{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2020-06-19","gaps":[],"covered":["EBA Q&A 2019_4637 — Q&A — Separation of factors for strong customer authentication [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4637-separation-of-factors-for-strong-customer-authentication","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4637-separation-of-factors-for-strong-customer-authentication","title":"EBA Q&A 2019_4637 — Q&A — Separation of factors for strong customer authentication [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4637-separation-of-factors-for-strong-customer-authentication","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 19 June 2020","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4637","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"6264b454629f4d37","change_date":null,"nearest_versions":["2020-06-19"],"first_text_date":null,"correction_applies":false,"versions":["2020-06-19"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4637-separation-of-factors-for-strong-customer-authentication/versions/2020-06-19","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4637-separation-of-factors-for-strong-customer-authentication/versions/2020-06-19/rev/6264b454629f4d37","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4637-separation-of-factors-for-strong-customer-authentication/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4637-separation-of-factors-for-strong-customer-authentication/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 19 Jun 2020 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2020-06-19","question_submitted_on":"2019-03-28","locators":{"published_on":"EBA Q&A register entry 2019_4637, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4637, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4637","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4637-separation-of-factors-for-strong-customer-authentication.md","body_sha256":"47d4b565b54be8165f97b1d941e2776f283aaa22510153caf5fefdca338e2701"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2019_4637 — Q&A — Separation of factors for strong customer authentication [Final Q&A]\"\nshortTitle: \"EBA Q&A 2019_4637 — Q&A — Separation of factors for strong customer authentication [Final Q&A]\"\nanswer_id: EBA_QA_2019_4637\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 97 PSD2\"\ndate: 19 June 2020\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4637\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 19 June 2020\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4637\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2019_4637, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2020-06-19\"\n  question_submitted_on: \"2019-03-28\"\n  locators:\n    published_on: \"EBA Q&A register entry 2019_4637, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2019_4637, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 19 Jun 2020 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 19 June 2020 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4637)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2019_4637 — Q&A — Separation of factors for strong customer authentication \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2019_4637 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 19 June 2020; question submitted 28 March 2019 |\n| **Legal basis** | Article 97 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Separation of factors for strong customer authentication**\n\n### Question\n\nIf a mobile phone has two different e-banking apps on it, one for the banking agendas (a banking app where payments are initiated by entering password, possibly in combination with OTPs) and one for receiving the SMS OTPs (authorization app),would this scenario fulfill the PSD2 requirements of sufficient separation of both factors (since both factors reside on the same smartphone, but in different apps)?\n\n### Background\n\nThere are different platforms for e-banking, such as using a PC/laptop and a mobile phone:\n\nScenario 1:\n\nUsing the PC interface to login to the bank, check one’s account balance and initiate payments.\n\nWhen one logs into the bank one enters username and password into the browser of the PC (this corresponds to the factor “knowledge” according to PSD2).\n\nSince one needs a second factor to log into the account (e.g. “possession” according to PSD2), then one could use a smartphone, where the bank sends an SMS with a “One Time Password, OTP” to one’s previously registered mobile phone.\n\nIn this scenario the factors “knowledge” and “possession” are completely separated, since knowledge (static password) is input via the PC interface and the SMS is received on my Smartphone (possession).\n\nScenario 2:\n\nSimilar to Scenario 1, but use banking app on one’s smartphone instead of the above mentioned PC interface.\n\nI.e. the same smartphone that is to be used for receiving the OTP.\n\nIn this case the separation between “knowledge” and “possession” is not as strict as for the PC based e-banking GUI\n\n(i.e. only one hardware device is used, i.e. my smartphone for both “possession” and “knowledge”).\n\nIn the context of PSD2, is the separation between “knowledge” and “possession” still to be considered satisfactory, even though both factors use the same hardware device?\n\n\\[This could be viewed as a satisfactory separation of the requirements of PSD2.\\]\n\nScenario 3:\n\nBuilding on scenario 2, one could use the same Banking app on one’s smartphone to (1) enter username, (2) enter static password and (3) receive an OTP.\n\nNow the separation of factors is even worse compared to scenario 2, since the same hardware and the same app is used for both factors.\n\nAgain: Is the separation between “knowledge” and “possession” still to be considered satisfactory?\n\n\\[This could be viewed as an unsatisfactory separation between factors\\]\n\n***\n\n### Answer\n\nIn accordance with Article 9(1) of the Delegated Regulation (EU) 2018/389, “payment service providers (PSPs) shall ensure that the use of the elements of strong customer authentication (SCA) ... is subject to measures which ensure that, in terms of technology, algorithms and parameters, the breach of one of the elements does not compromise the reliability of the others”. In addition, Article 9(2) requires PSPs to “adopt security measures, where any of the elements of SCA or the authentication code itself is used through a multi-purpose device to mitigate the risk which would result from that multi-purpose device being compromised”.\n\nArticle 9(3), in turn, provides that “...the mitigating measures shall include each of the following:\n\n(a) the use of separated secure execution environments through the software installed inside the multi-purpose device;\n\n(b) mechanisms to ensure that the software or device has not been altered by the payer or by a third party;\n\n(c) where alterations have taken place, mechanisms to mitigate the consequences thereof.“\n\nIt follows from the above that a one-time password evidencing possession used together with a knowledge element on the same multi-purpose device (e.g. a smartphone) may constitute a valid strong customer authentication and thus be compliant with the requirements of the Delegated Regulation, provided that the PSP has put in place measures to ensure that the breach of one of the elements does not compromise the reliability of the other element.\n\nParagraph 26 of the EBA Opinion on the elements of SCA under PSD2 provides further details on when a mobile app can evidence possession.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4637)\n\n## Related Level 1 articles\n\n- [Article 97 — Authentication](../../../articles/97.md)\n"}