{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2019-06-14","gaps":[],"covered":["EBA Q&A 2018_4400 — Q&A — Secure corporate payment processes and protocols [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4400-secure-corporate-payment-processes-and-protocols","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4400-secure-corporate-payment-processes-and-protocols","title":"EBA Q&A 2018_4400 — Q&A — Secure corporate payment processes and protocols [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4400-secure-corporate-payment-processes-and-protocols","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 14 June 2019","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4400","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"f4086a3dabc06583","change_date":null,"nearest_versions":["2019-06-14"],"first_text_date":null,"correction_applies":false,"versions":["2019-06-14"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4400-secure-corporate-payment-processes-and-protocols/versions/2019-06-14","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4400-secure-corporate-payment-processes-and-protocols/versions/2019-06-14/rev/f4086a3dabc06583","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4400-secure-corporate-payment-processes-and-protocols/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4400-secure-corporate-payment-processes-and-protocols/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 14 Jun 2019 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2019-06-14","question_submitted_on":"2018-12-04","locators":{"published_on":"EBA Q&A register entry 2018_4400, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4400, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4400","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4400-secure-corporate-payment-processes-and-protocols.md","body_sha256":"f5d1406561af5ac4a0e903b5ee9881bea1193adf8b8843f97f1b0c9142e4c86b"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2018_4400 — Q&A — Secure corporate payment processes and protocols [Final Q&A]\"\nshortTitle: \"EBA Q&A 2018_4400 — Q&A — Secure corporate payment processes and protocols [Final Q&A]\"\nanswer_id: EBA_QA_2018_4400\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 98(1) PSD2\"\ndate: 14 June 2019\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4400\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 14 June 2019\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4400\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2018_4400, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2019-06-14\"\n  question_submitted_on: \"2018-12-04\"\n  locators:\n    published_on: \"EBA Q&A register entry 2018_4400, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2018_4400, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 14 Jun 2019 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 14 June 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4400)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2018_4400 — Q&A — Secure corporate payment processes and protocols \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2018_4400 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 14 June 2019; question submitted 4 December 2018 |\n| **Legal basis** | Article 98(1) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Secure corporate payment processes and protocols**\n\n### Question\n\nAre USB drives (containing a certificate) used only by corporate clients compatible with RTS requirements?\n\nCan USB drives be considered as payment processes exempted from strong customer authentication ?\n\n### Background\n\nArticle 17 of the RTS on strong customer authentication and common secure communication creates an exemption from strong customer authentication based on the Secure corporate payment processes and protocols.\n\nPSPs are allowed not to apply SCA, in respect of legal persons initiating electronic payment transactions through the use of dedicated payment processes or protocols that are only made available to payers who are not consumers.\n\nThe question arises because there is no dynamic link (mandatory according to Article 5 of the RTS) in this process.\n\nAn X.509 certificate is a digital certificate that uses the widely accepted international X.509 public key infrastructure (PKI) standard to verify that a public key belongs to the user, computer or service identity contained within the certificate.\n\nIn our bank, the certificate (hosted in a USB key) is intended exclusively for a payers who are not consumers.\n\n***\n\n### Answer\n\nArticle 17 of the Commission Delegated Regulation (EU) 2018/389 states that “Payment service providers shall be allowed not to apply strong customer authentication, in respect of legal persons initiating electronic payment transactions through the use of dedicated payment processes or protocols that are only made available to payers who are not consumers, where the competent authorities are satisfied that those processes or protocols guarantee at least equivalent levels of security to those provided \\[in PSD2\\]”. This article refers to “the use of dedicated payment processes or protocols” to “initiate electronic payment transactions” but does not refer to a process used to carry out a specific element that may be required for the purpose of payment initiation, such as the authentication of the payment service user, for instance using an USB certificate.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4400)\n\n## Related Level 1 articles\n\n- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)\n"}