{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-03-05","gaps":[],"covered":["EBA Q&A 2019_4671 — Q&A — Compliance of (1) card data (2) SMS OTP and (3) EMV 3DS [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4671-compliance-of-1-card-data-2-sms-otp-and-3-emv-3ds-behaviour","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4671-compliance-of-1-card-data-2-sms-otp-and-3-emv-3ds-behaviour","title":"EBA Q&A 2019_4671 — Q&A — Compliance of (1) card data (2) SMS OTP and (3) EMV 3DS [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4671-compliance-of-1-card-data-2-sms-otp-and-3-emv-3ds-behaviour","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 5 March 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4671","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"d950c4cd020caf5f","change_date":null,"nearest_versions":["2021-03-05"],"first_text_date":null,"correction_applies":false,"versions":["2021-03-05"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4671-compliance-of-1-card-data-2-sms-otp-and-3-emv-3ds-behaviour/versions/2021-03-05","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4671-compliance-of-1-card-data-2-sms-otp-and-3-emv-3ds-behaviour/versions/2021-03-05/rev/d950c4cd020caf5f","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4671-compliance-of-1-card-data-2-sms-otp-and-3-emv-3ds-behaviour/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4671-compliance-of-1-card-data-2-sms-otp-and-3-emv-3ds-behaviour/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 5 Mar 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-03-05","question_submitted_on":"2019-04-15","locators":{"published_on":"EBA Q&A register entry 2019_4671, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4671, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4671","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4671-compliance-of-1-card-data-2-sms-otp-and-3-emv-3ds-behaviour.md","body_sha256":"7e5bf735293271dc908a8737b0c5e0e014980027862d3931933cdb4a2ff65ed9"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2019_4671 — Q&A — Compliance of (1) card data (2) SMS OTP and (3) EMV 3DS [Final Q&A]\"\nshortTitle: \"EBA Q&A 2019_4671 — Q&A — Compliance of (1) card data (2) SMS OTP and (3) EMV 3DS [Final Q&A]\"\nanswer_id: EBA_QA_2019_4671\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 4(1) PSD2\"\ndate: 5 March 2021\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4671\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 5 March 2021\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4671\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2019_4671, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2021-03-05\"\n  question_submitted_on: \"2019-04-15\"\n  locators:\n    published_on: \"EBA Q&A register entry 2019_4671, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2019_4671, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 5 Mar 2021 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 5 March 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4671)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2019_4671 — Q&A — Compliance of (1) card data (2) SMS OTP and (3) EMV 3DS \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2019_4671 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 5 March 2021; question submitted 15 April 2019 |\n| **Legal basis** | Article 4(1) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Compliance of (1) card data (2) SMS OTP and (3) EMV 3DS behaviour-based inherence as an authentication information with the requirements of PSD2 and RTS on SCA**\n\n### Question\n\nCould the use of (1) card data (2) SMS One Time Password (OTP) and (3) Europay, MasterCard, Visa (EMV) 3-D secure (3DS) behaviour-based inherence information as an authentication solution be considered compliant with the PSD2 and RTS on strong customer authentication and secure communication requirements?\n\n### Background\n\nWe consider the authentication solution based on (1) card data, (2) SMS OTP and (3) EMV 3DS behaviour-based inherence information compliant with the requirements of PSD2 SCA. This method of authentication has proved to be effective, secure and considerably convenient for users worldwide. There is a significant number of banks and financial institutions who are currently considering the adoption of this solution in order to be compliant with PSD2.\n\nThe three components of the aforementioned authentication solution correspond to three different categories of authentication elements, namely: Knowledge (card data), Ownership (SMS OTP) and Inherence (EMV 3DS). They are independent from each other and, therefore, they can be used in pairs in compliance with PSD2. Card data (Knowledge) is significantly more complex and considerably longer than a common static password or a PIN-code.\n\nFurthermore, it includes different pieces of data – card number, expiry date and CVC, which makes it impossible for the card data to be simply guessed and very unlikely to be stolen by a fraudulent software. Anyone who possesses a card is required to keep it secure and private, thus shifting the liability for the protection of the data to the client, much like with a regular password, only notably more complex than that.\n\nAn additional password requirement would only cause frustration without significantly improving the security of the payments. In addition, in the recent years we have been witnessing a gradual transition to fully contactless payments, which makes it impossible to capture card data.\n\nMobile payments are also on the rise, which provides no opportunities for card data leakage. EMV 3DS (Inherence) provides behaviour-based inherence information generated on the basis of more than 130 data points that provide a significant level of uniqueness. The data points include elements which identify the cardholder’s location, spending habits and transaction history, as well as the devices they use, which is enough for issuers to authenticate cardholders correctly.\n\nThe practice in recent years has shown that each of these two types of authentication provides more security than a single piece of data, such as a PIN-code or a password (knowledge) or even an OTP generated by a physical device in the possession of the cardholder (possession). For example, an issuer can authenticate a card holder with a very high degree of certainty if recurring purchases are made from the same device and location and are shipped to the same address. This set of circumstances provide for a much more secure and reliable authentication compared to the use of a single piece of authentication information.\n\nIn Questions 28 and 32 of the European Banking Authority’s Feedback Table, EBA has recognised that the behaviour-based information may constitute a valid inherence authentication element under PSD2. Furthermore, the EBA has confirmed this view in its Opinion on the implementation of the RTS from June 2018.\n\nIssuers will remain responsible for determining if it is appropriate to select EMV 3DS behaviour-based information as a valid inherence authentication element in itself or as support for the risk analysis and monitoring associated with a transaction under the RTS.\n\nThis decision will have regard for the risk profile of the transaction, the information transmitted through EMV 3DS and the reliability of the behaviour-based information obtained (in terms of minimizing false positives and the chances of replication).\n\nPlease consider the fact that if it were not for the introduction of authentication through (1) card data (2) SMS OTP and (3) EMV 3DS behaviour-based inherence information, hundreds of millions of European consumers would still need to remember a password in addition to having to put in their card details when making a purchase. The introduction of a password requirement will lead to high abandonment rates, massive complaints by customers for not being able to shop online, and an overall frustration throughout the European online markets.\n\nAs the representative body of the FinTech sector in Member State B, we have the ability to observe the trends in the sector, as well as the user behaviour. Therefore, we are concerned that the introduction of an additional authentication method such as a PIN-code, would hinder the development of the financial services provided by the companies in the sector, since the customers who utilize them are used to the high level of comfort and accessibility of the services. It is expected that such a measure will disincentivise users to continue using the services of Fintech companies who operate with online payments.\n\n***\n\n### Answer\n\nParagraph 35 of the EBA Opinion on the Implementation of the RTS on SCA and CSC (EBA-Op-2018-04), stated that the card details and security code printed on the card would not constitute a knowledge element. In addition, while a card with a dynamic card security code may constitute a possession element, it would not constitute a knowledge element.\n\nTable 2 of the EBA Opinion on the elements of strong customer authentication (SCA) under PSD2, (EBA-Op-2019-06), notes that a Card with possession evidenced by card details (printed on the card) is not a compliant ‘possession’ element, for approaches currently observed.\n\nAccordingly, card details cannot be used as a valid factor in a two-factor SCA under Directive 2015/2366/EU (PSD2) and the Delegated Regulation (EU) 2018/389.\n\nWith regard to EMV 3DS, paragraph 21 and Table 1 of the EBA Opinion on the elements of SCA under PSD2 clarified that communication protocols, such as EMV® 3-D Secure version 2.0 and newer, did not appear to constitute inherence elements for approaches observed on the market at the time of issuance of the Opinion.\n\nWith regard to the SMS OTP, as clarified in Q&A 2018\\_4039 a one-time password sent via SMS would constitute a possession element and therefore should comply with the requirements under Article 7 of the Delegated Regulation. This was reflected also in Table 2 of the EBA Opinion on the elements of strong customer authentication under PSD2.\n\nAccordingly, authentication based on the combination of card details, SMS OTP and current EMV 3DS would not meet the SCA requirements under PSD2 and the Delegated Regulation.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4671)\n\n## Related Level 1 articles\n\n- [Article 4 — Definitions](../../../articles/4.md)\n"}