<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2019-12-06","gaps":[],"covered":["EBA Q&A 2019_4785 — Q&A — Unsuccessful authentications and declined transactions [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4785-unsuccessful-authentications-and-declined-transactions","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4785-unsuccessful-authentications-and-declined-transactions","title":"EBA Q&A 2019_4785 — Q&A — Unsuccessful authentications and declined transactions [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4785-unsuccessful-authentications-and-declined-transactions","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 6 December 2019","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4785","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"971f5d5efa87b95e","change_date":null,"nearest_versions":["2019-12-06"],"first_text_date":null,"correction_applies":false,"versions":["2019-12-06"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4785-unsuccessful-authentications-and-declined-transactions/versions/2019-12-06","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4785-unsuccessful-authentications-and-declined-transactions/versions/2019-12-06/rev/971f5d5efa87b95e","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4785-unsuccessful-authentications-and-declined-transactions/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4785-unsuccessful-authentications-and-declined-transactions/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 6 Dec 2019 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2019-12-06","question_submitted_on":"2019-06-18","locators":{"published_on":"EBA Q&A register entry 2019_4785, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4785, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2019_4785 — Q&A — Unsuccessful authentications and declined transactions [Final Q&A]"
shortTitle: "EBA Q&A 2019_4785 — Q&A — Unsuccessful authentications and declined transactions [Final Q&A]"
answer_id: EBA_QA_2019_4785
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 98(4) PSD2"
date: 6 December 2019
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4785
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 6 December 2019"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4785"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2019_4785, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2019-12-06"
  question_submitted_on: "2019-06-18"
  locators:
    published_on: "EBA Q&A register entry 2019_4785, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2019_4785, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 6 Dec 2019 [Final Q&A]**

*Final Q&A · EBA Q&A register, 6 December 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4785)*

| | |
|---|---|
| **Full title** | EBA Q&A 2019_4785 — Q&A — Unsuccessful authentications and declined transactions \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2019_4785 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 6 December 2019; question submitted 18 June 2019 |
| **Legal basis** | Article 98(4) PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Unsuccessful authentications and declined transactions effect on the counters of cumulative amount and number of consecutive transactions**

### Question

Do failed authentications or declined transactions increase the counters of cumulative amount or number of hits?

### Background

Article 16 states that Payment service providers shall be allowed not to apply strong customer authentication, where the payer initiates a remote electronic payment transaction provided that the following conditions are met:

(a) the amount of the remote electronic payment transaction does not exceed EUR 30; and

(b) the cumulative amount of previous remote electronic payment transactions initiated by the payer since the last application of strong customer authentication does not exceed EUR 100; or

(c) the number of previous remote electronic payment transactions initiated by the payer since the last application of strong customer authentication does not exceed 5 consecutive individual remote electronic payment transactions.

The question is if for example a specific Payment Services User (PSU) keeps getting declined, assuming it’s a fraudster, does it effect the sensors mentioned above? This will have impact on genuine user due to exceeding the thresholds defined by this article. We would like to know if only successfully completed transactions effects these counters.

***

### Answer

Article 16 of the Delegated Regulation (EU) 2018/389 refers to the counting of low-value remote electronic payment transactions that have been successfully initiated. Accordingly, Article 16(a) specifies an individual transaction limit of €30 and Article 16(b) refers to the cumulative amount of the low-value remote electronic payment transaction that have been successfully initiated. In addition, when counting the number of consecutive individual remote electronic payment transactions for the purpose of Article 16(c), only those transactions that have been successfully initiated, need to be included.

However, if a payment service provider (PSP) wishes to include all authorised transactions, regardless of whether they have been successfully initiated or not, it is not prevented from so doing.

Q&A 2018\_4230 addressed this question from the perspective of the exemption from strong customer authentication (SCA) under Article 11 of the Delegated Regulation.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4785)

## Related Level 1 articles

- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)