<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2019-10-11","gaps":[],"covered":["EBA Q&A 2018_4182 — Q&A — Application of limits for Strong customer authentication [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4182-application-of-limits-for-strong-customer-authentication","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4182-application-of-limits-for-strong-customer-authentication","title":"EBA Q&A 2018_4182 — Q&A — Application of limits for Strong customer authentication [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4182-application-of-limits-for-strong-customer-authentication","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 11 October 2019","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4182","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"0b47b2c4e70cbf8a","change_date":null,"nearest_versions":["2019-10-11"],"first_text_date":null,"correction_applies":false,"versions":["2019-10-11"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4182-application-of-limits-for-strong-customer-authentication/versions/2019-10-11","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4182-application-of-limits-for-strong-customer-authentication/versions/2019-10-11/rev/0b47b2c4e70cbf8a","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4182-application-of-limits-for-strong-customer-authentication/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4182-application-of-limits-for-strong-customer-authentication/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 11 Oct 2019 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2019-10-11","question_submitted_on":"2018-08-06","locators":{"published_on":"EBA Q&A register entry 2018_4182, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4182, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2018_4182 — Q&A — Application of limits for Strong customer authentication [Final Q&A]"
shortTitle: "EBA Q&A 2018_4182 — Q&A — Application of limits for Strong customer authentication [Final Q&A]"
answer_id: EBA_QA_2018_4182
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "PSD2"
date: 11 October 2019
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4182
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 11 October 2019"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4182"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2018_4182, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2019-10-11"
  question_submitted_on: "2018-08-06"
  locators:
    published_on: "EBA Q&A register entry 2018_4182, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2018_4182, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 11 Oct 2019 [Final Q&A]**

*Final Q&A · EBA Q&A register, 11 October 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4182)*

| | |
|---|---|
| **Full title** | EBA Q&A 2018_4182 — Q&A — Application of limits for Strong customer authentication \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2018_4182 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 11 October 2019; question submitted 6 August 2018 |
| **Legal basis** | PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Application of limits for Strong customer authentication (SCA) exemption**

### Question

How should payment service providers (PSPs) apply the cumulative limits set in Articles 11 and 16 of the RTS on strong customer authentication and secure communication?

### Background

(For the purpose of simplicity we will only refer to Article 11 here. The same applies to Article 16 just changing the relevant amounts).

Article 11 indicates that PSPs are allowed not to apply SCA if the amount of the transaction does not exceed 50 Euros and either the cumulative amount of previous transactions from the date of the last application of SCA does not exceed 150 Euros, or the number of consecutive transactions since the last application of SCA does not exceed 5.

In point 43 of EBA’s opinion on the implementation of the RTS, dated June 13th, it is confirmed that only one of the two cumulative limits needs to be met in order for the PSPs to be allowed not to apply SCA.

However, it is then suggested that PSPs decide at the outset which of the two cumulative limits they use. This suggestion has created some confusion regarding whether or not PSPs can change the limit applied at will, on a transaction-by-transaction basis.

***

### Answer

The Commission Delegated Regulation (EU) 2018/389 does not specify how payment service providers (PSPs) should apply the counters for the purpose of deciding whether an exemption under Articles 11 and 16 of the Delegated Regulation may apply or not. The EBA Opinion on the implementation of the regulatory technical standards on strong customer authentication and common and secure communication, EBA-Op-2018-04, states in paragraph 43 that “it may be preferable for PSPs to decide at the outset which cumulative limit they use (rather than on a transaction-by-transaction basis), as it may otherwise be confusing for consumers”. This has also been clarified in Q&A 2018\_4225.

Nevertheless, in the event that PSPs decide to apply the exemptions on a transaction-per-transaction basis, they would need to simultaneously check whether either of the limits under Article 11(b) and Article 11(c) of the Delegated Regulation (or Article 16(b) and Article 16(c) respectively) has been reached and apply strong customer authentication (SCA) as soon as either or both limits are reached.

The application of the exemptions under Articles 11 and 16 is without prejudice to the possibility for PSPs, based on their fraud management procedures, to request the application of SCA before any of the limits is reached.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4182)