{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-04-09","gaps":[],"covered":["EBA Q&A 2020_5673 — Q&A — Legal requirements for the authentication procedure [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2020-5673-legal-requirements-for-the-authentication-procedure-when","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5673-legal-requirements-for-the-authentication-procedure-when","title":"EBA Q&A 2020_5673 — Q&A — Legal requirements for the authentication procedure [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2020-5673-legal-requirements-for-the-authentication-procedure-when","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 9 April 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5673","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"e5eaa720ff598b66","change_date":null,"nearest_versions":["2021-04-09"],"first_text_date":null,"correction_applies":false,"versions":["2021-04-09"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5673-legal-requirements-for-the-authentication-procedure-when/versions/2021-04-09","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5673-legal-requirements-for-the-authentication-procedure-when/versions/2021-04-09/rev/e5eaa720ff598b66","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5673-legal-requirements-for-the-authentication-procedure-when/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2020-5673-legal-requirements-for-the-authentication-procedure-when/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 9 Apr 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-04-09","question_submitted_on":"2020-12-28","locators":{"published_on":"EBA Q&A register entry 2020_5673, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2020_5673, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5673","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2020-5673-legal-requirements-for-the-authentication-procedure-when.md","body_sha256":"e73cfed543ee55c97309ad005fcbda1ec678b8372a59d64fefcbf297337a1f64"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2020_5673 — Q&A — Legal requirements for the authentication procedure [Final Q&A]\"\nshortTitle: \"EBA Q&A 2020_5673 — Q&A — Legal requirements for the authentication procedure [Final Q&A]\"\nanswer_id: EBA_QA_2020_5673\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 97 PSD2\"\ndate: 9 April 2021\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5673\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 9 April 2021\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5673\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2020_5673, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2021-04-09\"\n  question_submitted_on: \"2020-12-28\"\n  locators:\n    published_on: \"EBA Q&A register entry 2020_5673, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2020_5673, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 9 Apr 2021 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 9 April 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5673)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2020_5673 — Q&A — Legal requirements for the authentication procedure \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2020_5673 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 9 April 2021; question submitted 28 December 2020 |\n| **Legal basis** | Article 97 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Legal requirements for the authentication procedure when SCA exemptions are applied for remote payment transactions**\n\n### Question\n\nWhat are the legal requirements for the type of authentication procedure used when conditions for the application of of Strong customer authentication (SCA) exemption for remote payment transactions are fulfilled?\n\n### Background\n\nThere are different ways how a Payment Services Provider (PSP) can apply an authentication procedure when conditions for SCA exemption are fulfilled in the case of remote payment transactions (Articles 13-18 of RTS on SCA&CSC).\n\nThere is a possibility to initiate a transaction with the application of a single authentication element. Another possibility is to not require authentication at all (or maybe only require the customer to select Yes/No for initiation of transaction) if it can be justified by risk assessment.\n\nOur understanding is that, according to its risk assessment, a PSP can choose the appropriate authentication procedure. Furthermore, we think that a PSP has the right to implement a partial solution and apply the SCA exemption only on dynamic linking requirement. In that case, a PSP would require SCA authentication, but without dynamic linking. It is up to the PSP to define the level of risk it wants to accept and one possible solution is to use the SCA authentication all the time even when PSP could apply the SCA exemption.\n\n***\n\n### Answer\n\nArticle 97(1) of Directive 2015/2366/EU (PSD2) requires payment service providers (PSPs) to ‘apply strong customer authentication where the payer:\n\n(a) accesses its payment account online;\n\n(b) initiates an electronic payment transaction;\n\n(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.’\n\nChapter III of the Commission Delegated Regulation (EU) 2018/389 sets out the exemptions from the application of strong customer authentication (SCA).\n\nRecital 17 of the Delegated Regulation further clarifies that PSPs that make use of any of the exemptions from SCA ‘should be allowed at any time to choose to apply strong customer authentication...’.\n\nPSD2 and the Delegated Regulation do not specify how the authentication as defined in Article 4(29) of PSD2 should take place when an exemption from SCA is used. Therefore, if a PSP decides to make use of an exemption from SCA, it is up to the PSP to decide how to perform authentication, i.e. how to verify the identity of a payment service user or the validity of the use of the payment instrument.\n\nFinally, it should be noted that the security measures for dynamic linking under Article 97(2) of PSD2 and Article 5 of the Delegated Regulation are required for the initiation of remote electronic payment transactions where SCA is required under Article 97(1)(b) of PSD2. PSD2 and the Delegated Regulation do not require the application of these security measures to remote electronic payment transactions exempted from SCA.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5673)\n\n## Related Level 1 articles\n\n- [Article 97 — Authentication](../../../articles/97.md)\n"}