{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-01-15","gaps":[],"covered":["EBA Q&A 2020_5516 — Q&A — Perform SCA by reusing an element used [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2020-5516-perform-sca-by-reusing-an-element-used-in-an-authentication","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5516-perform-sca-by-reusing-an-element-used-in-an-authentication","title":"EBA Q&A 2020_5516 — Q&A — Perform SCA by reusing an element used [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2020-5516-perform-sca-by-reusing-an-element-used-in-an-authentication","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 15 January 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5516","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"57fdfaa6d755a045","change_date":null,"nearest_versions":["2021-01-15"],"first_text_date":null,"correction_applies":false,"versions":["2021-01-15"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5516-perform-sca-by-reusing-an-element-used-in-an-authentication/versions/2021-01-15","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5516-perform-sca-by-reusing-an-element-used-in-an-authentication/versions/2021-01-15/rev/57fdfaa6d755a045","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5516-perform-sca-by-reusing-an-element-used-in-an-authentication/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5516-perform-sca-by-reusing-an-element-used-in-an-authentication/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 15 Jan 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-01-15","question_submitted_on":"2020-09-25","locators":{"published_on":"EBA Q&A register entry 2020_5516, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2020_5516, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5516","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2020-5516-perform-sca-by-reusing-an-element-used-in-an-authentication.md","body_sha256":"91f5174ca7adf5d9f9a9741145ba23d2d7761c6890d95c44ed4bcd59929eac45"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2020_5516 — Q&A — Perform SCA by reusing an element used [Final Q&A]\"\nshortTitle: \"EBA Q&A 2020_5516 — Q&A — Perform SCA by reusing an element used [Final Q&A]\"\nanswer_id: EBA_QA_2020_5516\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 97 PSD2\"\ndate: 15 January 2021\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5516\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 15 January 2021\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5516\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2020_5516, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2021-01-15\"\n  question_submitted_on: \"2020-09-25\"\n  locators:\n    published_on: \"EBA Q&A register entry 2020_5516, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2020_5516, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 15 Jan 2021 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 15 January 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5516)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2020_5516 — Q&A — Perform SCA by reusing an element used \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2020_5516 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 15 January 2021; question submitted 25 September 2020 |\n| **Legal basis** | Article 97 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Perform SCA by reusing an element used in an authentication exempted from SCA**\n\n### Question\n\nWhen an element is used to access the payment account online, in the case the Payment Service Provider (PSP) is allowed not to apply Strong Customer Authentication (SCA) (only applying a single-factor authentication : login + password), is it possible to reuse this element to perform SCA to authenticate a transaction ?\n\n### Background\n\nConsidering the following :\n\nRTS on strong customer authentication and secure communication (RTS on SCA), Article 10 : PSPs are allowed not to apply SCA under specific conditions when a PSU accesses his payment account online ;\n\nEBA Opinion on the elements of strong customer authentication under PSD2, EBA-Op-2019-06 - Paragraph 40 : the element used to access the payment account online may be reused to perform SCA under specific conditions\n\nSuppose that a Payment Service User (PSU) wants to access his payment account online. In compliance with RTS Art. 10 and supposing that less than 90 days have elapsed since the last time SCA was applied, the PSU accesses his payment account online with a single-factor authentication (login + password : knowledge). Once the PSU has accessed his payment account online and within the same session, the PSU wants to authenticate a transaction (requiring SCA). In this case, is it possible to reuse within the same session the element used to access the payment account online (knowledge) and add a second element (possession with dynamic linking) at the time the transaction is initiated to perform SCA?\n\n***\n\n### Answer\n\nEBA Q&A 2018\\_4141 clarified that “the Commission Delegated Regulation does not prescribe a time limit for the provision of the two authentication elements necessary for SCA (Strong Customer Authentication) while within a session. When initiating a payment, SCA may therefore be performed when one of the elements used at the time the customer accessed its payment account online (including via a mobile app) is reused in compliance with Article 4, and the other element of SCA is carried out at the time the payment is initiated, provided that the dynamic linking element required under Article 97(2) PSD2 and detailed under Article 5 of the Delegated Regulation is present and linked to that latter element”.\n\nQ&A 2018\\_4141 does not exclude the possibility for payment service providers to make use of the exemption from the application of SCA to payment account information under Article 10 of the Commission Delegated Regulation (EU) 2018/389.\n\nFollowing the above, it is possible for payment service providers to reuse an element used for accessing payment accounts online under the exemption under Article 10 of the Delegated Regulated when initiating a remote electronic payment transaction within the same session, provide that the conditions set in Q&A 2018\\_4141 are met.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5516)\n\n## Related Level 1 articles\n\n- [Article 97 — Authentication](../../../articles/97.md)\n"}