<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2019-12-20","gaps":[],"covered":["EBA Q&A 2019_4556 — Q&A — Definition of payee for dynamic linking [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4556-definition-of-payee-for-dynamic-linking","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4556-definition-of-payee-for-dynamic-linking","title":"EBA Q&A 2019_4556 — Q&A — Definition of payee for dynamic linking [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4556-definition-of-payee-for-dynamic-linking","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 20 December 2019","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4556","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"6726b92be6527f5b","change_date":null,"nearest_versions":["2019-12-20"],"first_text_date":null,"correction_applies":false,"versions":["2019-12-20"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4556-definition-of-payee-for-dynamic-linking/versions/2019-12-20","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4556-definition-of-payee-for-dynamic-linking/versions/2019-12-20/rev/6726b92be6527f5b","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4556-definition-of-payee-for-dynamic-linking/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4556-definition-of-payee-for-dynamic-linking/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 20 Dec 2019 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2019-12-20","question_submitted_on":"2019-02-15","locators":{"published_on":"EBA Q&A register entry 2019_4556, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4556, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2019_4556 — Q&A — Definition of payee for dynamic linking [Final Q&A]"
shortTitle: "EBA Q&A 2019_4556 — Q&A — Definition of payee for dynamic linking [Final Q&A]"
answer_id: EBA_QA_2019_4556
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 97 PSD2"
date: 20 December 2019
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4556
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 20 December 2019"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4556"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2019_4556, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2019-12-20"
  question_submitted_on: "2019-02-15"
  locators:
    published_on: "EBA Q&A register entry 2019_4556, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2019_4556, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 20 Dec 2019 [Final Q&A]**

*Final Q&A · EBA Q&A register, 20 December 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4556)*

| | |
|---|---|
| **Full title** | EBA Q&A 2019_4556 — Q&A — Definition of payee for dynamic linking \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2019_4556 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 20 December 2019; question submitted 15 February 2019 |
| **Legal basis** | Article 97 PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Definition of payee for dynamic linking**

### Question

Article 5 of the RTS on strong customer authentication and secure communication requires the authentication code to be specific to the amount of the payment transaction and the payee.

Does it suffice to include a meaningful part of the identifier into the calculation of the authentication code? For instance, would it suffice to include only numeric characters of the IBAN in the calculation of the authentication code?

### Background

This question regularly pops up in discussions about the practical implementation of strong customer authentication.

A payee can be identified in multiple ways, such as an International Bank Account Number (IBAN), phone number, name, etc. These identifiers often consist of a mix of alphanumeric characters (A-Z, 0-9). For instance, an IBAN often contains alphabetic characters.

Certain authentication devices (e.g. hardware tokens) only allow entry of numeric characters (0-9), and not alphabetic ones (A-Z). As a consequence, the authentication device cannot calculate the authentication code over the precise identifier (e.g. full IBAN).

***

### Answer

Article 5(1) of the Delegated Regulation (EU) 2018/389 states that “where payment service providers apply strong customer authentication in accordance with Article 97(2) of Directive (EU) 2015/2366, in addition to the requirements of Article 4, they shall adopt security measures that meet each of the following requirements: a) the payer is made aware of the amount of the payment transaction and of the payee; b) the authentication code generated is specific to the amount of the payment transaction and the payee agreed to by the payer when initiating the transaction; c) the authentication code accepted by the payment service provider corresponds to the original specific amount of the payment transaction and to the identity of the payee agreed to by the payer; d) any change to the amount or the payee results in the invalidation of the authentication code generated”.

In that regard, the authentication code shall be specific to the payee(s) agreed to by the payer. However, the Delegated Regulation does not specify how the payee should be identified for the purpose of the dynamic linking requirements in Article 5, which can be, for instance, through the IBAN (or a similar type of unique identifier).

In relation to the above, it would be sufficient to include a meaningful part of the IBAN (or a similar type of unique identifier), or none at all, in the authentication code, provided that the requirements in Article 5(1) of the Delegated Regulation are met.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4556)

## Related Level 1 articles

- [Article 97 — Authentication](../../../articles/97.md)