--- title: "EBA Q&A 2018_4338 — Q&A — Trusted Beneficiaries [Final Q&A]" shortTitle: "EBA Q&A 2018_4338 — Q&A — Trusted Beneficiaries [Final Q&A]" answer_id: EBA_QA_2018_4338 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 98(1) PSD2" date: 9 April 2021 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4338 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 9 April 2021" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4338" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2018_4338, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2021-04-09" question_submitted_on: "2018-10-24" locators: published_on: "EBA Q&A register entry 2018_4338, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2018_4338, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 9 Apr 2021 [Final Q&A]** *Final Q&A · EBA Q&A register, 9 April 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4338)* | | | |---|---| | **Full title** | EBA Q&A 2018_4338 — Q&A — Trusted Beneficiaries \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2018_4338 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 9 April 2021; question submitted 24 October 2018 | | **Legal basis** | Article 98(1) PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Trusted Beneficiaries** ### Question Article 13 of the RTS on strong customer authentication (SCA) and secure communication does not seem to restrict the use of trusted beneficiaries beside the fact that the payee must be in the list of trusted beneficiaries when initiating the payment transaction. Is it correct to conclude from this that the usage of trusted beneficiaries is not further restricted and can, therefore, also be implemented as a generic beneficiary approval step prior to every initiation of a payment transaction? ### Background Article 97.2 of the PSD2 Directive and Article 5 of the RTS on strong customer authentication and secure communication require payment service providers to apply SCA that includes elements which dynamically link the transaction to a specific amount and a specific payee for the initiation of electronic payment transactions. Article 13 of the RTS allows payment service providers to not apply SCA where the payer initiates a payment transaction and the payee is included in a list of trusted beneficiaries previously created by the payer. SCA is to be applied where a payer creates or amends a list of trusted beneficiaries. The requirement for applying SCA aims at increasing security whilst reducing the risk of fraud. Applying SCA with dynamic linking to the payee and the amount when initiating a payment transaction aims at providing additional security beyond SCA without dynamic linking. However, the concept of trusted beneficiaries does not hinder an attacker adopting whitelisting with SCA (without any linking) for approving a new payee before initiating a fake payment. There appears to be no legitimate security rationale to limit a Payment Services User (PSU) beyond what an attacker is effectively limited to. The risk of circumvention by an attacker can consistently be mitigated e.g. by implementing, beyond current RTS requirements, SCA with dynamic linking to the payee whenever adding a new payee to the list of trusted beneficiaries. *** ### Answer Under Article 13(2) of the Commission Delegated Regulation (EU) 2018/389, payment service providers “shall be allowed not to apply strong customer authentication where the payer initiates a payment transaction and the payee is included in a list of trusted beneficiaries previously created by the payer”. Article 13 of the Delegated Regulation does not restrict the use of the trusted beneficiary list by payment service providers for other purposes such as the introduction of an option for the payer to add a new payee to the general trusted beneficiary list as an additional step in the approval process prior to every initiation of a new payment transaction. However, in accordance with Article 13(1) of the Delegated Regulation, adding the payee to the general trusted beneficiary list requires the application of strong customer authentication, including when done prior to the initiation of the payment transaction. The above is without prejudice to the clarifications provided in Q&A 2018\_4076. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4338) ## Related Level 1 articles - [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)