{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2020-09-25","gaps":[],"covered":["EBA Q&A 2019_4651 — Q&A — Relying on vendor mechanisms processing the biometric [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4651-relying-on-vendor-mechanisms-processing-the-biometric-data","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4651-relying-on-vendor-mechanisms-processing-the-biometric-data","title":"EBA Q&A 2019_4651 — Q&A — Relying on vendor mechanisms processing the biometric [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4651-relying-on-vendor-mechanisms-processing-the-biometric-data","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 25 September 2020","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4651","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"985f56c512439dd1","change_date":null,"nearest_versions":["2020-09-25"],"first_text_date":null,"correction_applies":false,"versions":["2020-09-25"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4651-relying-on-vendor-mechanisms-processing-the-biometric-data/versions/2020-09-25","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4651-relying-on-vendor-mechanisms-processing-the-biometric-data/versions/2020-09-25/rev/985f56c512439dd1","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4651-relying-on-vendor-mechanisms-processing-the-biometric-data/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4651-relying-on-vendor-mechanisms-processing-the-biometric-data/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 25 Sep 2020 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2020-09-25","question_submitted_on":"2019-04-01","locators":{"published_on":"EBA Q&A register entry 2019_4651, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4651, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4651","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4651-relying-on-vendor-mechanisms-processing-the-biometric-data.md","body_sha256":"ff2406c740f448a568a2d458b888b1e7f86103c7f2726c9c05a9a831ca23c72d"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2019_4651 — Q&A — Relying on vendor mechanisms processing the biometric [Final Q&A]\"\nshortTitle: \"EBA Q&A 2019_4651 — Q&A — Relying on vendor mechanisms processing the biometric [Final Q&A]\"\nanswer_id: EBA_QA_2019_4651\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 98(1) PSD2\"\ndate: 25 September 2020\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4651\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 25 September 2020\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4651\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2019_4651, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2020-09-25\"\n  question_submitted_on: \"2019-04-01\"\n  locators:\n    published_on: \"EBA Q&A register entry 2019_4651, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2019_4651, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 25 Sep 2020 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 25 September 2020 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4651)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2019_4651 — Q&A — Relying on vendor mechanisms processing the biometric \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2019_4651 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 25 September 2020; question submitted 1 April 2019 |\n| **Legal basis** | Article 98(1) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Relying on vendor mechanisms processing the biometric data for strong customer authentication; Multiple fingerprint samples stored on a mobile device and used for purpose of user authentication.**\n\n### Question\n\nAre the obligations of a payment service provider (PSP) laid down in the Article 8 of RTS on strong customer authentication and secure communication fulfilled in case the biometric credentials of customer are stored at the device level and the strong customer authentication itself is processed by the mobile device?\n\nIn this context, are the obligations of the PSP laid down in Article 8 and 24 of RTS on Strong Customer Authentication fulfilled in case the mobile device stores multiple fingerprint samples for user authentication?\n\n### Background\n\nArticle 8 paragraph 1 of the EU Commission Delegated Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication provides that the PSP shall adopt measures to mitigate the risk that the authentication elements categorised as inherence and read by access devices and software provided to the payer are uncovered by unauthorised parties. At a minimum, the PSP shall ensure that those access devices and software have a very low probability of an unauthorised party being authenticated as the payer.\n\nIn case customers intend to use fingerprint or facial recognition as inherence element to access their payment account online through mobile banking application on a mobile device which runs on iOS or Android operating system, the mobile banking application uses the fingerprint or facial recognition system implemented on the Android or iOS operating system. In such case, the biometric data of the respective customer are stored on the secure enclave of a mobile device and the biometric authentication itself is processed by the operating system of the respective mobile device. PSP itself does not have access to biometric data of the customer, but only obtains positive or negative result of the user verification (i.e. whether the verification was successful or not). No application has access to the secure enclave where the biometric data are stored.\n\nAs a result, the PSP has to rely on the vendor mechanisms (e.g. in case of iOS Apple touch ID) for customer identity verification including the implemented security measures.\n\nPursuant to Article 24 of RTS on Strong Customer Authentication, the PSP should ensure that only the payment service user is associated, in a secure manner, with the personalized security credentials, the authentication devices and the software. However, some fingerprint recognition software implemented on a mobile device demand multiple fingerprint samples for user verification and therefore, there is a risk that fingerprint samples of multiple persons could be stored on the mobile device even before installation and registration of a mobile banking application. Under such conditions, the PSP cannot ensure with certainty that another person will register and use the mobile banking application on behalf of the actual payment services user.\n\n***\n\n### Answer\n\nQ&A 2018\\_4047 clarified that issuing payment service providers (PSPs) may (i) use third party technology, such as a smartphone fingerprint reader, to support strong customer authentication (SCA) and to ensure they fulfill all the security measures established in the Commission Delegated Regulation (EU) 2018/389 or (ii) outsource the execution of SCA to a third party in compliance with the general requirements on outsourcing, including the requirements in the EBA Guidelines on Outsourcing arrangements (EBA/GL/2019/02). This Q&A further clarified that PSPs remain fully responsible for the compliance with the requirements in the Delegated Regulation and that PSPs should make sure that the technical service provider has a satisfactory level of security and that it applies the mitigating measures in accordance with Article 9 of the Delegated Regulation.\n\nThe security measures referred to in the answer to Q&A 2018\\_4047 include the requirements of Article 8 of the Delegated Regulation. This means that PSPs may, in line with the requirements of Article 8 of the Delegated Regulation, use biometric credentials that are stored at the device level for the application of the strong customer authentication, provided that the PSPs has ensured that technology used has a satisfactory level of security.\n\nQ&A 2019\\_4560 provides further clarity on the use of an authentication device by multiple users, including on the association of the personalised security credentials, such as a fingerprint. In line with Article 24 of the Delegated Regulation and the answer to Q&A 2019\\_4560, in case the authentication device can store multiple fingerprint samples that are used as personalised security credentials, the PSP should ensure that only a single payment service user (and their SCA profile) is associated with their respective fingerprint samples.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4651)\n\n## Related Level 1 articles\n\n- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)\n"}