--- title: "EBA Q&A 2020_5516 — Q&A — Perform SCA by reusing an element used [Final Q&A]" shortTitle: "EBA Q&A 2020_5516 — Q&A — Perform SCA by reusing an element used [Final Q&A]" answer_id: EBA_QA_2020_5516 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 97 PSD2" date: 15 January 2021 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5516 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 15 January 2021" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5516" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2020_5516, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2021-01-15" question_submitted_on: "2020-09-25" locators: published_on: "EBA Q&A register entry 2020_5516, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2020_5516, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 15 Jan 2021 [Final Q&A]** *Final Q&A · EBA Q&A register, 15 January 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5516)* | | | |---|---| | **Full title** | EBA Q&A 2020_5516 — Q&A — Perform SCA by reusing an element used \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2020_5516 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 15 January 2021; question submitted 25 September 2020 | | **Legal basis** | Article 97 PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Perform SCA by reusing an element used in an authentication exempted from SCA** ### Question When an element is used to access the payment account online, in the case the Payment Service Provider (PSP) is allowed not to apply Strong Customer Authentication (SCA) (only applying a single-factor authentication : login + password), is it possible to reuse this element to perform SCA to authenticate a transaction ? ### Background Considering the following : RTS on strong customer authentication and secure communication (RTS on SCA), Article 10 : PSPs are allowed not to apply SCA under specific conditions when a PSU accesses his payment account online ; EBA Opinion on the elements of strong customer authentication under PSD2, EBA-Op-2019-06 - Paragraph 40 : the element used to access the payment account online may be reused to perform SCA under specific conditions Suppose that a Payment Service User (PSU) wants to access his payment account online. In compliance with RTS Art. 10 and supposing that less than 90 days have elapsed since the last time SCA was applied, the PSU accesses his payment account online with a single-factor authentication (login + password : knowledge). Once the PSU has accessed his payment account online and within the same session, the PSU wants to authenticate a transaction (requiring SCA). In this case, is it possible to reuse within the same session the element used to access the payment account online (knowledge) and add a second element (possession with dynamic linking) at the time the transaction is initiated to perform SCA? *** ### Answer EBA Q&A 2018\_4141 clarified that “the Commission Delegated Regulation does not prescribe a time limit for the provision of the two authentication elements necessary for SCA (Strong Customer Authentication) while within a session. When initiating a payment, SCA may therefore be performed when one of the elements used at the time the customer accessed its payment account online (including via a mobile app) is reused in compliance with Article 4, and the other element of SCA is carried out at the time the payment is initiated, provided that the dynamic linking element required under Article 97(2) PSD2 and detailed under Article 5 of the Delegated Regulation is present and linked to that latter element”. Q&A 2018\_4141 does not exclude the possibility for payment service providers to make use of the exemption from the application of SCA to payment account information under Article 10 of the Commission Delegated Regulation (EU) 2018/389. Following the above, it is possible for payment service providers to reuse an element used for accessing payment accounts online under the exemption under Article 10 of the Delegated Regulated when initiating a remote electronic payment transaction within the same session, provide that the conditions set in Q&A 2018\_4141 are met. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5516) ## Related Level 1 articles - [Article 97 — Authentication](../../../articles/97.md)