--- title: "EBA Q&A 2018_4177 — Q&A — Application of SCA when a PSU accesses payment [Final Q&A]" shortTitle: "EBA Q&A 2018_4177 — Q&A — Application of SCA when a PSU accesses payment [Final Q&A]" answer_id: EBA_QA_2018_4177 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 97 PSD2" date: 9 November 2018 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4177 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 9 November 2018" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4177" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2018_4177, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2018-11-09" question_submitted_on: "2018-08-02" locators: published_on: "EBA Q&A register entry 2018_4177, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2018_4177, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 9 Nov 2018 [Final Q&A]** *Final Q&A · EBA Q&A register, 9 November 2018 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4177)* | | | |---|---| | **Full title** | EBA Q&A 2018_4177 — Q&A — Application of SCA when a PSU accesses payment \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2018_4177 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 9 November 2018; question submitted 2 August 2018 | | **Legal basis** | Article 97 PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Application of SCA when a PSU accesses payment transactions data older than on the last 90 days, without having access to sensitive payment data and for a period of 90 days after the last access using SCA** ### Question Could Payment Service Providers (PSPs) be allowed to choose between applying SCA(Strong Customer Authentication) or not when a PSU (Payment Service User) accesses payment transactions data older than on the last 90 days without having access to sensitive payment data and for a period of 90 days after its last access using SCA? ### Background Article 10 of Regulation (EU) 2018/389 – RTS on strong customer authentication and secure communication provides an exemption from SCA when a PSU accesses limited payment account information that are the balance or payment transactions data on the last 90 days. Many ASPSP's websites and TPP's applications actually show to the PSU, who accesses its payment account(s) online, payment transactions data on more than the last 90 days (meaning older data / data on payment transactions executed before). As such, for a PSU accessing its payment accounts online (banking website for instance) without SCA : When he/she scrolls the payment transactions and gets to older transactions (meaning here older than 90 days ago) then a SCA should be done ; When he/she uses the search engine to look for an old transaction (meaning here older than 90 days ago) then a SCA should be done ; When he/she uses PFM services (personal finance management) which usually show old transactions (meaning here older than 90 days ago) then a SCA should be done. As a consequence, we note that the objective of the Article 10 - which allows PSPs, for payment account information access, to apply SCA only every 90 days – cannot be reached. With current practices of ASPSP’s websites and TPP’s websites (which show payment transactions older than 90 days ago), there is no interest for PSPs to use the SCA exemption of article 10.2.b) because with the today’s customer habits and uses (refer to the 3 examples above, the PSP will have to apply a SCA right after the PSU’s access . The requirement to consider the date of the payment transaction wipes out the purpose of applying the exemption described in Article 10. *** ### Answer According to Article 10(1) of Commission Delegated Regulation (EU) 2018/389, “payment service providers shall be allowed not to apply strong customer authentication where a payment service user is limited to accessing either or both of the following items online without disclosure of sensitive payment data: (a) the balance of one or more designated payment accounts; (b) the payment transactions executed in the last 90 days through one or more designated payment accounts”. Consequently for payment transaction history older than 90 days, the exemption to the obligation to apply strong customer authentication under Article 10 of the Delegated Regulation does not apply. For such information, payment service providers should always have to apply strong customer authentication. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4177) ## Related Level 1 articles - [Article 97 — Authentication](../../../articles/97.md)