{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-01-15","gaps":[],"covered":["EBA Q&A 2018_4235 — Q&A — Ability of static card data to be considered a possession [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4235-ability-of-static-card-data-to-be-considered-a-possession","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4235-ability-of-static-card-data-to-be-considered-a-possession","title":"EBA Q&A 2018_4235 — Q&A — Ability of static card data to be considered a possession [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4235-ability-of-static-card-data-to-be-considered-a-possession","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 15 January 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4235","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"51a7cfbcdd77d747","change_date":null,"nearest_versions":["2021-01-15"],"first_text_date":null,"correction_applies":false,"versions":["2021-01-15"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4235-ability-of-static-card-data-to-be-considered-a-possession/versions/2021-01-15","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4235-ability-of-static-card-data-to-be-considered-a-possession/versions/2021-01-15/rev/51a7cfbcdd77d747","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4235-ability-of-static-card-data-to-be-considered-a-possession/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4235-ability-of-static-card-data-to-be-considered-a-possession/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 15 Jan 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-01-15","question_submitted_on":"2018-09-06","locators":{"published_on":"EBA Q&A register entry 2018_4235, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4235, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4235","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4235-ability-of-static-card-data-to-be-considered-a-possession.md","body_sha256":"0dc0aa03552ae8f188c2e0704c7b31b05edfd913b3b5240d245dec4cee388c1b"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2018_4235 — Q&A — Ability of static card data to be considered a possession [Final Q&A]\"\nshortTitle: \"EBA Q&A 2018_4235 — Q&A — Ability of static card data to be considered a possession [Final Q&A]\"\nanswer_id: EBA_QA_2018_4235\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 98(1) PSD2\"\ndate: 15 January 2021\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4235\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 15 January 2021\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4235\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2018_4235, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2021-01-15\"\n  question_submitted_on: \"2018-09-06\"\n  locators:\n    published_on: \"EBA Q&A register entry 2018_4235, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2018_4235, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 15 Jan 2021 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 15 January 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4235)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2018_4235 — Q&A — Ability of static card data to be considered a possession \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2018_4235 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 15 January 2021; question submitted 6 September 2018 |\n| **Legal basis** | Article 98(1) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Ability of static card data to be considered a possession factor?**\n\n### Question\n\nCan static card data (Card number PAN + cardholder name +Exp. Date + static CVV2/CVC2) be considered a as a possession factor, and if so: is it strong enough to be a valid factor in a 2-factor Strong customer authentication (SCA)?\n\n### Background\n\nIn its Opinion on the implementation of the RTS on SCA and CSC (EBA-Op-2018-04), the EBA explained that simple card data (Card number PAN + cardholder name +Exp. Date + CVV2/CVC2) cannot be considered a knowledge element. However, many would consider this data to rather be an element of possession, as also the physical card is an element of possession. The CVV2/CVC2 was originally intro-duced to establish that the actual physical card had at some point in time been in-volved in the initiation of the card-based payment – e.g. that it is not just a computer-generated card number under an issuer BIN.\n\n***\n\n### Answer\n\nArticle 4(30) of Directive 2015/2366/EU (PSD2) defines ‘possession’ as “something only the user possesses”.\n\nParagraph 28 and Table 2 of the EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06) clarified that card details and card security code that are printed on the card cannot constitute a valid possession element for the approaches currently observed on the market since the requirements of Article 7 of the Commission Delegated Regulation (EU) 2018/389 would not be met.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4235)\n\n## Related Level 1 articles\n\n- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)\n"}