{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2019-06-14","gaps":[],"covered":["EBA Q&A 2019_4586 — Q&A — Requirement on the use of a Qualified Certificate [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4586-requirement-on-the-use-of-a-qualified-certificate-for","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4586-requirement-on-the-use-of-a-qualified-certificate-for","title":"EBA Q&A 2019_4586 — Q&A — Requirement on the use of a Qualified Certificate [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4586-requirement-on-the-use-of-a-qualified-certificate-for","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 14 June 2019","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4586","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"7a6a3591295036cc","change_date":null,"nearest_versions":["2019-06-14"],"first_text_date":null,"correction_applies":false,"versions":["2019-06-14"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4586-requirement-on-the-use-of-a-qualified-certificate-for/versions/2019-06-14","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4586-requirement-on-the-use-of-a-qualified-certificate-for/versions/2019-06-14/rev/7a6a3591295036cc","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4586-requirement-on-the-use-of-a-qualified-certificate-for/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4586-requirement-on-the-use-of-a-qualified-certificate-for/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 14 Jun 2019 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2019-06-14","question_submitted_on":"2019-02-28","locators":{"published_on":"EBA Q&A register entry 2019_4586, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4586, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4586","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4586-requirement-on-the-use-of-a-qualified-certificate-for.md","body_sha256":"8f6f46b2c45669796e98a603cf4bfc5f3cae3a672b83745a5e3d77848351ed57"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2019_4586 — Q&A — Requirement on the use of a Qualified Certificate [Final Q&A]\"\nshortTitle: \"EBA Q&A 2019_4586 — Q&A — Requirement on the use of a Qualified Certificate [Final Q&A]\"\nanswer_id: EBA_QA_2019_4586\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 98 PSD2\"\ndate: 14 June 2019\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4586\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 14 June 2019\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4586\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2019_4586, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2019-06-14\"\n  question_submitted_on: \"2019-02-28\"\n  locators:\n    published_on: \"EBA Q&A register entry 2019_4586, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2019_4586, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 14 Jun 2019 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 14 June 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4586)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2019_4586 — Q&A — Requirement on the use of a Qualified Certificate \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2019_4586 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 14 June 2019; question submitted 28 February 2019 |\n| **Legal basis** | Article 98 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Requirement on the use of a Qualified Certificate for Electronic Seals (QSealC) for integrity and authenticity**\n\n### Question\n\nPlease clarify whether in the EBA’s Opinion on the use of eIDAS under the RTS on SCA and CSC, under Paragraph 11, Qualified Electronic Seals employing a Qualified Seal creation Device are required to provide integrity and authenticity through the reference to Article 35(2) of Regulation (EU) No 910/2014?\n\n### Background\n\nThe Opinion of the European Banking Authority on the use of eIDAS certificates under the RTS on SCA and CSC item 11 describes using of QSealC as required by RTS Article 34(1) for integrity and authenticity of signed / sealed data. This goes on to reference Article 35(2) of Regulation (EU) No 910/2014 (eIDAS). Article 35(2) of Regulation (EU) No 910/2014 relates to a \"Qualified Electronic Seal\". Under eIDAS Artcile 3(27) a \"Qualified Electronic Seal\" includes additional requirements beyond the use of a QSealC in particular use of special device for security of the signing key called in eIDAS a \"Qualified Signature/Seal Creation Device\". Use of such a device would be a significant additional burden on Payment Service Providers.\n\n***\n\n### Answer\n\nArticle 34(1) of the Commission Delegated Regulation (EU) 2018/389 specifies that ‘for the purpose of identification, as referred to in Article 30(1)(a), payment service providers shall rely on qualified certificates for electronic seals (QSealCs) as referred to in Article 3(30) of Regulation (EU) No 910/2014 or for website authentication (QWACs) as referred to in Article 3(39) of that Regulation.’\n\nParagraph 11 of the Opinion of the European Banking Authority (EBA) on the use of eIDAS certificates under the RTS on strong customer authentication and secure communication, describes some of the specificities of QSealCs, namely that they (i) ensure the integrity and correctness of the origin (authenticity) of the signed data and (ii) provide strong evidence of the signed data.\n\nThe reference in the EBA’s Opinion to Article 35(2) of Regulation (EU) No 910/2014 shows that the specificities of the QSealCs cited in paragraph 11 of the Opinion were in line with the applicable legislation.\n\nFurther, this reference is in line with the objective of PSD2 of technological neutrality and did not infer that Qualified Electronic Seals employing a Qualified Seal creation Device are required for the purpose of Article 34(1) of the Delegated Regulation.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4586)\n\n## Related Level 1 articles\n\n- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)\n"}