{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-07-30","gaps":[],"covered":["EBA Q&A 2021_5821 — Q&A — Strong customer authentication (SCA) Knowledge element [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2021-5821-strong-customer-authentication-sca-knowledge-element-place","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2021-5821-strong-customer-authentication-sca-knowledge-element-place","title":"EBA Q&A 2021_5821 — Q&A — Strong customer authentication (SCA) Knowledge element [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2021-5821-strong-customer-authentication-sca-knowledge-element-place","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 30 July 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_5821","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"9f0579d5b669636c","change_date":null,"nearest_versions":["2021-07-30"],"first_text_date":null,"correction_applies":false,"versions":["2021-07-30"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2021-5821-strong-customer-authentication-sca-knowledge-element-place/versions/2021-07-30","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2021-5821-strong-customer-authentication-sca-knowledge-element-place/versions/2021-07-30/rev/9f0579d5b669636c","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2021-5821-strong-customer-authentication-sca-knowledge-element-place/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2021-5821-strong-customer-authentication-sca-knowledge-element-place/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 30 Jul 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-07-30","question_submitted_on":"2021-04-21","locators":{"published_on":"EBA Q&A register entry 2021_5821, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2021_5821, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_5821","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2021-5821-strong-customer-authentication-sca-knowledge-element-place.md","body_sha256":"101fe12cead3637f723d08b70873630034fab3c36469adeb3d60ba188003a234"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2021_5821 — Q&A — Strong customer authentication (SCA) Knowledge element [Final Q&A]\"\nshortTitle: \"EBA Q&A 2021_5821 — Q&A — Strong customer authentication (SCA) Knowledge element [Final Q&A]\"\nanswer_id: EBA_QA_2021_5821\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 4(30) PSD2\"\ndate: 30 July 2021\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_5821\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 30 July 2021\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_5821\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2021_5821, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2021-07-30\"\n  question_submitted_on: \"2021-04-21\"\n  locators:\n    published_on: \"EBA Q&A register entry 2021_5821, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2021_5821, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 30 Jul 2021 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 30 July 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_5821)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2021_5821 — Q&A — Strong customer authentication (SCA) Knowledge element \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2021_5821 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 30 July 2021; question submitted 21 April 2021 |\n| **Legal basis** | Article 4(30) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Strong customer authentication (SCA) Knowledge element: Place of Birth and Date of Birth**\n\n### Question\n\nDoes a payer’s date of birth and place of birth constitute a valid Knowledge Element for strong customer authentication.\n\n### Background\n\nAfter reading many different articles, Knowledge should be something in the customers head. So if a date of birth can be viewed across many different forms of personal information (even through the window of some letters in your letterbox or my facebook page) and my Place of birth can be found on my passport.,\n\nShould my bank be using this to validate Knowledge for making data changes?\n\n***\n\n### Answer\n\nArticle 4(30) of Directive 2015/2366/EU (PSD2) defines knowledge as something only the user knows.\n\nArticle 6 of Regulation (EU) 2018/389 specifies the requirement for payment service providers (PSPs) to mitigate the risk that the element is ‘uncovered by, or disclosed to, unauthorised parties’ and to have mitigation measures in place ‘in order to prevent their disclosure to unauthorised parties’.\n\nAccordingly, date and/or place of birth cannot constitute a knowledge element under PSD2 and the Delegated Regulation since these may be accessible by third parties other than the payment service user or the PSP.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_5821)\n\n## Related Level 1 articles\n\n- [Article 4 — Definitions](../../../articles/4.md)\n"}