingly, for lists of trusted beneficiaries that already existed before the application of the Delegated Regulation (and have been developed in the same context as an exemption to the requirement to use SCA under the general authentication requirements in Article 2 of the Delegated Regulation), SCA should be required only when there is an amendment to this list. The payment service user would not need to re-create that list.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4120)\n\n## Related Level 1 articles\n\n- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)\n"}