<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-09-24","gaps":[],"covered":["EBA Q&A 2020_5650 — Q&A — Requirements towards SCA if association is done based [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2020-5650-requirements-towards-sca-if-association-is-done-based-on","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5650-requirements-towards-sca-if-association-is-done-based-on","title":"EBA Q&A 2020_5650 — Q&A — Requirements towards SCA if association is done based [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2020-5650-requirements-towards-sca-if-association-is-done-based-on","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 24 September 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5650","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"a744ae71de024d5d","change_date":null,"nearest_versions":["2021-09-24"],"first_text_date":null,"correction_applies":false,"versions":["2021-09-24"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5650-requirements-towards-sca-if-association-is-done-based-on/versions/2021-09-24","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5650-requirements-towards-sca-if-association-is-done-based-on/versions/2021-09-24/rev/a744ae71de024d5d","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5650-requirements-towards-sca-if-association-is-done-based-on/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5650-requirements-towards-sca-if-association-is-done-based-on/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 24 Sep 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-09-24","question_submitted_on":"2020-12-09","locators":{"published_on":"EBA Q&A register entry 2020_5650, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2020_5650, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2020_5650 — Q&A — Requirements towards SCA if association is done based [Final Q&A]"
shortTitle: "EBA Q&A 2020_5650 — Q&A — Requirements towards SCA if association is done based [Final Q&A]"
answer_id: EBA_QA_2020_5650
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 98 PSD2"
date: 24 September 2021
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5650
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 24 September 2021"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5650"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2020_5650, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2021-09-24"
  question_submitted_on: "2020-12-09"
  locators:
    published_on: "EBA Q&A register entry 2020_5650, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2020_5650, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 24 Sep 2021 [Final Q&A]**

*Final Q&A · EBA Q&A register, 24 September 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5650)*

| | |
|---|---|
| **Full title** | EBA Q&A 2020_5650 — Q&A — Requirements towards SCA if association is done based \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2020_5650 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 24 September 2021; question submitted 9 December 2020 |
| **Legal basis** | Article 98 PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Requirements towards SCA if association is done based on phone call**

### Question

Does the requirement to apply Strong customer authentication (SCA) under Article 24 paragraph 2 b of Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication apply when customer is served using telephone call? Or is the only possibility to associate authentication credentials with the customer not having active credentials at hand, only possible having customer present?

### Background

Article 24 paragraph 2 b of the RTS on SCA "the association by means of a remote channel of the payment service user's identity with the personalised security credentials and with authentication devices or software is performed using strong customer authentication".

During the pandemics there is a high demand for the services not requiring to meet in presence.

***

### Answer

In accordance with Article 97(1)(c) of Directive 2015/2366/EU (PSD2), payment service providers (PSPs) shall apply strong customer authentication (SCA) where the payer ‘carries out any action through a remote channel which may imply a risk of payment fraud or other abuses’.

Article 4(30) of PSD2 defines strong customer authentication as ‘an authentication based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data’.

In accordance with Article 24(2) of the Commission Delegated Regulation (EU) 2018/389, in order to ensure that only the payment service user (PSU) is associated, in a secure manner, with the personalised security credentials (PSC), the authentication devices and the software, PSPs shall ensure that ‘the association by means of a remote channel of the payment service user's identity with the personalised security credentials and with authentication devices or software is performed using strong customer authentication.’

Accordingly, the association of the PSU with the PSC can be done remotely by applying SCA. A telephone call does not, for approaches currently observed in the market, ensure the application of a valid SCA in accordance with PSD2 and the Delegated Regulation.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5650)

## Related Level 1 articles

- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)