--- title: "EBA Q&A 2020_5621 — Q&A — Use of new technology for SCA [Final Q&A]" shortTitle: "EBA Q&A 2020_5621 — Q&A — Use of new technology for SCA [Final Q&A]" answer_id: EBA_QA_2020_5621 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 97 PSD2" date: 23 April 2021 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5621 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 23 April 2021" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5621" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2020_5621, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2021-04-23" question_submitted_on: "2020-11-16" locators: published_on: "EBA Q&A register entry 2020_5621, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2020_5621, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 23 Apr 2021 [Final Q&A]** *Final Q&A · EBA Q&A register, 23 April 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5621)* | | | |---|---| | **Full title** | EBA Q&A 2020_5621 — Q&A — Use of new technology for SCA \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2020_5621 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 23 April 2021; question submitted 16 November 2020 | | **Legal basis** | Article 97 PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Use of new technology for SCA** ### Question Is a Payment Services Provider (PSP) allowed to adopt innovative technologies for verifying Payment Services Users (PSUs) where the PSP maintains fraud levels below a certain threshold? ### Background The rules for applying Strong customer authentication (SCA) are technology and business model neutral and have been designed to reduce fraud associated with electronic transactions. However, to ensure compliance, some PSPs have started adopting SCA solutions that fulfil the technical requirements for SCA but do not necessarily reduce fraud or increase the security of payments. Some of these solutions are susceptible to fraud, and while they offer a means of verifying a PSU, they do not provide increased security or fraud prevention to the PSU. There are innovative solutions that offer a different way of verifying instructions from PSUs while enhancing the security of electronic transactions. These solutions rely on innovative technologies (such as machine learning) to reduce fraudulent transactions. For instance, they can be used to identify fraudulent devices, IP addresses and locations, as well as fraudulent security credentials resulting in a robust way of mitigating and preventing potential fraud. Some of these solutions do not necessarily fit into the strict categories of possession, knowledge or inherence, because they rely on advanced machine learning and data analytics, to identify and prevent fraudulent instructions or transactions from suspicious sources. Since the rules of SCA are technology and business model neutral, new and innovative approaches (such as advanced machine learning and data analytics) which reduce fraud, should be allowed as an option for PSPs to verify instructions from PSUs. *** ### Answer In accordance with Article 97(1) Directive 2015/2366/EU (PSD2), payment service providers (PSPs) shall apply strong customer authentication (SCA) when the payer (a) accesses its payment account online, (b) initiates an electronic payment transaction, or (c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses. Article 4(30) of PSD2 defines strong customer authentication as ‘an authentication based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data’. The Commission Delegated Regulation (EU) 2018/389 provides further details on the requirements for SCA. PSD2 and the Delegated Regulation do not restrict PSPs from using additional security measures to the application of SCA, which would not constitute a valid element of SCA by themselves, such as those referred to by the submitter, namely solutions relying on innovative technologies (such as machine learning) to identify fraudulent devices, IP addresses and locations, as well as fraudulent security credentials. Article 2 of the Delegated Regulation, in particular, requires PSPs to adopt transaction monitoring mechanisms ‘that enable them to detect unauthorised or fraudulent payment transactions for the purpose of the implementation of the security measures’. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5621) ## Related Level 1 articles - [Article 97 — Authentication](../../../articles/97.md)