--- title: "EBA Q&A 2018_4138 — Q&A — Testing eIDAS certificates before 14 September 2019 [Final Q&A]" shortTitle: "EBA Q&A 2018_4138 — Q&A — Testing eIDAS certificates before 14 September 2019 [Final Q&A]" answer_id: EBA_QA_2018_4138 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 98(1) PSD2" date: 7 June 2019 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4138 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 7 June 2019" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4138" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2018_4138, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2019-06-07" question_submitted_on: "2018-07-18" locators: published_on: "EBA Q&A register entry 2018_4138, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2018_4138, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 7 Jun 2019 [Final Q&A]** *Final Q&A · EBA Q&A register, 7 June 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4138)* | | | |---|---| | **Full title** | EBA Q&A 2018_4138 — Q&A — Testing eIDAS certificates before 14 September 2019 \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2018_4138 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 7 June 2019; question submitted 18 July 2018 | | **Legal basis** | Article 98(1) PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Testing eIDAS certificates before 14 September 2019** ### Question How can Third Party Providers (TPPs) and Account servicing payment service providers (ASPSPs) test their interfaces using PSD2 eIDAS-certificates during the testing period prior to September 2019 as it is only mandatory to use PSD2 eIDAS certificates from September 2019 onwards? ### Background ASPSPs want to (1) meet the requirements of the testing period in order to qualify for the exemption to the fall-back and sees the importance of timely testing of all requirements imposed by the RTS SCA. Additionally ASPSPs want to (2) ensure that the testing period is used for testing the interfaces including certificates similar to those that are going to be used after September 2019. This way ASPSPs and TPPs can both optimise their customer journeys based on the actual to-be-state. *** ### Answer In accordance with Article 33(6) of the Commission Delegated Regulation (EU) 2018/389, one of the conditions that account servicing payment service providers (ASPSPs), who have opted for a dedicated interface, must meet in order to be eligible for an exemption from the fall-back mechanism under Article 36(4) of the Delegated Regulation is that their dedicated interface “has been designed and tested in accordance with Article 30(5) to the satisfaction of the payment service providers referred to therein” (Article 33(6)(b) of the Delegated Regulation). In accordance with Article 30(5) of the Delegated Regulation, ”Account servicing payment service providers shall make available a testing facility, including support, for connection and functional testing to enable authorised payment initiation service providers, payment service providers issuing card-based payment instruments and account information service providers, or payment service providers that have applied for the relevant authorisation, to test their software and applications used for offering a payment service to users. This testing facility should be made available no later than 6 months before the application date referred to in Article 38(2) or before the target date for the market launch of the access interface when the launch takes place after the date referred to in Article 38(2) \[...\]” Furthermore, Guideline 6.5(b) of the EBA Guidelines on the conditions to be met to benefit from an exemption from contingency measures under Article 33(6) of Regulation (EU) 2018/389 (EBA/GL/2018/07), provides that “The testing facility should allow ASPSPs, authorised Payment Initiation Service Providers (PISPs), Account Information Service Providers (AISPs) and card-based payment instrument issuers (CBPIIs) or payment service providers (PSPs) that have applied to their competent authorities for the relevant authorisation to test the dedicated interface in a secure, dedicated testing environment with non-real Payment Services User (PSU) data, for the following: \[...\] b. the ability of ASPSPs and authorised PISPs, AISPs and CBPIIs to exchange the relevant certificates in accordance with Article 34 of the” Delegated Regulation. As clarified in the Final report on the above mentioned Guidelines, for the purpose of the testing under Article 30(5) of the Delegated Regulation, the testing facility should allow the testing of the ability of authorised AISPs, PISPs and CBPIIs to exchange eIDAS certificates as referred to in Article 34 of the Delegated Regulation. Prior to 14 September 2019, when certificates must comply with Article 34 of the Delegated Regulation, authorised or registered AISPs, PISPs or CBPIIs that do not yet have the relevant qualified certificate under Article 34 of the Delegated Regulation, may also use test certificates for the purpose of testing in accordance with Article 30(5) of the Delegated Regulation. PSPs that have applied to their competent authorities for the relevant authorisation/ registration as AISPs, PISPs or CBPIIs, but are not yet authorised, may identify themselves for the purpose of testing under Article 30(5) of the Delegated Regulation using test certificates, taking into account that said Article requires ASPSPs to also grant these providers access to the testing facility. This also applies to the period after the application date, 14 September 2019, of the Delegated Regulation. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4138) ## Related Level 1 articles - [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)