{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2020-09-25","gaps":[],"covered":["EBA Q&A 2019_4560 — Q&A — SCA profiles and multiple-use of devices [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4560-sca-profiles-and-multiple-use-of-devices","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4560-sca-profiles-and-multiple-use-of-devices","title":"EBA Q&A 2019_4560 — Q&A — SCA profiles and multiple-use of devices [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4560-sca-profiles-and-multiple-use-of-devices","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 25 September 2020","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4560","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"bbcdec776ff0a2b2","change_date":null,"nearest_versions":["2020-09-25"],"first_text_date":null,"correction_applies":false,"versions":["2020-09-25"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4560-sca-profiles-and-multiple-use-of-devices/versions/2020-09-25","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4560-sca-profiles-and-multiple-use-of-devices/versions/2020-09-25/rev/bbcdec776ff0a2b2","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4560-sca-profiles-and-multiple-use-of-devices/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4560-sca-profiles-and-multiple-use-of-devices/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 25 Sep 2020 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2020-09-25","question_submitted_on":"2019-02-19","locators":{"published_on":"EBA Q&A register entry 2019_4560, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4560, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4560","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4560-sca-profiles-and-multiple-use-of-devices.md","body_sha256":"0343634990a8b7df4e52800d92aeffba68499cc4cc4958e5d319dfdb1b521d1d"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2019_4560 — Q&A — SCA profiles and multiple-use of devices [Final Q&A]\"\nshortTitle: \"EBA Q&A 2019_4560 — Q&A — SCA profiles and multiple-use of devices [Final Q&A]\"\nanswer_id: EBA_QA_2019_4560\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 97(1) PSD2\"\ndate: 25 September 2020\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4560\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 25 September 2020\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4560\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2019_4560, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2020-09-25\"\n  question_submitted_on: \"2019-02-19\"\n  locators:\n    published_on: \"EBA Q&A register entry 2019_4560, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2019_4560, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 25 Sep 2020 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 25 September 2020 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4560)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2019_4560 — Q&A — SCA profiles and multiple-use of devices \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2019_4560 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 25 September 2020; question submitted 19 February 2019 |\n| **Legal basis** | Article 97(1) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**SCA profiles and multiple-use of devices**\n\n### Question\n\nCan multiple users use the same device (i.e. smartphone) and have different strong customer authentication (SCA) profiles on the same device?\n\n### Background\n\nArticle 24 of Regulation (EU) 2018/389 – RTS on strong customer authentication and secure communication only explains that \"Payment service providers\" shall ensure that only the payment service user is associated, in a secure manner, with the personalised security credentials, the authentication devices and the software.\n\nArticle 24 does not say anything about multiple use of devices.\n\n\"Article 24 - Association with the payment service user\n\n1. Payment service providers shall ensure that only the payment service user is associated, in a secure manner, with the personalised security credentials, the authentication devices and the software.\n\n2. For the purpose of paragraph 1, payment service providers shall ensure that each of the following requirements is met:\n\n(a) the association of the payment service user's identity with personalised security credentials, authentication devices and software is carried out in secure environments under the payment service provider's responsibility comprising at least the payment service provider's premises, the internet environment provided by the payment service provider or other similar secure websites used by the payment service provider and its automated teller machine services, and taking into account risks associated with devices and underlying components used during the association process that are not under the responsibility of the payment service provider;\n\n(b) the association by means of a remote channel of the payment service user's identity with the personalised security credentials and with authentication devices or software is performed using strong customer authentication.\"\n\n***\n\n### Answer\n\nArticle 24(1) of the Commission Delegated Regulation (EU) 2018/389 provides that ‘payment service providers shall ensure that only the payment service user is associated, in a secure manner, with the personalised security credentials, the authentication devices and the software’. Paragraph 2, letter ‘b’ of the same article continues by specifying that ‘the association by means of a remote channel of the payment service user's identity with the personalised security credentials and with authentication devices or software is performed using strong customer authentication.’\n\nIn line with the requirements of Article 24 of the Delegated Regulation only a single payment service user can be associated, at a time, with the personalised security credentials, the authentication devices and/or software. This does not preclude, however, the use of the same authentication device and/or software by multiple payment service users having different SCA profiles when supported by the device and/or software.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4560)\n\n## Related Level 1 articles\n\n- [Article 97 — Authentication](../../../articles/97.md)\n"}