--- title: "EBA Q&A 2020_5477 — Q&A — Clarification on level of protection required [Final Q&A]" shortTitle: "EBA Q&A 2020_5477 — Q&A — Clarification on level of protection required [Final Q&A]" answer_id: EBA_QA_2020_5477 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "PSD2" date: 24 September 2021 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5477 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 24 September 2021" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5477" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2020_5477, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2021-09-24" question_submitted_on: "2020-09-04" locators: published_on: "EBA Q&A register entry 2020_5477, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2020_5477, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 24 Sep 2021 [Final Q&A]** *Final Q&A · EBA Q&A register, 24 September 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5477)* | | | |---|---| | **Full title** | EBA Q&A 2020_5477 — Q&A — Clarification on level of protection required \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2020_5477 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 24 September 2021; question submitted 4 September 2020 | | **Legal basis** | PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Clarification on level of protection required for the processing of the IBAN outside the inter-PSP environment** ### Question Can the IBAN of the payer or payee be handled in cleartext outside the inter Payment Service Provider (PSP) environment? For instance could a payer’s IBAN be contained in cleartext in a payer-presented QR-code provided by the payer’s device to the merchant’s point of interaction for the initiation of an (instant) credit transfer? Or could a merchant’s IBAN be contained in cleartext in a merchant-presented QR-code at the merchant’s point of interaction to be read by the payer’s device for the initiation of an (instant) credit transfer? ### Background Article 4 (32), PSD2, provides that for the activities of Payment Initiation Service Providers (PISPs), i) the name of the account owner and ii) the account number (the IBAN) do not constitute sensitive payment data. In line with the clarifications given under the EBA Q&A 2018\_4081, if the transaction is initiated in accordance with the rules of Article 36 (1), RTS and provided that the PISP complies with Article 66 (3), PSD2, it seems possible that the IBAN could be used/displayed in cleartext in an Application Programming Interface (API) environment. It is however unclear whether the same would apply in case of presentation of the IBAN in cleartext as part of the payer-presented-QR provided by the payer’s device to the merchant at point of interaction (POI) (or vice-versa) for the initiation of an (instant). In particular, from a security perspective, it is unclear whether in a POI context the IBAN could be shown to all parties without tokenisation and still comply with Article 35 (1), RTS on security of communication. *** ### Answer Article 4(31) of Directive 2015/2366/EU (PSD2) defines personalised security credentials (PSC) as ‘personalised features provided by the payment service provider to a payment service user for the purposes of authentication’. Accordingly, since the IBAN is not an element used for the purpose of authentication, it cannot be considered as a PSC. Article 4(32) of PSD2 defines sensitive payment data as ‘data, including personalised security credentials which can be used to carry out fraud. The article further clarifies that ‘for the activities of payment initiation service providers and account information service providers, the name of the account owner and the account number do not constitute sensitive payment data’. Accordingly, the IBAN of the payer does not constitute sensitive payment data for the activities of payment initiation service providers. In relation to the above, in a transaction initiated at the point-of-interaction (POI) by using a QR code presented by either the payer or the payee (merchant), the IBAN can be included in free text. However, since its disclosure may be used to carry out fraud, it will be for payment service providers to assess the risks arising from transmitting the IBAN in free text between the device of the payer and the POI and from storing it, if applicable. Subsequently, PSPs should decide whether it is necessary to implement corresponding security measures to mitigate these risks. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5477)