<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2019-06-14","gaps":[],"covered":["EBA Q&A 2018_4413 — Q&A — Qualified certificate under eIDAS for ASPSP [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4413-qualified-certificate-under-eidas-for-aspsp","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4413-qualified-certificate-under-eidas-for-aspsp","title":"EBA Q&A 2018_4413 — Q&A — Qualified certificate under eIDAS for ASPSP [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4413-qualified-certificate-under-eidas-for-aspsp","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 14 June 2019","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4413","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"b786bc31b65edea0","change_date":null,"nearest_versions":["2019-06-14"],"first_text_date":null,"correction_applies":false,"versions":["2019-06-14"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4413-qualified-certificate-under-eidas-for-aspsp/versions/2019-06-14","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4413-qualified-certificate-under-eidas-for-aspsp/versions/2019-06-14/rev/b786bc31b65edea0","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4413-qualified-certificate-under-eidas-for-aspsp/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4413-qualified-certificate-under-eidas-for-aspsp/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 14 Jun 2019 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2019-06-14","question_submitted_on":"2018-12-10","locators":{"published_on":"EBA Q&A register entry 2018_4413, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4413, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2018_4413 — Q&A — Qualified certificate under eIDAS for ASPSP [Final Q&A]"
shortTitle: "EBA Q&A 2018_4413 — Q&A — Qualified certificate under eIDAS for ASPSP [Final Q&A]"
answer_id: EBA_QA_2018_4413
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 98(1) PSD2"
date: 14 June 2019
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4413
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 14 June 2019"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4413"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2018_4413, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2019-06-14"
  question_submitted_on: "2018-12-10"
  locators:
    published_on: "EBA Q&A register entry 2018_4413, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2018_4413, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 14 Jun 2019 [Final Q&A]**

*Final Q&A · EBA Q&A register, 14 June 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4413)*

| | |
|---|---|
| **Full title** | EBA Q&A 2018_4413 — Q&A — Qualified certificate under eIDAS for ASPSP \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2018_4413 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 14 June 2019; question submitted 10 December 2018 |
| **Legal basis** | Article 98(1) PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Qualified certificate under eIDAS for ASPSP**

### Question

Is it required for an Account Servicing Payment Service Provider (ASPSP) to use qualified certificates under eIDAS to identify itself to a Third Party Provider (TPP)?

### Background

Article 34 (1) refers to Article 30 (1) in Regulation (EU No 910/2014 relating to qualified certificates. This is called eIDAS within our submission. Under (a) to (c) are mentioned AISP, PISP and CBPII without ASPSP. So too in Table 1 in "Opinion of the European Banking Authority on the implementation of the RTS on SCA and CSC". Nevertheless article 34 (2) and (3) mention ASPSP in conjunction with qualified certificates under eIDAS describing the necessary attributes to be used inside certificates. So it seems to be, that there is no unique definition whether ASPSP needs qualified certificates or not.

***

### Answer

Article 30(1)(a) of the Commission Delegated Regulation (EU) 2018/389 specifies that ‘account servicing payment service providers that offer to a payer a payment account that is accessible online shall have in place at least one interface which meets each of the following requirements: (a) account information service providers, payment initiation service providers and payment service providers issuing card-based payment instruments are able to identify themselves towards the account servicing payment service provider’.

Article 34(1) of the Delegated Regulation, provides that ‘for the purpose of identification, as referred to in Article 30(1)(a), payment service providers shall rely on qualified certificates for electronic seals (QSealCs) as referred to in Article 3(30) of Regulation (EU) No 910/2014 or for website authentication (QWACs) as referred to in Article 3(39) of that Regulation.’

In relation to the above, in paragraph 28 of the EBA Opinion on the use of eIDAS certificates under the RTS on strong customer authentication and secure communication it states that in the scenario where the payment service provider acts in its capacity as an account servicing payment service provider and offers to payment service users accounts that are accessible online, said payment service providers should be assigned the role ‘account servicing’. Also, the Delegated Regulation and PSD2 do not require account servicing payment service providers to identify themselves towards the account information service providers, payment initiation service providers and payment service providers issuing card-based payment instruments. Nevertheless, competent authorities could encourage account servicing payment service providers also to obtain an eIDAS certificate for the purpose of mutual identification.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4413)

## Related Level 1 articles

- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)