{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-12-17","gaps":[],"covered":["EBA Q&A 2020_5325 — Q&A — Alternative strong customer authentication for citizens [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2020-5325-alternative-strong-customer-authentication-for-citizens","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5325-alternative-strong-customer-authentication-for-citizens","title":"EBA Q&A 2020_5325 — Q&A — Alternative strong customer authentication for citizens [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2020-5325-alternative-strong-customer-authentication-for-citizens","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 17 December 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5325","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"947a1987989c9288","change_date":null,"nearest_versions":["2021-12-17"],"first_text_date":null,"correction_applies":false,"versions":["2021-12-17"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5325-alternative-strong-customer-authentication-for-citizens/versions/2021-12-17","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5325-alternative-strong-customer-authentication-for-citizens/versions/2021-12-17/rev/947a1987989c9288","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5325-alternative-strong-customer-authentication-for-citizens/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5325-alternative-strong-customer-authentication-for-citizens/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 17 Dec 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-12-17","question_submitted_on":"2020-06-21","locators":{"published_on":"EBA Q&A register entry 2020_5325, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2020_5325, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5325","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2020-5325-alternative-strong-customer-authentication-for-citizens.md","body_sha256":"1fd491b96444f8f6869d143440ebddcba2e6a3dbaa77a44708fe31c0536a2520"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2020_5325 — Q&A — Alternative strong customer authentication for citizens [Final Q&A]\"\nshortTitle: \"EBA Q&A 2020_5325 — Q&A — Alternative strong customer authentication for citizens [Final Q&A]\"\nanswer_id: EBA_QA_2020_5325\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"PSD2\"\ndate: 17 December 2021\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5325\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 17 December 2021\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5325\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2020_5325, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2021-12-17\"\n  question_submitted_on: \"2020-06-21\"\n  locators:\n    published_on: \"EBA Q&A register entry 2020_5325, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2020_5325, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 17 Dec 2021 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 17 December 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5325)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2020_5325 — Q&A — Alternative strong customer authentication for citizens \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2020_5325 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 17 December 2021; question submitted 21 June 2020 |\n| **Legal basis** | PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Alternative strong customer authentication for citizens without mobile**\n\n### Question\n\nWhy does the PSD2 allow banks to deny the access to the electronic financial services to customers without a mobile but with a PC?\n\n### Background\n\nIn Member State A, bank customers only can log in their accounts with username or ID number + pin code or password + SMS one time password.\n\nI do not have a mobile. However, I do have, a PC, which I have been using for electronic bank transactions for 20 years with a bank pin card. I cannot buy anything through the internet with my credit/debit cards since 2016. I cannot make any electronic bank transaction since September 2019. I cannot even log in my bank account since January 2020.\n\nI am not against the Strong customer authentication (SCA) methods and I know EBA developed those SCA methods under the principle of “technological neutrality”.\n\nHowever, since PSD2 does not force banks to apply a particular SCA method, should not the PSD2 make banks implement a range of SCA methods to ensure that all bank consumers have access to digital financial services regardless of the kind of electronic devices they own or not?\n\nI believe that I have the right to use electronic financial services and in spite of having a PC I do not have access to such services because I do not have a mobile, so all banks in Member State A are discriminating against their customers based on owning or not a mobile.\n\nThe RTS does not specifically mention anything about banks and Payment Service Providers (PSPs) guarantee that users are able to access and perform electronic transaction independently of kind of electronic device they have. This is something that it is not covered in the regulations and thus, in Member State A, the Banks and PSPs have limited such transactions only to user with a mobile, since having a mobile is compulsory.\n\nPoint (4) of the first page of Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication states “To remain technologically neutral a specific technology for the implementation of authentication codes should not be required”.\n\nIf a specific technology is not required to implement the authentication codes, why do all the Member State A’s banks require customers to have a mobile?\n\nI believe any kind of discrimination (in this case versus people not having a mobile) should be avoided, and it seems that the only way to get it is through being included in the regulations.\n\nMaybe the regulation should specify that banks and PSPs should implement different SCAs for customers with a mobile and without a mobile but with a different electronic device in order to avoid this situation.\n\nThe RTS is mainly focused in customer protection but not in assuring that all customer owning an electronic device different from mobile get access to the electronic payments.\n\nThat, at least in Member State A, has resulted in excluding users with only a PC or a tablet access to electronic transactions. In my case, I have been using only a PC for my electronic financial transactions during 20 years with two different authentication methods (one I know and one I possess).\n\nSince January 2020, I do not have access and I do not understand why because I was already using two authentication methods.\n\n***\n\n### Answer\n\nArticleA 97(1) of Directive 2015/2366/EU (PSD2) requires payment service providers (PSPs) to ‘apply strong customer authentication where the payer:\n\n(a) accesses its payment account online;\n\n(b) initiates an electronic payment transaction;\n\n(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.’\n\nArticle 4(30) of PSD2 defines strong customer authentication as ‘an authentication based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data’.\n\nPSD2 and the Commission Delegated Regulation (EU) 2018/389 do not prescribe a specific authentication approach that should be used for applying strong customer authentication. It is left for payment service providers to choose how to authenticate their customers.\n\nFinally, he EBA has provided in its Opinion on the elements of strong customer authentication (EBA-Op-2019-06) non-exhaustive lists of possible elements of strong customer authentication (knowledge, possession and inherence) that comply or may comply with the legal requirements. These lists include authentication elements that are not based on mobile phones and mobile applications.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5325)\n"}