{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-09-24","gaps":[],"covered":["EBA Q&A 2020_5643 — Q&A — Delegation of 2-Factor Authentication (2FA) to PISP, AISP [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2020-5643-delegation-of-2-factor-authentication-2fa-to-pisp-aisp-or","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5643-delegation-of-2-factor-authentication-2fa-to-pisp-aisp-or","title":"EBA Q&A 2020_5643 — Q&A — Delegation of 2-Factor Authentication (2FA) to PISP, AISP [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2020-5643-delegation-of-2-factor-authentication-2fa-to-pisp-aisp-or","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 24 September 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5643","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"b7aeb2ff91fc8073","change_date":null,"nearest_versions":["2021-09-24"],"first_text_date":null,"correction_applies":false,"versions":["2021-09-24"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5643-delegation-of-2-factor-authentication-2fa-to-pisp-aisp-or/versions/2021-09-24","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5643-delegation-of-2-factor-authentication-2fa-to-pisp-aisp-or/versions/2021-09-24/rev/b7aeb2ff91fc8073","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5643-delegation-of-2-factor-authentication-2fa-to-pisp-aisp-or/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5643-delegation-of-2-factor-authentication-2fa-to-pisp-aisp-or/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 24 Sep 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-09-24","question_submitted_on":"2020-12-03","locators":{"published_on":"EBA Q&A register entry 2020_5643, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2020_5643, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5643","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2020-5643-delegation-of-2-factor-authentication-2fa-to-pisp-aisp-or.md","body_sha256":"4598568ad47e697dc277ba1599f25c50bbe911122c5f059ac5c954887d70c230"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2020_5643 — Q&A — Delegation of 2-Factor Authentication (2FA) to PISP, AISP [Final Q&A]\"\nshortTitle: \"EBA Q&A 2020_5643 — Q&A — Delegation of 2-Factor Authentication (2FA) to PISP, AISP [Final Q&A]\"\nanswer_id: EBA_QA_2020_5643\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"PSD2\"\ndate: 24 September 2021\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5643\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 24 September 2021\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5643\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2020_5643, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2021-09-24\"\n  question_submitted_on: \"2020-12-03\"\n  locators:\n    published_on: \"EBA Q&A register entry 2020_5643, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2020_5643, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 24 Sep 2021 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 24 September 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5643)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2020_5643 — Q&A — Delegation of 2-Factor Authentication (2FA) to PISP, AISP \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2020_5643 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 24 September 2021; question submitted 3 December 2020 |\n| **Legal basis** | PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Delegation of 2-Factor Authentication (2FA) to PISP, AISP or other third party**\n\n### Question\n\nWhere a Payment Service Provider (PSP) is providing financial services via a third party application - either through a Payment Initiation Services Provider (PISP), Account Information Service Provider (AISP) or by providing embedded financial products or banking as a service solutions (i.e. financial services via an Application Programming Interface (API)) - is it permitted for the PSP to delegate the application of 2-Factor Authentication (2FA) to the third party?\n\n### Background\n\nDirective 2015/2366/EU (PSD2) Article 97, Paragraph 5 states: ‘Member States shall ensure that the account servicing payment service provider allows the payment initiation service provider and the account information service provider to rely on the authentication procedures provided by the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and, where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.’\n\nWhile the PSP may allow the PISP, AISP or other to use their authentication procedures, the PSP, AISP or other may desire to use their own procedures.\n\nThere are many third party applications that run 2FA through third parties such as Firebase (Google), for example.\n\nIs it sufficient for a PSP to be reliant on the third party application applying this outsourced 2FA in the provision of the underlying financial service?\n\n***\n\n### Answer\n\nArticle 97(5) of Directive 2015/2366/EU (PSD2) prescribes that account servicing payment service providers (ASPSPs) shall allow payment initiation service providers (PISPs) and the account information service providers (AISPs) to rely on the authentication procedures provided by the ASPSP to the payment service user (PSU).\n\nArticles 66(3) and 67(2) of PSD2 state that the personalised security credentials (PSC) are accessible to AISPs and PISPs.\n\nIn addition, Recital 30 of PSD2 states that ‘the personalised security credentials used for secure customer authentication by the payment service user or by the payment initiation service provider are usually those issued by the account servicing payment service providers’.\n\nIn relation to the above, paragraph 38 of the EBA Opinion on the implementation of the RTS on SCA&CSC (EBA-Op-2018-04) clarified that the above PSD2 requirements are to be read in conjunction with one another, which means that the payment service provider (PSP) applying strong customer authentication (SCA) is the PSP that issues the PSC. This paragraph also clarified that the ASPSP may, however, choose to contract with other providers such as wallet providers or PISPs and AISPs for them to conduct SCA on the ASPSP’s behalf and determine the liability.\n\nQ&A 2018\\_4047, Q&A 2019\\_4651 and Q&A 2019\\_4937 further clarified different aspects on delegation of SCA, including that PSPs may (i) use third party technology, such as a smartphone fingerprint reader, to support SCA and to ensure they fulfill all the security measures established in the Commission Delegated Regulation (EU) 2018/389 or (ii) outsource the execution of SCA to a third party in compliance with the general requirements on outsourcing, including the requirements in the EBA Guidelines on Outsourcing arrangements (EBA/GL/2019/02).\n\nIn relation to the above, the application of SCA can be delegated to AISPs, PISPs or other third parties, provided that the ASPSP complies with the applicable legal requirements cited above.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5643)\n"}