--- title: "EBA Q&A 2020_5115 — Q&A — Using Trusted Beneficiary Lists to Auto Reject PISP [Final Q&A]" shortTitle: "EBA Q&A 2020_5115 — Q&A — Using Trusted Beneficiary Lists to Auto Reject PISP [Final Q&A]" answer_id: EBA_QA_2020_5115 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 97 PSD2" date: 15 January 2021 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5115 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 15 January 2021" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5115" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2020_5115, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2021-01-15" question_submitted_on: "2020-02-10" locators: published_on: "EBA Q&A register entry 2020_5115, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2020_5115, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 15 Jan 2021 [Final Q&A]** *Final Q&A · EBA Q&A register, 15 January 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5115)* | | | |---|---| | **Full title** | EBA Q&A 2020_5115 — Q&A — Using Trusted Beneficiary Lists to Auto Reject PISP \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2020_5115 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 15 January 2021; question submitted 10 February 2020 | | **Legal basis** | Article 97 PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Using Trusted Beneficiary Lists to Auto Reject PISP Transactions** ### Question Is an Account Servicing Payment Service Provider (ASPSP) able to block a Payment Initiation Services Provider (PISP) transaction before attempting Strong Customer Authentication (SCA) if the beneficiary account does not appear in the Payment Services User (PSU)'s regular payee list/trusted beneficiary list? ### Background Article 13 of the RTS introduced "Trusted beneficiaries" where an ASPSP could optionally choose to provide an exemption from the application of SCA where the PSU had securely added the beneficiary account to a trusted beneficiary list. This could potentially provide an improved user experience on what would be a lower risk transaction. The response to EBA Q&A 2018\_4076 "Strong customer authentication and secure communication (incl. access) clarified that, "creation or amendment of such a list through the services of a PISP or an Account Information Service Provider (AISP) is not possible". Unfortunately some ASPSPs have interpreted the guidance to mean that they have the legal right to block access to any PISP transaction where the beneficiary account does not appear in the trusted beneficiary list without applying SCA. This is done on the basis that through the ASPSP in question's online interface a PSU must add all beneficiary accounts to their trusted beneficiary account as part of the payment process. As a PISP (or AISP) does not have write access to the trusted beneficiary list, Third Party Providers (TPPs) are not able to create an equivalent level of payment service as offered through the banks own interface, severely limiting innovation which would appear to be against the spirit of the PSD2 legislation. *** ### Answer Article 68(5) of Directive 2015/2366/EU (PSD2) prescribes that “an account servicing payment service provider may deny an account information service provider or a payment initiation service provider access to a payment account for objectively justified and duly evidenced reasons relating to unauthorised or fraudulent access to the payment account by that account information service provider or that payment initiation service provider, including the unauthorised or fraudulent initiation of a payment transaction.” The fact that the payee is not included in a list of trusted beneficiaries under Article 13 of the Commission Delegated Regulation (EU) 2018/389 does not constitute such a reason and therefore account servicing payment service providers should not deny access to payment accounts to payment initiation service providers on that basis. Article 13 of the Delegated Regulation specifies the requirements for the creation and amendment of lists of trusted beneficiaries and introduces an optional exemption from the application of strong customer authentication for payment transactions where the payee is included in a list of trusted beneficiaries. Article 13 does not introduce requirements related to the access to payment accounts data. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5115) ## Related Level 1 articles - [Article 97 — Authentication](../../../articles/97.md)