--- title: "EBA Q&A 2021_6141 — Q&A — Association of personalised security credentials [Final Q&A]" shortTitle: "EBA Q&A 2021_6141 — Q&A — Association of personalised security credentials [Final Q&A]" answer_id: EBA_QA_2021_6141 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 97(1) PSD2" date: 17 December 2021 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6141 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 17 December 2021" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6141" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "not stated in the document" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Final answer" locator: "EBA Q&A register entry 2021_6141: a 'Final answer' field and no 'Answer prepared by' field" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2021-12-17" question_submitted_on: "2021-08-06" locators: published_on: "EBA Q&A register entry 2021_6141, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2021_6141, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer published in the EBA Q&A tool · author not stated · not legislation · published 17 Dec 2021 [Final Q&A]** *Final Q&A · EBA Q&A register, 17 December 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6141)* | | | |---|---| | **Full title** | EBA Q&A 2021_6141 — Q&A — Association of personalised security credentials \[Final Q&A\] | | **Prepared by** | Not stated in the document | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2021_6141 | | **Document type** | Q&A | | **Legal nature** | Author not stated · not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 17 December 2021; question submitted 6 August 2021 | | **Legal basis** | Article 97(1) PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Association of personalised security credentials to the payment service user** ### Question Should strong customer authentication (SCA) elements always be issued under control of the Account service Payment Services Provider (ASPSP)? ### Background When adding a payment card to a digital wallet, a payment service user is requesting the ASPSP for issuance of personalised security credentials to act as a possession element in future payment transactions. The process of adding the payment card to the wallet may have different options in the way the strong customer authentication for the association of the personalised security credentials according to Article 24 of Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication is executed. Some industry practices are observed where the wallet provider (in its role as token requester) provides certain SCA elements instead of the ASPSP. This could for example be a knowledge element for the payment service user which was issued and verified by the wallet provider. According to PSD2 Article 4(31), personalised security credentials are personalised features provided by the payment service provider to a payment service user for the purposes of authentication. According to EBA Q&A 2019\_4827, the "tokenisation of card details may meet the requirements of Article 7(1) of the Delegated Regulation, if the payment service provider of the payer (the issuer) is involved in the process of issuance of the token directly or indirectly (e.g. through an outsourcing agreement with a third party, i.e. a token requestor such as a wallet provider in the case of digital wallets or a merchant in the case of cards on file).” *** ### Answer Article 97(1)(c) of Directive 2015/2366/EU (PSD2) requires payment service providers (PSPs) to apply strong customer authentication (SCA) ‘where the payer carries out any action through a remote channel which may imply a risk of payment fraud or other abuses. Article 4(31) of PSD2 defines ‘personalised security credentials’ as personalised features provided by the payment service provider to a payment service user for the purposes of authentication Article 24 of the Commission Delegated Regulation (EU) 2018/389 prescribes further that ‘payment service providers shall ensure that only the payment service user (PSU) is associated, in a secure manner, with the personalised security credentials, the authentication devices and the software’ and that ‘the association by means of a remote channel of the payment service user's identity with the personalised security credentials and with authentication devices or software is performed using strong customer authentication’. Accordingly, the payment service provider that has issued the payment card (issuer) is responsible for providing the SCA elements to the payment service user and is required to apply SCA when adding a payment card to a digital wallet. Finally, issuers may outsource the provision and verification of the elements of SCA to a third party. In that case, the issuer should comply with the general requirements on outsourcing, including the requirements of the EBA Guidelines on Outsourcing arrangements (EBA/GL/2019/02) and the applicable requirements of the Delegated Regulation, including Articles 6-8 in relation to the respective SCA element, and Article 3 in relation to the periodical review of the security measures. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6141) ## Related Level 1 articles - [Article 97 — Authentication](../../../articles/97.md)