<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2019-06-14","gaps":[],"covered":["EBA Q&A 2018_4400 — Q&A — Secure corporate payment processes and protocols [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4400-secure-corporate-payment-processes-and-protocols","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4400-secure-corporate-payment-processes-and-protocols","title":"EBA Q&A 2018_4400 — Q&A — Secure corporate payment processes and protocols [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4400-secure-corporate-payment-processes-and-protocols","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 14 June 2019","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4400","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"f4086a3dabc06583","change_date":null,"nearest_versions":["2019-06-14"],"first_text_date":null,"correction_applies":false,"versions":["2019-06-14"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4400-secure-corporate-payment-processes-and-protocols/versions/2019-06-14","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4400-secure-corporate-payment-processes-and-protocols/versions/2019-06-14/rev/f4086a3dabc06583","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4400-secure-corporate-payment-processes-and-protocols/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4400-secure-corporate-payment-processes-and-protocols/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 14 Jun 2019 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2019-06-14","question_submitted_on":"2018-12-04","locators":{"published_on":"EBA Q&A register entry 2018_4400, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4400, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2018_4400 — Q&A — Secure corporate payment processes and protocols [Final Q&A]"
shortTitle: "EBA Q&A 2018_4400 — Q&A — Secure corporate payment processes and protocols [Final Q&A]"
answer_id: EBA_QA_2018_4400
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 98(1) PSD2"
date: 14 June 2019
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4400
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 14 June 2019"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4400"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2018_4400, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2019-06-14"
  question_submitted_on: "2018-12-04"
  locators:
    published_on: "EBA Q&A register entry 2018_4400, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2018_4400, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 14 Jun 2019 [Final Q&A]**

*Final Q&A · EBA Q&A register, 14 June 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4400)*

| | |
|---|---|
| **Full title** | EBA Q&A 2018_4400 — Q&A — Secure corporate payment processes and protocols \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2018_4400 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 14 June 2019; question submitted 4 December 2018 |
| **Legal basis** | Article 98(1) PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Secure corporate payment processes and protocols**

### Question

Are USB drives (containing a certificate) used only by corporate clients compatible with RTS requirements?

Can USB drives be considered as payment processes exempted from strong customer authentication ?

### Background

Article 17 of the RTS on strong customer authentication and common secure communication creates an exemption from strong customer authentication based on the Secure corporate payment processes and protocols.

PSPs are allowed not to apply SCA, in respect of legal persons initiating electronic payment transactions through the use of dedicated payment processes or protocols that are only made available to payers who are not consumers.

The question arises because there is no dynamic link (mandatory according to Article 5 of the RTS) in this process.

An X.509 certificate is a digital certificate that uses the widely accepted international X.509 public key infrastructure (PKI) standard to verify that a public key belongs to the user, computer or service identity contained within the certificate.

In our bank, the certificate (hosted in a USB key) is intended exclusively for a payers who are not consumers.

***

### Answer

Article 17 of the Commission Delegated Regulation (EU) 2018/389 states that “Payment service providers shall be allowed not to apply strong customer authentication, in respect of legal persons initiating electronic payment transactions through the use of dedicated payment processes or protocols that are only made available to payers who are not consumers, where the competent authorities are satisfied that those processes or protocols guarantee at least equivalent levels of security to those provided \[in PSD2\]”. This article refers to “the use of dedicated payment processes or protocols” to “initiate electronic payment transactions” but does not refer to a process used to carry out a specific element that may be required for the purpose of payment initiation, such as the authentication of the payment service user, for instance using an USB certificate.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4400)

## Related Level 1 articles

- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)