--- title: "EBA Q&A 2019_4450 — Q&A — Potential inconsistency on the application [Rejected question]" shortTitle: "EBA Q&A 2019_4450 — Q&A — Potential inconsistency on the application [Rejected question]" answer_id: EBA_QA_2019_4450 status: "Rejected question" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: withdrawn regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 97 PSD2" date: 11 February 2022 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4450 lifecycle: "Rejected question" text_version: "EBA Q&A register, 11 February 2022" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4450" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "not stated in the document" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Consultancy firm" locator: "EBA Q&A register entry 2019_4450: no answer; the register names only the 'Type of submitter'" document_type: "qa_question" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2022-02-11" question_submitted_on: "2019-01-04" locators: published_on: "EBA Q&A register entry 2019_4450, field 'Rejected publishing date'" question_submitted_on: "EBA Q&A register entry 2019_4450, field 'Submission date'" lifecycle_label: "Rejected question" --- **Question published in the EBA Q&A tool · no answer · not legislation · published 11 Feb 2022 [Rejected question]** *Rejected question · EBA Q&A register, 11 February 2022 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4450)* | | | |---|---| | **Full title** | EBA Q&A 2019_4450 — Q&A — Potential inconsistency on the application \[Rejected question\] | | **Prepared by** | Not stated in the document | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2019_4450 | | **Document type** | Q&A | | **Legal nature** | No answer · not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 11 February 2022; question submitted 4 January 2019 | | **Legal basis** | Article 97 PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Potential inconsistency on the application of Strong Customer Authentication exemptions to AISPs** ### Question Shall Account Servicing Payment Service Providers (ASPSPs) always grant Account Information Service Provider (AISPs) to be exempted from Strong Customer Authentication (SCA) according to rules defined in Article 10 of the RTS on strong customer authentication and secure communication (Delegated Regulation (EU) 2018/389), or is the final decision to apply such exemption always up to the ASPSP? ### Background There is a seeming inconsistency between RTS on strong customer authentication (SCA) and secure communication (CSC) (Delegated Regulation (EU) 2018/389), the EBA opinion on the application of RTS on SCA and CSC (EBA-Op-2018-04), and the Q&A answer EBA Q&A 2018\_4089. 1. Article 10 of the RTS on strong customer authentication and secure communication, states: "(Payment Services Providers) PSPs shall be allowed not to apply SCA, (...), where a (Payment Services User) PSU is limited to accessing either or both of the following items online without disclosure of sensitive payment data: (a) the balance of one or more designated payment accounts; (b) the payment transactions executed in the last 90 days through one or more designated payment accounts." Article 36(5) of the RTS on SCA and CSC, states: “Account information service providers shall be able to access information from designated payment accounts and associated payment transactions held by account servicing payment service providers for the purposes of performing the account information service in either of the following circumstances: (a) whenever the payment service user is actively requesting such information; (b) where the payment service user does not actively request such information, no more than four times in a 24-hour period, unless a higher frequency is agreed between the account information service provider and the account servicing payment service provider, with the payment service user's consent.” COMMENT: The above articles seems to entail that the SCA exemption under Article 10 of the RTS shall be applied mandatorily by ASPSP whenever an Account Information Service Provider (AISP) is requesting it, otherwise it would not be possible for AISPs to exercise their right to perform automated AIS accesses without the PSU. ex art 36(5). 2. EBA Opinion on the implementation of the RTS on SCA and CSC, EBA-Op-2018-04, paragraph 38, states: “...the PSP applying SCA is the PSP that issues the personalised security credentials \[i.e. the ASPSP\]. It is consequently also the same provider that decides whether or not to apply an exemption in the context of AIS and PIS. EBA Opinion EBA-Op-2018-04, paragraph 39, states: “...only the ASPSP can apply SCA or decide whether or not an exemption applies to a PSU’s payment account in the context of AIS and PIS.” COMMENT: EBA Opinion EBA-Op-2018-04 states that all exemptions - thus including Article 10 of the RTS - are applicable in a fully discretionary way by the ASPSP. Therefore, an ASPSP may decide to never apply the exemption ex art 10 to the AIS services, or to apply such exemption only when the PSU is accessing through the ASPSP direct channels (e.g. Internet Banking) and to avoid applying it when the PSU accesses through an AISP, i.e. to apply it in a discriminatory way versus Third Party Providers (TPPs). It seems that the statements included in the EBA Opinion EBA-Op-2018-04, paragraph 38 and 39, if not mitigated, are at odds with a key objective of the PSD2 i.e. to create a "level playfield" between ASPSPs and TPPs. Furthermore, there is a significant contradiction with respect to Article 36(5) of the RTS. 3. Q&A Tool / EBA Q&A 2018\_4089 “PSD2 does not distinguish between payment transactions that may have been made using a payment initiation service provider or not. Similarly the Commission Delegated Regulation (EU) 2018/389 does not distinguish whether a payment transactions has been made using a payment initiation service provider or not for the purpose of applying an exemption.” COMMENT: In this EBA Answer a further different notion is affirmed both with respect to Article 36 (5) of the RTS, and in relation to paragraphs 38 and 39 in this EBA Opinion : i.e. for the purpose of applying the SCA exemptions, the input channel of the payment request (bank's own channel or TPP channel) is not relevant. The EBA answer 2018\_4089 is explicitely referred to exemptions related to PIS requests (RTS art. 11 to 18), however by applying the same concept to the exemption for AIS requests pursuant art. 10, it could be deduced that "it is the ASPSP that always decides whether or not to apply an exemption, provided that the same exemption is applied regardless of the channel from where the request is coming (own channel or XS2A)". The above rule would not be discriminatory against TPPs (like the one described in paragrah 38 and 39 of the EBA opinion EBA-Op-2018-04), but it is still at odds with Article 36(5) of the RTS. *** ### Answer Please note that as part of adjustments to the Single Rulebook Q&A process, agreed by the EBA and the European Commission, it has been decided to reject outstanding questions submitted before 1 January 2020, when the Q&A process was updated as part of the last ESAs Review. In particular, the question that you have submitted has now regrettably been rejected and will not be addressed. If you believe your question would still benefit from clarification, you are invited to resubmit your question, adapting it to reflect any legislative, regulatory or other relevant developments that may have occurred since the initial date of submission. The EBA will aim to address resubmitted questions as a matter of priority. When considering to resubmit, you are kindly requested to observe the updated admissibility criteria agreed in the context of the adjustment of the Q&A process, available in the Additional background and guidance for asking questions. We hope for your understanding. For further information please refer to the press release and the updated Q&A page. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4450) ## Related Level 1 articles - [Article 97 — Authentication](../../../articles/97.md)