--- title: "EBA Q&A 2020_5626 — Q&A — Association with the payment service user by means [Final Q&A]" shortTitle: "EBA Q&A 2020_5626 — Q&A — Association with the payment service user by means [Final Q&A]" answer_id: EBA_QA_2020_5626 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 24(2) PSD2" date: 24 September 2021 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5626 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 24 September 2021" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5626" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2020_5626, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2021-09-24" question_submitted_on: "2020-11-18" locators: published_on: "EBA Q&A register entry 2020_5626, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2020_5626, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 24 Sep 2021 [Final Q&A]** *Final Q&A · EBA Q&A register, 24 September 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5626)* | | | |---|---| | **Full title** | EBA Q&A 2020_5626 — Q&A — Association with the payment service user by means \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2020_5626 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 24 September 2021; question submitted 18 November 2020 | | **Legal basis** | Article 24(2) PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Association with the payment service user by means of a remote channel** ### Question Is it sufficient to use a company level knowledge element, in combination with a peronal posession element to associate a user of a business application with personalised security credentials such as authentication software or a knowledge element? ### Background When associating a user with personalised security credentials through a remote channel, it is required by the RTS on strong customer authentication and secure communication, Article 24.2.b, that strong customer authentication (SCA) is performed. In a business application, the association of the identity of the user is performed in 2 steps. 1) A possession element is associated with the user in a secure environments under the payment service provider's responsibility and than securely delivered to the customer. 2) After delivery the possession element the possession element is used in combination with a company level secret to activate the possession element and create a new personalized knowledge element. After this association and activation process the user can access the business application on behalf of the company using the possession element and the personalized knowledge element. *** ### Answer Article 4(29) of Directive 2015/2366/EU (PSD2) defines authentication as ‘a procedure which allows the payment service provider to verify the identity of a payment service user or the validity of the use of a specific payment instrument, including the use of the user’s personalised security credentials’. Article 4(30) of PSD2, in turn, defines the authentication element knowledge as ‘something only the user knows’. Article 4(31) of PSD2 defines personalised security credentials (PSC) as ‘personalised features provided by the payment service provider to a payment service user for the purposes of authentication’. Article 6(1) of the Commission Delegated Regulation (EU) 2018/389, in turn, requires payment service providers (PSPs) to ‘adopt measures to mitigate the risk that the elements of strong customer authentication categorised as knowledge are uncovered by, or disclosed to, unauthorised parties’. Article 24(2)(b) of the Delegated Regulation prescribes that ‘the association by means of a remote channel of the payment service user's identity with the personalised security credentials and with authentication devices or software is performed using strong customer authentication’. Accordingly, PSPs cannot use company level knowledge as a valid SCA element to associate the payment service user (PSU) with the PSC since it will not allow the PSP to verify unequivocally the identity of the PSU and to mitigate the risk that the knowledge element is disclosed to unauthorised parties. The provision of the knowledge element should be carried out based on procedures set out by the PSP. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5626) ## Related Level 1 articles - [Article 24 — Professional secrecy](../../../articles/24.md)