--- title: "EBA Q&A 2019_4855 — Q&A — Application of the strong customer authentication (SCA) [Final Q&A]" shortTitle: "EBA Q&A 2019_4855 — Q&A — Application of the strong customer authentication (SCA) [Final Q&A]" answer_id: EBA_QA_2019_4855 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 97 PSD2" date: 23 April 2021 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4855 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 23 April 2021" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4855" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2019_4855, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2021-04-23" question_submitted_on: "2019-08-06" locators: published_on: "EBA Q&A register entry 2019_4855, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2019_4855, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 23 Apr 2021 [Final Q&A]** *Final Q&A · EBA Q&A register, 23 April 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4855)* | | | |---|---| | **Full title** | EBA Q&A 2019_4855 — Q&A — Application of the strong customer authentication (SCA) \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2019_4855 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 23 April 2021; question submitted 6 August 2019 | | **Legal basis** | Article 97 PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Application of the strong customer authentication (SCA) in case of refund** ### Question Does a refund, which is considered as an electronic payment transaction, be subject to strong customer authentication (SCA)? Does a merchant that initiates a refund request be considered as a payer? If so, does a Payment service provider (PSP), that holds the payment account of a Merchant, have to set up SCA each time his Merchant is doing a refund from its payment account? ### Background The PSD2 & RTS do not specify whether a PSP needs to implement the SCA to his merchant in case of refunds. It will negatively influence the merchant experience, if each time the merchant asks for a refund (whether via an Application Programming Interface (API) call or directly from the PSP's back office), the SCA has to be setup. Most of the time, the refunds are made via an API call (remote payment transaction), as a consequence, the merchant does not connect to the PSP's back office (and to his payment account) but carries it out directly from his own back office. All the process is done via API. *** ### Answer Article 97(1) of Directive 2015/2366/EU (PSD2) states that payment service providers (PSPs) “shall apply strong customer authentication (SCA) where the payer: (a) accesses its payment account online; (b) initiates an electronic payment transaction; (c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.” Article 4(5) of PSD2 defines a payment transaction as ‘an act, initiated by the payer or on his behalf or by the payee, of placing, transferring or withdrawing funds, irrespective of any underlying obligations between the payer and the payee’. Article 4(6) of PSD2, in turn, defines a remote payment transaction as ‘a payment transaction initiated via internet or through a device that can be used for distance communication’. Accordingly, the refund initiated by a merchant, which in this case acts in its capacity as a payer, is an electronic payment transaction initiated by the payer. Therefore, this would require the PSP of the merchant to apply SCA, unless an exemption from SCA under the Commission Delegated Regulation (EU) 2018/389 applies, including the exemption under Article 17 of the Delegated Regulation on secure corporate payment processes and protocols. In the specific case of a refund via a remote electronic payment transaction, in accordance with Article 97(2) of PSD2, the PSP of the merchant should apply SCA that includes elements, which dynamically link the transaction to a specific amount and a specific payee. In this case, the requirements of Article 5 of the Delegated Regulation apply also to the respective payment transaction. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4855) ## Related Level 1 articles - [Article 97 — Authentication](../../../articles/97.md)