{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2020-09-25","gaps":[],"covered":["EBA Q&A 2019_4783 — Q&A — Delayed or deferred PIN for wearable devices [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4783-delayed-or-deferred-pin-for-wearable-devices","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4783-delayed-or-deferred-pin-for-wearable-devices","title":"EBA Q&A 2019_4783 — Q&A — Delayed or deferred PIN for wearable devices [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4783-delayed-or-deferred-pin-for-wearable-devices","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 25 September 2020","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4783","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"beae48a50d627e34","change_date":null,"nearest_versions":["2020-09-25"],"first_text_date":null,"correction_applies":false,"versions":["2020-09-25"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4783-delayed-or-deferred-pin-for-wearable-devices/versions/2020-09-25","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4783-delayed-or-deferred-pin-for-wearable-devices/versions/2020-09-25/rev/beae48a50d627e34","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4783-delayed-or-deferred-pin-for-wearable-devices/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4783-delayed-or-deferred-pin-for-wearable-devices/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 25 Sep 2020 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2020-09-25","question_submitted_on":"2019-06-17","locators":{"published_on":"EBA Q&A register entry 2019_4783, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4783, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4783","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4783-delayed-or-deferred-pin-for-wearable-devices.md","body_sha256":"6d7f4b4d2c39b425571d6a1744cb116e71c383a851bb61ae0331b8ea0f96837b"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2019_4783 — Q&A — Delayed or deferred PIN for wearable devices [Final Q&A]\"\nshortTitle: \"EBA Q&A 2019_4783 — Q&A — Delayed or deferred PIN for wearable devices [Final Q&A]\"\nanswer_id: EBA_QA_2019_4783\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 98(1) PSD2\"\ndate: 25 September 2020\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4783\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 25 September 2020\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4783\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2019_4783, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2020-09-25\"\n  question_submitted_on: \"2019-06-17\"\n  locators:\n    published_on: \"EBA Q&A register entry 2019_4783, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2019_4783, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 25 Sep 2020 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 25 September 2020 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4783)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2019_4783 — Q&A — Delayed or deferred PIN for wearable devices \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2019_4783 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 25 September 2020; question submitted 17 June 2019 |\n| **Legal basis** | Article 98(1) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Delayed or deferred PIN for wearable devices**\n\n### Question\n\nIs the PIN entered when the cardholder takes on wearable device on, still valid as a knowledge element for one or several transactions later the same day, if it can be ensured that the device has not been taken off?\n\n### Background\n\nOn 26 October 2018, the EBA answered question Q&A 2018\\_4049 “Is persistent authentication for wearable devices compliant with the RTS?”.\n\nWe seek further clarification on this issue. One reason for the ambiguity of the answer is the ambiguity of the question. In the question the submitter refers to “persistent authentication” and the way that the background is formulated, the reader can be made to belief that wearable devices today have a biometric way of uniquely identifying the individual wearing the device through heartbeat or pulse. Although such biometrics are technically possible, there is presently no commercial implementation of such a wearable device – it would simply be too expensive.\n\nWhat the wearable devices that are on the market today do, is that they request the cardholder to enter his/her PIN when cardholder takes on the device. Then there is a locking mechanism that continuously measures that there is a pulse – i.e. to ensure that the device is not taken off. However, the device does not identify the individual’s pulse, there is no biometrics involved.\n\nThe elements used in these devices to authenticate the customer are therefore:\n\n1. the tokenised card in the wearable (possession);\n\n2. PIN (knowledge), not entered at the time of payment initiation but at an earlier point in time – we therefore refer to this as “delayed” or “deferred” PIN.\n\nThe relevant question is therefore, if the PIN entered when the cardholder took the device on, is still valid as a knowledge element for one or several transactions later the same day, if it can be ensured that the device has not been taken off?\n\nIf the answer is “Yes”, it means that the wearable device can be used to initiate several transactions without any other action from the cardholder than the tap on the terminal with the device, and this would constitute an strong customer authentication (SCA) transaction.\n\nIf the answer is “No”, it means that the mere tap the terminal with the device would not constitute SCA, and could therefore only be used to initiate low-value transactions which qualifies for the contactless exemption (Article 11). For transactions that require SCA a separate PIN entry, either on the wearable device or on the terminal, in direct connection with initiating the individual transaction, would be required.\n\n***\n\n### Answer\n\nArticle 97(1) of Directive 2015/2366/EU (PSD2) requires payment service providers (PSPs) to “apply strong customer authentication where the payer:\n\n(a) accesses its payment account online;\n\n(b) initiates an electronic payment transaction;\n\n(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.”\n\nArticle 4(30) of PSD2 defines strong customer authentication (SCA) as “an authentication based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data”.\n\nQ&A 2018\\_4141 clarified that when initiating a payment, within the same session in which SCA was performed to access account data, one of the authentication elements used at the time the customer accessed its payment account online (including via a mobile app) can be reused in compliance with Article 4 of the Commission Delegated Regulation (EU) 2018/389, provided that the other element of SCA is carried out at the time the payment is initiated and the dynamic linking element required under Article 97(2) PSD2 (in the case of remote payment transaction) is present and linked to that latter element.\n\nIn line with the principle set out in Q&A 2018\\_4141, one of the authentication elements, in the case described by the submitter, the ‘knowledge’ element, can be reused within the same session, provided that a unique authentication code is generated for each transaction and the other requirements of Articles 4-7 and 9 of the Delegated Regulation are met. However, in the example provided by the submitter, the locking mechanism described does not ensure that the payment service user remains in the same session, which would require a communication to be established between the payment service user and the payment service provider and for the payment service user to maintain that session open by actively using the device for initiating payment transactions and/or accessing their payment account. This means that the payment service user will need to reinsert the PIN for each payment transaction carried out after the initial session has expired.\n\nThe above is without prejudice to the possibility for the PSP to decide to make use of an exemption from the application of SCA under Articles 11 – 18 of the Delegated Regulation, such as the contactless payments at point of sale exemption.\n\nQ&A 2019\\_4827 provides further details on the use of tokenised version of the card details as a possession element.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4783)\n\n## Related Level 1 articles\n\n- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)\n"}