{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-09-24","gaps":[],"covered":["EBA Q&A 2020_5476 — Q&A — Clarification on the qualification and protection [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2020-5476-clarification-on-the-qualification-and-protection","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5476-clarification-on-the-qualification-and-protection","title":"EBA Q&A 2020_5476 — Q&A — Clarification on the qualification and protection [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2020-5476-clarification-on-the-qualification-and-protection","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 24 September 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5476","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"353caaf622f3ea9e","change_date":null,"nearest_versions":["2021-09-24"],"first_text_date":null,"correction_applies":false,"versions":["2021-09-24"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5476-clarification-on-the-qualification-and-protection/versions/2021-09-24","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5476-clarification-on-the-qualification-and-protection/versions/2021-09-24/rev/353caaf622f3ea9e","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5476-clarification-on-the-qualification-and-protection/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5476-clarification-on-the-qualification-and-protection/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 24 Sep 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-09-24","question_submitted_on":"2020-09-04","locators":{"published_on":"EBA Q&A register entry 2020_5476, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2020_5476, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5476","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2020-5476-clarification-on-the-qualification-and-protection.md","body_sha256":"c6a23d1d636cf919ff027414d3bd0305ca075cd9891a2f9a9839cb8f2f63f243"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2020_5476 — Q&A — Clarification on the qualification and protection [Final Q&A]\"\nshortTitle: \"EBA Q&A 2020_5476 — Q&A — Clarification on the qualification and protection [Final Q&A]\"\nanswer_id: EBA_QA_2020_5476\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"PSD2\"\ndate: 24 September 2021\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5476\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 24 September 2021\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5476\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2020_5476, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2021-09-24\"\n  question_submitted_on: \"2020-09-04\"\n  locators:\n    published_on: \"EBA Q&A register entry 2020_5476, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2020_5476, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 24 Sep 2021 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 24 September 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5476)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2020_5476 — Q&A — Clarification on the qualification and protection \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2020_5476 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 24 September 2021; question submitted 4 September 2020 |\n| **Legal basis** | PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Clarification on the qualification and protection requirements of a CustomerID when included in a payer-presented QR-code for the initiation of (instant) credit transfers at the point of interaction (POI)**\n\n### Question\n\nIs the CustomerID (i.e. ID issued by an Account Servicing Payment Service Providers (ASPSP) to its Payment Services User (PSU) for accessing the on-line banking system and usually required by PSD2 Application Programming Interfaces (APIs) to identify the PSU) to be qualified as “personalised security credentials of the PSU” within the meaning and for the purposes of Article 66 (3) b), PSD2, and Article 35 (5), RTS, and therefore be treated as “sensitive payment data” within the definition of Article 4 (32), PSD2? Accordingly, can said CustomerID be included in cleartext in the payer-presented QR-code for the initiation of (instant) credit transfers at the point of interaction (e.g. POS, vending machine) without any protection during the QR-code life-cycle, including the generation of the QR-code, storage of the QR-code on the payer’s device, transmission from the payer device to the payee’s point of interaction and in the payee’s (e.g. merchant) point of interaction?\n\n### Background\n\nPayer-presented QR-codes could be used to initiate (instant) credit transfers at the point of interaction. To enable the involvement of a PISP and their usage of a PSD2 API to initiate the (instant) credit transfer, the QR-code should contain the CustomerID in cleartext (i.e. ID issued by an ASPSP to its PSU payer for accessing the on-line banking system). It is however not clear whether said CustomerID is to be qualified as “personalised security credentials” within the meaning and for the purposes of Article 66 (3) b), PSD2 and Article 35 (5), RTS, and should therefore be treated as “sensitive payment data” as defined by Article 4 (32), PSD2. If so, would the inclusion of the CustomerID in cleartext as part of the payer-presented-QR at POI conflict with: - the provisions of Article 66 (3) b), providing that a PISP “shall ensure that the personalised security credentials of the PSU are not, with the exception of the user and the issuer of the personalised security credentials, accessible to other parties and that they are transmitted by the PISP through safe and efficient channels.” - the provisions of Article 35 (5), RTS, which mandates that ASPSPs and PISPs shall ensure that where they communicate personalised security credentials and authentication codes, “these are not readable, directly or indirectly, by any staff at any time”?\n\n***\n\n### Answer\n\nArticle 4(31) of Directive 2015/2366/EU (PSD2) defines personalised security credentials (PSC) as ‘personalised features provided by the payment service provider to a payment service user for the purposes of authentication’.\n\nGuideline 3.4.1 of the EBA Guidelines on ICT and security risk management (EBA/GL/2019/04) (which repealed the Guidelines on security measures for operational and security risks (EBA/GL/2017/17) as of 30 June 2020) specifies that the information security policy ‘should ensure the confidentiality, integrity and availability of ... sensitive data whether at rest, in transit or in use’. Guideline 3.4.4 further specifies that financial institutions, including payment service providers, should implement procedures to ‘prevent the occurrence of security issues in ICT systems and ICT services and should minimise their impact on ICT service delivery’ and that the procedures should include inter alia measures ensuring encryption of data at rest and in transit.\n\nAccordingly, the Customer ID facilitates the identification of the Payment Services User (PSU) for the purpose of authentication but is not in itself a valid Strong Customer Authentication (SCA) element . Therefore, it cannot be considered as a PSC.\n\nHowever, Customer ID is not available to third parties other than the payment service user and the payment service provider, and its disclosure can be used to carry out fraud. Therefore, taking also into account the above provisions of the GL on ICT and security risk management, the Customer ID cannot be included in a cleartext in a payer-presented QR-code for the initiation of credit transfers at the point of interaction without any security measures (e.g. encryption, tokenisation, transport layer security) ensuring its confidentiality during the QR-code life-cycle.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5476)\n"}