{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2020-07-24","gaps":[],"covered":["EBA Q&A 2019_4866 — Q&A — Reporting of card transactions that are out-of-scope [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4866-reporting-of-card-transactions-that-are-out-of-scope-from","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4866-reporting-of-card-transactions-that-are-out-of-scope-from","title":"EBA Q&A 2019_4866 — Q&A — Reporting of card transactions that are out-of-scope [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4866-reporting-of-card-transactions-that-are-out-of-scope-from","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 24 July 2020","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4866","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"9c96f308a5242c0f","change_date":null,"nearest_versions":["2020-07-24"],"first_text_date":null,"correction_applies":false,"versions":["2020-07-24"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4866-reporting-of-card-transactions-that-are-out-of-scope-from/versions/2020-07-24","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4866-reporting-of-card-transactions-that-are-out-of-scope-from/versions/2020-07-24/rev/9c96f308a5242c0f","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4866-reporting-of-card-transactions-that-are-out-of-scope-from/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4866-reporting-of-card-transactions-that-are-out-of-scope-from/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 24 Jul 2020 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2020-07-24","question_submitted_on":"2019-08-12","locators":{"published_on":"EBA Q&A register entry 2019_4866, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4866, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4866","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4866-reporting-of-card-transactions-that-are-out-of-scope-from.md","body_sha256":"7059073a7b1c0a1da94008852f3d5caf3ae00c188725741cb211da9fa400cf6a"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2019_4866 — Q&A — Reporting of card transactions that are out-of-scope [Final Q&A]\"\nshortTitle: \"EBA Q&A 2019_4866 — Q&A — Reporting of card transactions that are out-of-scope [Final Q&A]\"\nanswer_id: EBA_QA_2019_4866\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 96(6) PSD2\"\ndate: 24 July 2020\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4866\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 24 July 2020\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4866\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2019_4866, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2020-07-24\"\n  question_submitted_on: \"2019-08-12\"\n  locators:\n    published_on: \"EBA Q&A register entry 2019_4866, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2019_4866, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 24 Jul 2020 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 24 July 2020 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4866)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2019_4866 — Q&A — Reporting of card transactions that are out-of-scope \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2019_4866 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 24 July 2020; question submitted 12 August 2019 |\n| **Legal basis** | Article 96(6) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Reporting of card transactions that are out-of-scope from the requirement for SCA**\n\n### Question\n\nIn the Fraud Reporting, how should payment service providers (PSPs) report card transactions without Strong Customer Authentication (SCA) that are out of scope of the requirement for SCA, i.e. one-leg transactions and merchant-initiated transaction?\n\n### Background\n\nThere are three levels of card transactions that will not require strong customer authen-tication (SCA):\n\n1. Transactions outside the scope of PSD2 (and already PSD1):\n\na. Non-electronic card transactions:\n\ni. Pure mail and telephone order transactions\n\nii. Transactions generated through a deduction on paper of imprinted card information\n\nb. Transactions on card products that are exempted under Article 3 (k) for limited networks, e.g. merchant chain-specific cards.\n\n2. Transactions within the scope of PSD2 but outside the scope of the SCA re-quirement:\n\na. One-leg transactions, where the second payment service provider is outside the EEA\n\nb. Merchant-initiated transactions (MIT) that are initiated by the payee and thus, like the direct debit / direct debit, are not met by the require-ment for SCA.\n\n3. Transactions (which are within the scope of both PSD2 and RTS on SCA, where the card issuer or card acquirer chooses to apply one of the exemptions specified in the RTS.\n\nWith regard to fraud reporting, we perceive that the EBA Guidelines stipulate that transactions of type 1b, i.e. transactions with payment instruments exempted from PSD2 under Article 3 (k), shall not be reported.\n\nAll other categories of transactions above must be reported according to the Guidelines, including transactions of type 1a, even though this category is actually outside the scope of the directive and it therefore seem to be no legal support from the PSD2 to mandate reporting on these transactions. Reporting of transactions of category 1a, however, does not pose a problem since they have got their own rows in the templates (3.1 in the C template and 4.1 in the D template), and we support the basic idea that all transactions with general payment instruments should be reported to give fair statistics.\n\nHowever, a problem arises as to how transactions of category 2 should be reported. These transactions must be included in the totals for all transactions without SCA – “Of which authenticated via non-strong customer authentication”:\n\n• 3.2.1.3 (remote, issuer),\n\n• 3.2.2.3 (non-remote, issuer),\n\n• 4.2.1.3 (remote, acquirer) and\n\n• 4.2.2.3 (non-remote, acquirer).\n\nBut these totals will then be further broken down under the heading \"of which broken down by reason for non-strong customer authentication\" under which the exemptions allowed by the RTS are listed. However, for the transactions in category 2, none of these exemptions under the RTS applies, as these transactions are completely outside the scope of the RTS. Thus, they cannot be reported in any of these rows. Thus, the sum of the rows under the heading \"of which broken down by reason for non-strong customer authentication\" will not equal the total of “Of which authenticated via non-strong customer authentication”, which it is mandated under Validation that it should. If there is an automated control in the reporting facilities in the form that makes it impossible to submit the report when the lower level rows do not equal the higher-level total, then the reporting PSP will not be able to carry the reporting through at all. If there are no such If there are no such automated controls, the Payment Service Provider will be able to submit a report with higher-level totals that do not equal the sum of the lower-level rows, but the receiving supervisory authority will not be able to validate the data. In addition, for transactions outside the EEA, one cannot deduce the reason behind the gap between the totals and the reported exemptions, as this gap will consist of both one-leg transactions and (two-leg) merchant-initiated transactions.\n\n***\n\n### Answer\n\nIn accordance with the EBA Guidelines on fraud reporting under PSD2 (EBA/GL/2018/05) as amended by the EBA Guidelines EBA/GL/2020/01, “Merchant initiated transactions”, as defined in the EBA/GL/2020/01, that are initiated and executed from 1 July 2020 onwards, without the application of strong customer authentication (SCA), should be reported under the category “Merchant initiated transactions”, introduced through the EBA/GL/2020/01, in row 3.2.1.3.9 of Data Breakdown C, row 4.2.1.3.7 of Data Breakdown D or, as applicable, row 6.1.2.10 of Data Breakdown F.\n\nSimilarly, card-based payments initiated and executed from 1 July 2020 onwards where either the payer’s payment service provider (PSP) (the issuer) or the payee’s PSP (the acquirer) is located outside the Union (the so-called ‘one-leg’ transactions), to which SCA is not applied for reasons other than an exemption to SCA in Articles 11 to 18 of the Commission Delegated Regulation (EU) 2018/389, should be reported under the category “Other” in rows 3.2.1.3.10 and 3.2.2.3.8 of Data Breakdown C, rows 4.2.1.3.8 and 4.2.2.3.7 of Data Breakdown D and rows 6.1.2.11 and 6.2.2.8 of Data Breakdown F.\n\nGiven that the amendments introduced through the EBA/GL/2020/01 apply only to payment transactions initiated and executed from 1 July 2020 onwards, merchant initiated transactions and one-leg payment transactions that are initiated and executed before 1 July 2020, for which SCA is not applied for reasons other than an exemption in Articles 11 to 18 of the Commission Delegated Regulation, should be reported only under the higher-level category “Of which authenticated via non-strong customer authentication” in the relevant Data Breakdowns in Annex 2, and not in the breakdowns relating to the different exemptions to the SCA. This will affect the validation rules under the relevant Data Breakdowns in Annex 2 of the Guidelines, as the total of the transactions reported under the higher-level category “Of which authenticated via non-strong customer authentication” could be higher than the total of the transactions reported under the breakdowns relating to the different exemptions to SCA.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4866)\n\n## Related Level 1 articles\n\n- [Article 96 — Incident reporting](../../../articles/96.md)\n"}