{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-01-15","gaps":[],"covered":["EBA Q&A 2018_4315 — Q&A — Strong Authentication [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4315-strong-authentication","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4315-strong-authentication","title":"EBA Q&A 2018_4315 — Q&A — Strong Authentication [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4315-strong-authentication","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 15 January 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4315","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"42ed72734a787da1","change_date":null,"nearest_versions":["2021-01-15"],"first_text_date":null,"correction_applies":false,"versions":["2021-01-15"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4315-strong-authentication/versions/2021-01-15","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4315-strong-authentication/versions/2021-01-15/rev/42ed72734a787da1","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4315-strong-authentication/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4315-strong-authentication/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 15 Jan 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-01-15","question_submitted_on":"2018-10-08","locators":{"published_on":"EBA Q&A register entry 2018_4315, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4315, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4315","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4315-strong-authentication.md","body_sha256":"478185a2718e575c70b6aebd9589d50eb7637cdc7439e6584e93fa3ab7a63725"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2018_4315 — Q&A — Strong Authentication [Final Q&A]\"\nshortTitle: \"EBA Q&A 2018_4315 — Q&A — Strong Authentication [Final Q&A]\"\nanswer_id: EBA_QA_2018_4315\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 97 PSD2\"\ndate: 15 January 2021\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4315\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 15 January 2021\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4315\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2018_4315, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2021-01-15\"\n  question_submitted_on: \"2018-10-08\"\n  locators:\n    published_on: \"EBA Q&A register entry 2018_4315, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2018_4315, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 15 Jan 2021 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 15 January 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4315)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2018_4315 — Q&A — Strong Authentication \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2018_4315 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 15 January 2021; question submitted 8 October 2018 |\n| **Legal basis** | Article 97 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Strong Authentication**\n\n### Question\n\nIs one time passcode (OTP) Mail considered as a \"Strong Customer Authentication\" under Regulation (EU) 2018/389 – RTS on strong customer authentication and secure communication?\n\n### Background\n\nAuthentication by OTP mail reunites 2 authentication factors :\n\n1. The one-time password received by mail, enrolled by the payer's bank\n\n2. The password to access mails, only known by the payer.\n\nOTP mail is convenient for expatriates that can not have access to the SMS. It aims at replacing authentication by birthday date which is not a valid authentication method regarding the RTS.\n\n***\n\n### Answer\n\nArticle 4 (30) of Directive 2015/2366/EU (PSD2) defines possession as ‘something only the user possesses’.\n\nParagraph 26 of the EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06), clarified that approaches relying on mobile apps, web browsers or the exchange of (public and private) keys may also be evidence of possession, provided that they include a device-binding process that ensures a unique connection between the payment service user’s app, browser or key and the device.\n\nThis means that apps or web browsers (i) where the email with the OTP is received by the payment service users and (ii) which have a unique connection with the device, could evidence possession and thus be considered as a valid factor in a two-factor strong customer authentication under PSD2 and the Commission Delegated Regulation (EU) 2018/389. This would, however, require the email address where the OTP is sent to, to be accessible only via a registered device.\n\nFinally, it is for the payment service provider to ensure the unique connection between the device and the payment service user’s app or browser.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4315)\n\n## Related Level 1 articles\n\n- [Article 97 — Authentication](../../../articles/97.md)\n"}