<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2020-09-25","gaps":[],"covered":["EBA Q&A 2019_4910 — Q&A — Authentication code [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4910-authentication-code","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4910-authentication-code","title":"EBA Q&A 2019_4910 — Q&A — Authentication code [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4910-authentication-code","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 25 September 2020","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4910","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"9d29dbbe437d3d9f","change_date":null,"nearest_versions":["2020-09-25"],"first_text_date":null,"correction_applies":false,"versions":["2020-09-25"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4910-authentication-code/versions/2020-09-25","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4910-authentication-code/versions/2020-09-25/rev/9d29dbbe437d3d9f","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4910-authentication-code/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4910-authentication-code/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 25 Sep 2020 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2020-09-25","question_submitted_on":"2019-09-12","locators":{"published_on":"EBA Q&A register entry 2019_4910, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4910, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2019_4910 — Q&A — Authentication code [Final Q&A]"
shortTitle: "EBA Q&A 2019_4910 — Q&A — Authentication code [Final Q&A]"
answer_id: EBA_QA_2019_4910
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 97(1) PSD2"
date: 25 September 2020
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4910
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 25 September 2020"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4910"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2019_4910, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2020-09-25"
  question_submitted_on: "2019-09-12"
  locators:
    published_on: "EBA Q&A register entry 2019_4910, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2019_4910, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 25 Sep 2020 [Final Q&A]**

*Final Q&A · EBA Q&A register, 25 September 2020 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4910)*

| | |
|---|---|
| **Full title** | EBA Q&A 2019_4910 — Q&A — Authentication code \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2019_4910 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 25 September 2020; question submitted 12 September 2019 |
| **Legal basis** | Article 97(1) PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Authentication code**

### Question

Is an extra strong customer authentication (SCA) required, after logging in (with or without SCA) in the mobile application, to initiate the provisioning step to add the customers card to a third party wallet (e.g. Apple or Google pay)?

### Background

For example: A customer logs in to the mobile application with username & password (knowledge) + SMS One Time Password (possession). Once in his mobile banking environment he looks at his statements. Within that same session (that ends after 5 minutes inactivity) the customer selects the option to add the card to a third party wallet (in app provisioning). At this step is an extra SCA required?

***

### Answer

Article 97(1) of Directive 2015/2366/EU (PSD2) states that payment service providers (PSPs) “shall apply strong customer authentication (SCA) where the payer:

(a) accesses its payment account online;

(b) initiates an electronic payment transaction;

(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.”

Adding a payment card to a digital wallet is an action which may imply a risk of payment fraud or other abuses and thus would require the application of SCA. This means that, in the case described by the submitter, the payer would need to apply SCA for accessing its payment account via its mobile application, and apply a second SCA when adding the payment card to a digital wallet.

Q&A 2018\_4141 clarified that, when initiating a payment while within the same session in which SCA was performed to access account data, one of the elements used at the time the customer accessed its payment account online (including via a mobile app) may be reused in compliance with Article 4 of the Commission Delegated Regulation (EU) 2018/389, provided that the other element of SCA is carried out at the time the payment is initiated and the dynamic linking element required under Article 97(2) PSD2 (for remote payment transactions) is present and linked to that latter element.

Further, the principle set out in Q&A 2018\_4141 may be applied in the specific case described by the submitter. This means that one of the authentication elements used for accessing the payment account (via the mobile app) may be reused when adding the payment card to a digital wallet within the same session and within the same app, provided that the requirements of Articles 4, 6, 7, 8 and 9 of the Delegated Regulation are met.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4910)

## Related Level 1 articles

- [Article 97 — Authentication](../../../articles/97.md)