{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-04-23","gaps":[],"covered":["EBA Q&A 2020_5619 — Q&A — Independence of the elements for SCA [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2020-5619-independence-of-the-elements-for-sca","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5619-independence-of-the-elements-for-sca","title":"EBA Q&A 2020_5619 — Q&A — Independence of the elements for SCA [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2020-5619-independence-of-the-elements-for-sca","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 23 April 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5619","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"54c16aea0dbae1a4","change_date":null,"nearest_versions":["2021-04-23"],"first_text_date":null,"correction_applies":false,"versions":["2021-04-23"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5619-independence-of-the-elements-for-sca/versions/2021-04-23","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5619-independence-of-the-elements-for-sca/versions/2021-04-23/rev/54c16aea0dbae1a4","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5619-independence-of-the-elements-for-sca/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5619-independence-of-the-elements-for-sca/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 23 Apr 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-04-23","question_submitted_on":"2020-11-16","locators":{"published_on":"EBA Q&A register entry 2020_5619, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2020_5619, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5619","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2020-5619-independence-of-the-elements-for-sca.md","body_sha256":"59d2678caca0142515ea61e101292826870b1e88158c765a7589354f445ad769"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2020_5619 — Q&A — Independence of the elements for SCA [Final Q&A]\"\nshortTitle: \"EBA Q&A 2020_5619 — Q&A — Independence of the elements for SCA [Final Q&A]\"\nanswer_id: EBA_QA_2020_5619\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"PSD2\"\ndate: 23 April 2021\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5619\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 23 April 2021\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5619\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2020_5619, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2021-04-23\"\n  question_submitted_on: \"2020-11-16\"\n  locators:\n    published_on: \"EBA Q&A register entry 2020_5619, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2020_5619, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 23 Apr 2021 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 23 April 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5619)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2020_5619 — Q&A — Independence of the elements for SCA \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2020_5619 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 23 April 2021; question submitted 16 November 2020 |\n| **Legal basis** | PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Independence of the elements for SCA**\n\n### Question\n\nCan a Payment Service Provider (PSP) apply Strong customer authentication (SCA) using elements from the same category provided that the elements are independent (i.e. breach of one does not compromise reliability of the other elements)?\n\n### Background\n\nThe EBA stated in its Opinion on the implementation of the RTS on strong customer authentication (SCA) and secure communication (EBA-Op-2018-04), June 2018, that the two authentication elements (for SCA) need to belong to two different categories (i.e., knowledge, possession or inherence). The EBA RTS does not require authentication elements to belong to separate categories but impose a requirement on PSPs to adopt measures to ensure that the elements are independent. The view that authentication elements should come from separate categories can restrict innovation, development, and adoption of new elements which, although they fall into the same category, meet all the security and independence requirements under the EBA RTS.\n\nThe rationale for using authentication elements from separate categories is that adopting elements from different categories reduces the risk if one of the channels used by the Payment Service User (PSU) is compromised, enabling the PSP to fulfil the requirements of Article 9 of the RTS. However, using elements from separate categories is not the only way of ensuring that the elements are independent. In fact, there are elements that although they may belong to the same category, are independent. Additionally, PSPs can implement security measures to ensure that breach of one element does not comprise reliability of the other element.\n\nAs an example, technology on a mobile device can be used to securely read information on a card, passport or driver’s license enabling a PSP to verify possession of the identity document or physical card. The combination of these elements (which are independent) can be used to provide a more secure way to verify consumers compared to other combinations of elements. Arguably, confirming physical possession of a bank card and a passport by reading the data contained in their chips is more secure than verification based on a password and SMS One Time Password (OTP).\n\nHowever, based on the EBA Opinion of June 2018, a verification based on a combination of an identity document and a physical card would not meet SCA as both elements are categorised as “possession”.\n\nThe EBA RTS requires that the use of the elements “is subject to measures which ensure that, in terms of technology, algorithms and parameters, the breach of one of the elements does not compromise the reliability of the other elements”. It is possible to develop two authentication elements from the same category that are independent (i.e. breach of one does not compromise reliability of the other elements) and are more secure than other solutions that have been confirmed as meeting SCA requirements.\n\nWe welcome clarification that SCA elements can be from the same category provided they are independent (breach of one does not compromise reliability of the other factor) as required under Article 9 of the RTS and use of the factors meets the requirements under Articles 6 - 9 of the RTS.\n\n***\n\n### Answer\n\nArticle 4(30) of Directive 2015/2366/EU (PSD2) defines strong customer authentication as ‘an authentication based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data’.\n\nIn relation to this, Paragraph 33 of the EBA Opinion on the implementation of the RTS on SCA and CSC (EBA-Op-2018-04) clarified that the two authentication elements ‘need to belong to two different categories’.\n\nArticle 9 of the Commission Delegated Regulation (EU) 2018/389 further specifies requirements on how to ensure independence of the authentication elements, including the adoption of security measures in the case where the authentication elements are used through a multi-purpose device.\n\nTherefore, payment service providers (PSPs) should apply strong customer authentication (SCA) by using at least two independent elements from different categories. However, PSD2 and the Delegated Regulation do not restrict PSPs from applying an additional element from the same categories to one of the elements already applied as an additional security measure.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5619)\n"}