--- title: "EBA Q&A 2018_4120 — Q&A — Exemptions from Strong Customer Authentication (SCA) [Final Q&A]" shortTitle: "EBA Q&A 2018_4120 — Q&A — Exemptions from Strong Customer Authentication (SCA) [Final Q&A]" answer_id: EBA_QA_2018_4120 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 98(1) PSD2" date: 21 December 2018 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4120 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 21 December 2018" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4120" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2018_4120, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2018-12-21" question_submitted_on: "2018-07-16" locators: published_on: "EBA Q&A register entry 2018_4120, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2018_4120, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 21 Dec 2018 [Final Q&A]** *Final Q&A · EBA Q&A register, 21 December 2018 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4120)* | | | |---|---| | **Full title** | EBA Q&A 2018_4120 — Q&A — Exemptions from Strong Customer Authentication (SCA) \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2018_4120 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 21 December 2018; question submitted 16 July 2018 | | **Legal basis** | Article 98(1) PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Exemptions from Strong Customer Authentication (SCA): trusted beneficiaries** ### Question Should a Payment Service User (PSU) recreate a list of trusted beneficiaries that was already approved in accordance with the EBA Guidelines on the security of internet payments? ### Background Article 13 of the RTS on strong customer authentication and common secure communication creates an exemption from strong customer authentication based on the list of trusted beneficiaries. *** ### Answer In accordance with Article 13(1) of the Commission Delegated Regulation (EU) 2018/389, "payment service providers shall apply strong customer authentication (SCA) where a payer creates or amends a list of trusted beneficiaries through the payer’s account servicing payment service provider." Accordingly, for lists of trusted beneficiaries that already existed before the application of the Delegated Regulation (and have been developed in the same context as an exemption to the requirement to use SCA under the general authentication requirements in Article 2 of the Delegated Regulation), SCA should be required only when there is an amendment to this list. The payment service user would not need to re-create that list. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4120) ## Related Level 1 articles - [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)