--- title: "EBA Q&A 2020_5620 — Q&A — Use of behavioural data for SCA [Final Q&A]" shortTitle: "EBA Q&A 2020_5620 — Q&A — Use of behavioural data for SCA [Final Q&A]" answer_id: EBA_QA_2020_5620 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 97(1) PSD2" date: 23 April 2021 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5620 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 23 April 2021" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5620" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2020_5620, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2021-04-23" question_submitted_on: "2020-11-16" locators: published_on: "EBA Q&A register entry 2020_5620, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2020_5620, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 23 Apr 2021 [Final Q&A]** *Final Q&A · EBA Q&A register, 23 April 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5620)* | | | |---|---| | **Full title** | EBA Q&A 2020_5620 — Q&A — Use of behavioural data for SCA \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2020_5620 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 23 April 2021; question submitted 16 November 2020 | | **Legal basis** | Article 97(1) PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Use of behavioural data for SCA** ### Question Can a Payment Service Provider (PSP) use behavioural data and auditable scores to apply Strong customer authentication (SCA) in a way that protects consumer privacy? ### Background The EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06), June 2019, clarified that inherence may include behavioural biometrics identifying the specific authorised user and that inherence relates to physical properties of body parts, physiological characteristics and behavioural processes created by the body, and any combination of these. The EBA gave examples of factors which constitute inherence, including fingerprint and face scanning, keystroke dynamics and the angle at which a user holds the device, adding that these could be used to authenticate PSUs provided the implemented approaches have a ‘very low probability of an unauthorised party being authenticated as the payer’. In order to meet the criteria of behavioural biometrics under the EBA Opinion of June 2019, PSPs may have to obtain sensitive data about a Payment Service User (PSU) to create a behavioural biometric that can be used to identify the PSU. This may include information such as how a consumer navigates on a computer or webpage, capturing keystrokes, typing style and speed and how the consumer interacts with their device. This would allow a PSP (or its provider) to create a fingerprint of an online session and compare with a historical baseline to verify a consumer. Such solutions could require PSPs and third parties to obtain information from a user’s personal device (such as a computer or mobile phone) by scraping the information or installing technologies that monitor a consumer’s use of a personal device. There are additional concerns over the scope and definition of behavioural biometrics in the EBA Opinion of June 2019 in that: 1) some devices used for payments have been designed to protect consumer privacy by preventing third parties from capturing or accessing sensitive information such as keystroke dynamics or fingerprints; 2) some of the browser based solutions are not compatible with purchases within apps; and 3) allowing or encouraging third parties to capture information relating to "physical properties of body parts, physiological characteristics and behavioural processes” as contemplated in the Opinion could lead to solutions that profile individuals using sensitive information in conflict with the General Data Protection Regulation (GDPR), lending this to abuse or risk of compromise by malicious actors. It is possible for PSPs to obtain behavioural data and auditable behavioural scores about a PSU’s device, mobile number and account activity in a way that protects consumers’ privacy while preventing / reducing fraud. This can be done without accessing or capturing sensitive information relating to an individual’s physical or body parts. We welcome clarification that PSPs can use behavioural data and auditable behavioural scores about a PSUs’ device, mobile number and account activity to verify a user and meet SCA requirements. *** ### Answer Article 8(1) of the Commission Delegated Regulation (EU) 2018/389 specifies that payment service providers (PSPs) ‘shall adopt measures to mitigate the risk that the authentication elements categorised as inherence and read by access devices and software provided to the payer are uncovered by unauthorised parties. At a minimum, the payment service providers shall ensure that those access devices and software have a very low probability of an unauthorised party being authenticated as the payer.’ Paragraph 34 of the EBA Opinion on the implementation of the RTS on SCA and CSC (EBA-Op-2018-04) clarified that an authentication based on inherence ‘is typically based on biometrics (including behavioural biometrics), provided they comply with the requirements under Article 8 of the RTS’. Paragraph 18 of the EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06) further clarified that ‘inherence, which includes biological and behavioural biometrics, relates to physical properties of body parts, physiological characteristics and behavioural processes created by the body, and any combination of these. In addition, it is (the quality of) the implementation of any inherence-based approach that will determine whether or not it constitutes a compliant inherence element’. Paragraph 19 and Table 1 of the ‘EBA Opinion on the elements of strong customer authentication under PSD2’ provide a non-exhaustive list of possible inherence elements, which include keystroke dynamics and body movement patterns. In relation to the above, behavioural data related to the physiological characteristics and behavioural processes created by the body and auditable scores based on them, may be used as an inherence element in a strong customer authentication, provided that their implementation meets the requirements of Article 8 of the Delegated Regulation. This is without prejudice to the requirements of the General Data Protection Regulation (EU) 2016/679 (GDPR). The examples of behavioural biometrics provided in the ‘EBA Opinion on the elements of strong customer authentication under PSD2’ may not be compatible with some devices and browser-based solutions. However, it is for the payment service provider to choose the authentication approaches they would apply for carrying out strong customer authentication. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5620) ## Related Level 1 articles - [Article 97 — Authentication](../../../articles/97.md)