{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2019-12-20","gaps":[],"covered":["EBA Q&A 2019_4556 — Q&A — Definition of payee for dynamic linking [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4556-definition-of-payee-for-dynamic-linking","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4556-definition-of-payee-for-dynamic-linking","title":"EBA Q&A 2019_4556 — Q&A — Definition of payee for dynamic linking [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4556-definition-of-payee-for-dynamic-linking","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 20 December 2019","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4556","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"6726b92be6527f5b","change_date":null,"nearest_versions":["2019-12-20"],"first_text_date":null,"correction_applies":false,"versions":["2019-12-20"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4556-definition-of-payee-for-dynamic-linking/versions/2019-12-20","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4556-definition-of-payee-for-dynamic-linking/versions/2019-12-20/rev/6726b92be6527f5b","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4556-definition-of-payee-for-dynamic-linking/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4556-definition-of-payee-for-dynamic-linking/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 20 Dec 2019 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2019-12-20","question_submitted_on":"2019-02-15","locators":{"published_on":"EBA Q&A register entry 2019_4556, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4556, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4556","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4556-definition-of-payee-for-dynamic-linking.md","body_sha256":"d41d8f7339b6c94691bdcd5b489d9e8b3d9db216c71922e8d1541c7f602ed57f"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2019_4556 — Q&A — Definition of payee for dynamic linking [Final Q&A]\"\nshortTitle: \"EBA Q&A 2019_4556 — Q&A — Definition of payee for dynamic linking [Final Q&A]\"\nanswer_id: EBA_QA_2019_4556\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 97 PSD2\"\ndate: 20 December 2019\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4556\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 20 December 2019\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4556\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2019_4556, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2019-12-20\"\n  question_submitted_on: \"2019-02-15\"\n  locators:\n    published_on: \"EBA Q&A register entry 2019_4556, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2019_4556, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 20 Dec 2019 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 20 December 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4556)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2019_4556 — Q&A — Definition of payee for dynamic linking \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2019_4556 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 20 December 2019; question submitted 15 February 2019 |\n| **Legal basis** | Article 97 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Definition of payee for dynamic linking**\n\n### Question\n\nArticle 5 of the RTS on strong customer authentication and secure communication requires the authentication code to be specific to the amount of the payment transaction and the payee.\n\nDoes it suffice to include a meaningful part of the identifier into the calculation of the authentication code? For instance, would it suffice to include only numeric characters of the IBAN in the calculation of the authentication code?\n\n### Background\n\nThis question regularly pops up in discussions about the practical implementation of strong customer authentication.\n\nA payee can be identified in multiple ways, such as an International Bank Account Number (IBAN), phone number, name, etc. These identifiers often consist of a mix of alphanumeric characters (A-Z, 0-9). For instance, an IBAN often contains alphabetic characters.\n\nCertain authentication devices (e.g. hardware tokens) only allow entry of numeric characters (0-9), and not alphabetic ones (A-Z). As a consequence, the authentication device cannot calculate the authentication code over the precise identifier (e.g. full IBAN).\n\n***\n\n### Answer\n\nArticle 5(1) of the Delegated Regulation (EU) 2018/389 states that “where payment service providers apply strong customer authentication in accordance with Article 97(2) of Directive (EU) 2015/2366, in addition to the requirements of Article 4, they shall adopt security measures that meet each of the following requirements: a) the payer is made aware of the amount of the payment transaction and of the payee; b) the authentication code generated is specific to the amount of the payment transaction and the payee agreed to by the payer when initiating the transaction; c) the authentication code accepted by the payment service provider corresponds to the original specific amount of the payment transaction and to the identity of the payee agreed to by the payer; d) any change to the amount or the payee results in the invalidation of the authentication code generated”.\n\nIn that regard, the authentication code shall be specific to the payee(s) agreed to by the payer. However, the Delegated Regulation does not specify how the payee should be identified for the purpose of the dynamic linking requirements in Article 5, which can be, for instance, through the IBAN (or a similar type of unique identifier).\n\nIn relation to the above, it would be sufficient to include a meaningful part of the IBAN (or a similar type of unique identifier), or none at all, in the authentication code, provided that the requirements in Article 5(1) of the Delegated Regulation are met.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4556)\n\n## Related Level 1 articles\n\n- [Article 97 — Authentication](../../../articles/97.md)\n"}