{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2020-06-19","gaps":[],"covered":["EBA Q&A 2019_4662 — Q&A — Define what is “given period of time” [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4662-define-what-is-given-period-of-time","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4662-define-what-is-given-period-of-time","title":"EBA Q&A 2019_4662 — Q&A — Define what is “given period of time” [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4662-define-what-is-given-period-of-time","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 19 June 2020","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4662","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"f039c8b4701c3969","change_date":null,"nearest_versions":["2020-06-19"],"first_text_date":null,"correction_applies":false,"versions":["2020-06-19"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4662-define-what-is-given-period-of-time/versions/2020-06-19","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4662-define-what-is-given-period-of-time/versions/2020-06-19/rev/f039c8b4701c3969","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4662-define-what-is-given-period-of-time/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4662-define-what-is-given-period-of-time/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 19 Jun 2020 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2020-06-19","question_submitted_on":"2019-04-09","locators":{"published_on":"EBA Q&A register entry 2019_4662, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4662, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4662","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4662-define-what-is-given-period-of-time.md","body_sha256":"08b6779c56eab5c81358e62a8136552cb16807980c580f22ea94216df1aa2a5c"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2019_4662 — Q&A — Define what is “given period of time” [Final Q&A]\"\nshortTitle: \"EBA Q&A 2019_4662 — Q&A — Define what is “given period of time” [Final Q&A]\"\nanswer_id: EBA_QA_2019_4662\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 98 PSD2\"\ndate: 19 June 2020\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4662\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 19 June 2020\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4662\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2019_4662, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2020-06-19\"\n  question_submitted_on: \"2019-04-09\"\n  locators:\n    published_on: \"EBA Q&A register entry 2019_4662, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2019_4662, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 19 Jun 2020 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 19 June 2020 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4662)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2019_4662 — Q&A — Define what is “given period of time” \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2019_4662 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 19 June 2020; question submitted 9 April 2019 |\n| **Legal basis** | Article 98 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Define what is “given period of time”**\n\n### Question\n\nWhat constitutes a “given period of time” as expressed in Article 4.3 (b) of the RTS on strong customer authentication and secure communication?\n\n### Background\n\nRTS Article 4.3 (b) states “the number of failed authentication attempts that can take place consecutively, after which the actions referred to in Article 97(1) of Directive (EU) 2015/2366 shall be temporarily or permanently blocked, shall not exceed five within a given period of time;”.\n\nIt is assumed that the goal of the requirement is to rate-limit, for example, of the brute force attacks to an acceptable level of security.\n\n***\n\n### Answer\n\nIn accordance with Article 4(3)(b) of the Delegated Regulation (EU) 2018/389, payment service providers (PSPs) shall ensure that the actions referred to in Article 97(1) of Directive 2015/2366/EU (PSD2) are temporarily or permanently blocked after a number of failed authentication attempts that does not exceed five within a given period of time.\n\nThe Delegated Regulation does not specify the time period during which the failed authentication attempts referred to in Article 4(3)(b) shall take place. Therefore, it is for each PSP to decide, based on their risk assessment, the duration of this time period. The same principle applies also to determine the duration of the temporary block of the actions, referred to in Article 97(1) of PSD2, by the PSP after the maximum number of failed authentication attempts has been exceeded, or when the PSP should block these actions permanently.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4662)\n\n## Related Level 1 articles\n\n- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)\n"}