{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2018-12-21","gaps":[],"covered":["EBA Q&A 2018_4238 — Q&A — Signature performed on the screen of a digital device [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4238-signature-performed-on-the-screen-of-a-digital-device-as-a","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4238-signature-performed-on-the-screen-of-a-digital-device-as-a","title":"EBA Q&A 2018_4238 — Q&A — Signature performed on the screen of a digital device [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4238-signature-performed-on-the-screen-of-a-digital-device-as-a","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 21 December 2018","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4238","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"5e69dc625a077497","change_date":null,"nearest_versions":["2018-12-21"],"first_text_date":null,"correction_applies":false,"versions":["2018-12-21"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4238-signature-performed-on-the-screen-of-a-digital-device-as-a/versions/2018-12-21","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4238-signature-performed-on-the-screen-of-a-digital-device-as-a/versions/2018-12-21/rev/5e69dc625a077497","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4238-signature-performed-on-the-screen-of-a-digital-device-as-a/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4238-signature-performed-on-the-screen-of-a-digital-device-as-a/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 21 Dec 2018 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2018-12-21","question_submitted_on":"2018-09-06","locators":{"published_on":"EBA Q&A register entry 2018_4238, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4238, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4238","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4238-signature-performed-on-the-screen-of-a-digital-device-as-a.md","body_sha256":"3fdc301725e6496d3eb0683c2d685f71dfd1d5ac62e8e9ae41b9f13ca59222b5"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2018_4238 — Q&A — Signature performed on the screen of a digital device [Final Q&A]\"\nshortTitle: \"EBA Q&A 2018_4238 — Q&A — Signature performed on the screen of a digital device [Final Q&A]\"\nanswer_id: EBA_QA_2018_4238\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 98(1) PSD2\"\ndate: 21 December 2018\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4238\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 21 December 2018\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4238\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2018_4238, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2018-12-21\"\n  question_submitted_on: \"2018-09-06\"\n  locators:\n    published_on: \"EBA Q&A register entry 2018_4238, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2018_4238, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 21 Dec 2018 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 21 December 2018 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4238)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2018_4238 — Q&A — Signature performed on the screen of a digital device \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2018_4238 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 21 December 2018; question submitted 6 September 2018 |\n| **Legal basis** | Article 98(1) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Signature performed on the screen of a digital device as a factor in a two-factor SCA**\n\n### Question\n\nCould a signature performed on the screen of a digital device be considered a valid factor in a two-factor strong customer authentication (SCA) under the RTS – and what type of element is it?\n\n### Background\n\nEBA responded to a question about signature as authentication factor in connection to its “Final Report Draft RTS” of 23rd February 2017, Comment (273) -4), by saying\n\n“The EBA is of the view that it complies with the requirements under the RTS, including the presence of a dynamic element.”\n\nThe way the question is formulated it is unclear if the answer relates to a signature on a paper slip or a signature on a digital device, or both. It is also unclear to us what EBA means with “presence of a dynamic element” in this context.\n\nWe think EBA should elaborate on the requirements for capture and comparison of signature. The question of digital capture of a signature must be addressed separately from the issue of capture of signature on a paper slip.\n\n***\n\n### Answer\n\nArticle 4 of the Commission Delegated Regulation (EU) 2018/389 states that “the authentication shall be based on two or more elements which are categorised as knowledge,\n\npossession and inherence and shall result in the generation of an authentication code”.\n\nArticle 4 of PSD2 defines ‘Knowledge’ as ‘something only the user knows’, ‘possession’ as ‘something only the user possesses’ and ‘inherence’ as ‘something the user is’. Signature on a screen does not constitute ‘knowledge’ as this is not something only the user knows or ‘possession’ as this is not something that the user possesses.\n\nParagraph 34 of the EBA Opinion on the implementation of the regulatory technical standards on strong customer authentication (SCA) and common and secure communication, EBA-Op-2018-04, states that behavioural biometrics may constitute inherence providing they comply with the requirements under Article 8 of the Delegated Regulation. Consequently, a signature on a screen of a digital device alone could be considered as behavioural biometrics provided that the payment service provider could ensure that the access devices and recognition software are sufficiently comprehensive to ensure that there is a ‘very low probability of an unauthorised party being authenticated as the payer’ as required under Article 8 of the Delegated Regulation.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4238)\n\n## Related Level 1 articles\n\n- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)\n"}