{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2020-07-24","gaps":[],"covered":["EBA Q&A 2020_5070 — Q&A — Reporting of e-commerce card-based payment transactions [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2020-5070-reporting-of-e-commerce-card-based-payment-transactions","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5070-reporting-of-e-commerce-card-based-payment-transactions","title":"EBA Q&A 2020_5070 — Q&A — Reporting of e-commerce card-based payment transactions [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2020-5070-reporting-of-e-commerce-card-based-payment-transactions","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 24 July 2020","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5070","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"c11f807a2064ebe5","change_date":null,"nearest_versions":["2020-07-24"],"first_text_date":null,"correction_applies":false,"versions":["2020-07-24"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5070-reporting-of-e-commerce-card-based-payment-transactions/versions/2020-07-24","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5070-reporting-of-e-commerce-card-based-payment-transactions/versions/2020-07-24/rev/c11f807a2064ebe5","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5070-reporting-of-e-commerce-card-based-payment-transactions/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5070-reporting-of-e-commerce-card-based-payment-transactions/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 24 Jul 2020 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2020-07-24","question_submitted_on":"2020-01-02","locators":{"published_on":"EBA Q&A register entry 2020_5070, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2020_5070, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5070","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2020-5070-reporting-of-e-commerce-card-based-payment-transactions.md","body_sha256":"2c2e4753fc02dc8d7a47bd12675dfa94cc3e4aec057a06252952e808d02ba761"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2020_5070 — Q&A — Reporting of e-commerce card-based payment transactions [Final Q&A]\"\nshortTitle: \"EBA Q&A 2020_5070 — Q&A — Reporting of e-commerce card-based payment transactions [Final Q&A]\"\nanswer_id: EBA_QA_2020_5070\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 96(6) PSD2\"\ndate: 24 July 2020\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5070\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 24 July 2020\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5070\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2020_5070, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2020-07-24\"\n  question_submitted_on: \"2020-01-02\"\n  locators:\n    published_on: \"EBA Q&A register entry 2020_5070, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2020_5070, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 24 Jul 2020 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 24 July 2020 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5070)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2020_5070 — Q&A — Reporting of e-commerce card-based payment transactions \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2020_5070 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 24 July 2020; question submitted 2 January 2020 |\n| **Legal basis** | Article 96(6) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Reporting of e-commerce card-based payment transactions falling within the scope of EBA Opinion EBA-Op-2019-06 for which no strong customer authentication was applied**\n\n### Question\n\nShould e-commerce card-based payment transactions – falling within the scope of the EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06) and for which no strong customer authentication was applied – be reported under the higher-level category “Of which authenticated via non-strong customer authentication”?\n\n### Background\n\nEBA/GL/2018/05 requires that the data relating to the exemptions to the requirement to use strong customer authentication provided for in Commission Delegated Regulation (EU) 2018/389 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication, should be reported in each of the following lines of the respective Breakdowns A (1.3.1.2.4 to 1.3.1.2.9 and 1.3.2.2.4 to 1.3.2.2.8), C (3.2.1.3.4 to 3.2.1.3.8 and 3.2.2.3.4 to 3.2.2.3.7), D (4.2.1.3.4 to 4.2.1.3.6 and 4.2.2.3.4 to 4.2.2.3.6) and F (6.1.2.4 to 6.1.2.9 and 6.2.2.4 to 6.2.2.7) as detailed in Annex 2.\n\nHowever, EBA Opinion on the elements of strong customer authentication under PSD2, EBA-Op-2019-06, acknowledges that national competent authorities (NCAs) may provide limited additional time for e-commerce card-based payment transactions to allow card-issuing Payment service providers (PSPs) to migrate to authentication approaches that are compliant with Strong Customer Authentication (SCA) and acquiring PSPs to migrate their merchants to solutions that support SCA.\n\nGiven that EBA/GL/2018 do not refer to the above-mentioned migration period, and no specific categories were included in the reporting tables for non-strong customer authentication e-commerce card-based payment transactions falling within the scope of EBA-Op-2019-06, lack of clarity exists as to where these transactions ought to be reported.\n\n***\n\n### Answer\n\nIn accordance with the EBA Guidelines on fraud reporting under PSD2 (EBA/GL/2018/05) as amended by the EBA Guidelines EBA/GL/2020/01, e-commerce card based transactions initiated and executed from 1 July 2020 onwards that are subject to the supervisory flexibility allowed under the EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06) and the EBA Opinion on the deadline for the migration to SCA for e-commerce card-based payment transactions (EBA-Op-2019-11), and for which strong customer authentication (SCA) is not applied for reasons other than an exemption in Articles 11 to 18 of the Commission Delegated Regulation (EU) 2018/389, should be reported under the category “Other”, in row 3.2.1.3.10 / 3.2.2.3.8 of Data Breakdown C, row 4.2.1.3.8 / 4.2.2.3.7 of Data Breakdown D and/or, as applicable, row 6.1.2.11/ 6.2.2.8 of Data Breakdown F.\n\nBy contrast, e-commerce card based transactions initiated and executed before 1 July 2020, that are subject to the above-mentioned supervisory flexibility and for which SCA is not applied for reasons other than an exemption in Articles 11 to 18 of the Delegated Regulation, should be reported only under the higher-level category “Of which authenticated via non-strong customer authentication”, and not under the breakdowns underneath relating to the different exemptions to the SCA. However, this will affect the validation rules under the relevant Data Breakdowns in Annex 2, as the total of the transactions reported under the higher-level category “Of which authenticated via non-strong customer authentication” could be higher than the total of the transactions reported under the breakdowns relating to the different exemptions to SCA.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5070)\n\n## Related Level 1 articles\n\n- [Article 96 — Incident reporting](../../../articles/96.md)\n"}