{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2020-09-25","gaps":[],"covered":["EBA Q&A 2019_4937 — Q&A — SCA for contactless payments at a POS executed [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2019-4937-sca-for-contactless-payments-at-a-pos-executed-via-a-mobile","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4937-sca-for-contactless-payments-at-a-pos-executed-via-a-mobile","title":"EBA Q&A 2019_4937 — Q&A — SCA for contactless payments at a POS executed [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4937-sca-for-contactless-payments-at-a-pos-executed-via-a-mobile","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 25 September 2020","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4937","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"ebc4d87d7e88b5a8","change_date":null,"nearest_versions":["2020-09-25"],"first_text_date":null,"correction_applies":false,"versions":["2020-09-25"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4937-sca-for-contactless-payments-at-a-pos-executed-via-a-mobile/versions/2020-09-25","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4937-sca-for-contactless-payments-at-a-pos-executed-via-a-mobile/versions/2020-09-25/rev/ebc4d87d7e88b5a8","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4937-sca-for-contactless-payments-at-a-pos-executed-via-a-mobile/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2019-4937-sca-for-contactless-payments-at-a-pos-executed-via-a-mobile/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 25 Sep 2020 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2020-09-25","question_submitted_on":"2019-10-07","locators":{"published_on":"EBA Q&A register entry 2019_4937, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2019_4937, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4937","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2019-4937-sca-for-contactless-payments-at-a-pos-executed-via-a-mobile.md","body_sha256":"8b45c8053b85d9463d067df6c14c18a1622304415c0881367e90e34b4f557cd8"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2019_4937 — Q&A — SCA for contactless payments at a POS executed [Final Q&A]\"\nshortTitle: \"EBA Q&A 2019_4937 — Q&A — SCA for contactless payments at a POS executed [Final Q&A]\"\nanswer_id: EBA_QA_2019_4937\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 97 PSD2\"\ndate: 25 September 2020\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4937\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 25 September 2020\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4937\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2019_4937, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2020-09-25\"\n  question_submitted_on: \"2019-10-07\"\n  locators:\n    published_on: \"EBA Q&A register entry 2019_4937, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2019_4937, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 25 Sep 2020 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 25 September 2020 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4937)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2019_4937 — Q&A — SCA for contactless payments at a POS executed \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2019_4937 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 25 September 2020; question submitted 7 October 2019 |\n| **Legal basis** | Article 97 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**SCA for contactless payments at a POS executed via a mobile device**\n\n### Question\n\n1) Can we consider the strong customer authentication (SCA) outsourced from the issuer of cards to the payer?\n\n2) Is it necessary for the issuer of the cards to perform SCA based on the elements of identification that are beyond its control?\n\n### Background\n\nWhereas the following transactions having the cumulative characteristics:\n\n- In case of contactless payment (irrespective of the value) executed at a POS (point of sale);\n\n- Payments executed through a mobile device (phone, watch etc.)\n\n- The mobile device is owned by the payer;\n\n- The payer enrolls its cards in an electronic wallet downloaded on the device (e.g. an application) which is provided by a supplier of such software;\n\n- After the enrolment of cards within the wallet performed by the payer, the issuer of cards will verify the identity of the cardholder and the link between the cardholder and the enrolled cards and furthermore authorizes the enrolment of cards chosen by the payer;\n\n- The payer shall establish at the enrolment moment the security elements needed for the payments (e.g. device lock screens, fingerprint, face ID, passcode of the phone/application etc.), hereinafter referred as ‘’elements of identifications’’;\n\n- The payer is the only one able to set up its own method of identification and verification for authorization of payments with one of the elements of identifications mentioned above;\n\n- The payer is the only one able to change the settings of the above mentioned elements of identifications due to the fact that has the control of his own device;\n\n- The elements of identifications are hosted in the mobile device’ memory and are beyond the control of the issuer of cards.\n\n***\n\n### Answer\n\nArticle 97(1) of Directive 2015/2366/EU (PSD2) requires payment service providers (PSPs) to ‘apply strong customer authentication where the payer:\n\n(a) accesses its payment account online;\n\n(b) initiates an electronic payment transaction;\n\n(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.’\n\nArticle 4(29) of PSD2 defines authentication as ‘a procedure which allows the payment service provider to verify the identity of a payment service user or the validity of the use of a specific payment instrument, including the use of the user’s personalised security credentials’.\n\nThe Commission Delegated Regulation (EU) 2018/389 introduces several exemptions from the application of strong customer authentication (SCA) under Articles 11 – 18 of the Delegated Regulation, such as Article 11 exemption on the contactless payments at point of sale.\n\nIn relation to the above, unless the exemption under Article 11 of the Delegated Regulation or another exemption from the application of SCA applies, payment service providers (PSPs) should apply SCA to contactless payments at a point of sale terminal executed via a mobile device.\n\nQ&A 2018\\_4047 clarified that issuing PSPs may (i) use third party technology, such as a smartphone fingerprint reader, to support SCA and to ensure they fulfill all the security measures established in the Delegated Regulation (EU) 2018/389 or (ii) outsource the execution of SCA to a third party in compliance with the general requirements on outsourcing, including the requirements in the EBA Guidelines on Outsourcing arrangements (EBA/GL/2019/02). This Q&A further clarified ‘the responsibility for compliance with SCA cannot be outsourced from PSPs to third parties and that PSPs remain fully responsible for the compliance with the requirements in the Delegated Regulation.’\n\nWith regard to the above, while the PSP may outsource the execution of SCA to a third party, this does not include the payer of the payment transaction, since, in accordance with Article 4(29) of PSD2, authentication is a procedure verifying the identity of the payment service user and consequently cannot be managed by the payment service users themselves, including because this would give rise to security risks, such as identity theft and fraud.\n\nQ&A 2018\\_4047, Q&A 2019\\_4560 and Q&A 2019\\_4651 provide further details on the use of SCA elements stored on authentication devices.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2019_4937)\n\n## Related Level 1 articles\n\n- [Article 97 — Authentication](../../../articles/97.md)\n"}