--- title: "EBA Q&A 2021_6145 — Q&A — SCA applicability / Application of SCA at tokenisation [Final Q&A]" shortTitle: "EBA Q&A 2021_6145 — Q&A — SCA applicability / Application of SCA at tokenisation [Final Q&A]" answer_id: EBA_QA_2021_6145 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 97 PSD2" date: 31 January 2023 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6145 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 31 January 2023" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6145" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2021_6145, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2023-01-31" question_submitted_on: "2021-08-31" locators: published_on: "EBA Q&A register entry 2021_6145, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2021_6145, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 31 Jan 2023 [Final Q&A]** *Final Q&A · EBA Q&A register, 31 January 2023 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6145)* | | | |---|---| | **Full title** | EBA Q&A 2021_6145 — Q&A — SCA applicability / Application of SCA at tokenisation \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2021_6145 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 31 January 2023; question submitted 31 August 2021 | | **Legal basis** | Article 97 PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **SCA applicability / Application of SCA at tokenisation stage** ### Question Does the authentication to unlock the mobile device count as one of the elements of strong customer authentication when a payment service user is tokenising a card on an e-wallet solution such as Apple Pay? ### Background Reference is made to Q&A\_4827, where the EBA clarified that SCA should be applied at the time of the issuance of the token (the initial addition of the funding payment instrument) in accordance with Article 97(1)(c) of the PSD2. Would the SCA requirement be fulfilled if one element of SCA (possession) is present during the issuance of the token and the other element (knowledge (inputting of a PIN) or inherence (fingerprint or face recognition) would have been applied when the payment service user unlocked his mobile device? *** ### Answer Article 97(1)(c) of Directive 2015/2366/EU (PSD2) requires payment service providers (PSPs) to apply strong customer authentication (SCA) ‘where the payer carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.’ Article 6(1) of the Commission Delegated Regulation (EU) 2018/389 require PSPs to ‘adopt measures to mitigate the risk that the elements of SCA categorised as knowledge are uncovered by, or disclosed to, unauthorised parties.’ Article 8(1) of the Commission Delegated Regulation (EU) 2018/389 require PSPs to ‘adopt measures to mitigate the risk that the authentication elements categorised as inherence and read by access devices and software provided to the payer are uncovered by unauthorised parties. At a minimum, the PSPs shall ensure that those access devices and software have a very low probability of an unauthorised party being authenticated as the payer.’ Article 24(2)(b) of the Commission Delegated Regulation (EU) 2018/389 requires PSPs to apply SCA to associate by means of a remote channel the payment service user's identity with personalised security credentials. Q&A 6141 clarified that the PSP that has issued the payment card (issuer) is responsible for providing the SCA elements to the payment service user and is required to apply SCA when adding a payment card to a digital wallet. Q&A 4047 also clarified that 'PSPs may outsource the execution of SCA to a third party. In that case, said PSPs should comply with the general requirements on outsourcing, including the requirements in the EBA Guidelines on Outsourcing arrangements (EBA/GL/2019/02). ' Q&A 4827 further clarified that ‘SCA should be applied at the time of the issuance of the token’ (adding a payment card to a digital wallet in order to create a token and associate it with the device). Accordingly, unlocking of a mobile phone with biometrics (e.g. a fingerprint) or with a PIN/password should not be considered a valid SCA element for the purpose of adding a payment card to a digital wallet if the screen locking mechanism of the mobile device is not under the control of the issuer or if the payer has not been associated previously through an SCA with the credential used for unlocking the phone. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6145) ## Related Level 1 articles - [Article 97 — Authentication](../../../articles/97.md)