{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-02-26","gaps":[],"covered":["EBA Q&A 2018_4383 — Q&A — Exemption of secure corporate payment processes [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4383-exemption-of-secure-corporate-payment-processes-and","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4383-exemption-of-secure-corporate-payment-processes-and","title":"EBA Q&A 2018_4383 — Q&A — Exemption of secure corporate payment processes [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4383-exemption-of-secure-corporate-payment-processes-and","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 26 February 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4383","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"6c0542b412a5cd1c","change_date":null,"nearest_versions":["2021-02-26"],"first_text_date":null,"correction_applies":false,"versions":["2021-02-26"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4383-exemption-of-secure-corporate-payment-processes-and/versions/2021-02-26","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4383-exemption-of-secure-corporate-payment-processes-and/versions/2021-02-26/rev/6c0542b412a5cd1c","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4383-exemption-of-secure-corporate-payment-processes-and/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4383-exemption-of-secure-corporate-payment-processes-and/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 26 Feb 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-02-26","question_submitted_on":"2018-11-21","locators":{"published_on":"EBA Q&A register entry 2018_4383, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4383, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4383","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4383-exemption-of-secure-corporate-payment-processes-and.md","body_sha256":"0d45572bba702ed5ea341987ce9f10b01be03173e52c1cc95535f6ee6040a5d7"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2018_4383 — Q&A — Exemption of secure corporate payment processes [Final Q&A]\"\nshortTitle: \"EBA Q&A 2018_4383 — Q&A — Exemption of secure corporate payment processes [Final Q&A]\"\nanswer_id: EBA_QA_2018_4383\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 98(1) PSD2\"\ndate: 26 February 2021\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4383\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 26 February 2021\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4383\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2018_4383, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2021-02-26\"\n  question_submitted_on: \"2018-11-21\"\n  locators:\n    published_on: \"EBA Q&A register entry 2018_4383, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2018_4383, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 26 Feb 2021 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 26 February 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4383)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2018_4383 — Q&A — Exemption of secure corporate payment processes \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2018_4383 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 26 February 2021; question submitted 21 November 2018 |\n| **Legal basis** | Article 98(1) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Exemption of secure corporate payment processes and protocols**\n\n### Question\n\nIs the exemption of applying strong customer authentication, in respect of legal persons initiating electronic payment transactions through the use of dedicated payment processes or protocols that are only made available to payers who are not consumers applicable to both payment initiation and account information services? Or, is it solely applicable to payment initiation service?\n\n### Background\n\nThe text “dedicated payment process or protocols” could be understood as making reference solely to payment process also known as payment initiations and would there by exclude account information processes from benefiting from exemption of strong customer authentication under the conditions expressed in Article 17 of the RTS.\n\nIf the exemption is only applicable to payment initiation, in the case where our company has an encrypted leased line or VPN tunnel with our client establishing a secure communication between our companies where both parties are completely identified. Where the customers accounting system uses API’s to communicate directly with our core banking system and is able among other functions to initiate payments and request account information such as balances and transactions on accounts which we also make available on our online banking system in case the primary connection breaks down.\n\nWe would be able to exempt from secure customer authentication the payment initiation performed by our client’s system for instance when he pays his employees. We would however be forced to require secure customer authentication for that same system to request and download the account statement when it performs the reconciliation of these same accounts.\n\n***\n\n### Answer\n\nArticle 17 of the Commission Delegated Regulation (EU) 2018/389 states that payment service providers may decide not to apply strong customer authentication (SCA) “in respect of legal persons initiating electronic payment transactions through the use of dedicated payment processes or protocols that are only made available to payers who are not consumers”, provided competent authorities are satisfied that the levels of security are equivalent to those provided for by Directive 2015/2366/EU (PSD2). This exemption applies solely to payment initiation, given it refers to “legal persons initiating electronic payment transactions”; it does not apply to account information.\n\nPayment initiation as a process is not to be confused with payment initiation services, with the latter referring to a payment that is initiated by a third party.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4383)\n\n## Related Level 1 articles\n\n- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)\n"}