{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2023-01-27","gaps":[],"covered":["EBA Q&A 2021_6156 — Q&A — Arbitrating between security and obstacles [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2021-6156-arbitrating-between-security-and-obstacles","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2021-6156-arbitrating-between-security-and-obstacles","title":"EBA Q&A 2021_6156 — Q&A — Arbitrating between security and obstacles [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2021-6156-arbitrating-between-security-and-obstacles","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 27 January 2023","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6156","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"0d4a414446aa42d9","change_date":null,"nearest_versions":["2023-01-27"],"first_text_date":null,"correction_applies":false,"versions":["2023-01-27"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2021-6156-arbitrating-between-security-and-obstacles/versions/2023-01-27","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2021-6156-arbitrating-between-security-and-obstacles/versions/2023-01-27/rev/0d4a414446aa42d9","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2021-6156-arbitrating-between-security-and-obstacles/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2021-6156-arbitrating-between-security-and-obstacles/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 27 Jan 2023 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2023-01-27","question_submitted_on":"2021-09-01","locators":{"published_on":"EBA Q&A register entry 2021_6156, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2021_6156, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6156","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2021-6156-arbitrating-between-security-and-obstacles.md","body_sha256":"f9470f2cfc94447533746ffb26e911d3791855944c050bf103724715af35abd9"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2021_6156 — Q&A — Arbitrating between security and obstacles [Final Q&A]\"\nshortTitle: \"EBA Q&A 2021_6156 — Q&A — Arbitrating between security and obstacles [Final Q&A]\"\nanswer_id: EBA_QA_2021_6156\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 95 PSD2\"\ndate: 27 January 2023\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6156\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 27 January 2023\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6156\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2021_6156, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2023-01-27\"\n  question_submitted_on: \"2021-09-01\"\n  locators:\n    published_on: \"EBA Q&A register entry 2021_6156, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2021_6156, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 27 Jan 2023 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 27 January 2023 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6156)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2021_6156 — Q&A — Arbitrating between security and obstacles \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2021_6156 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 27 January 2023; question submitted 1 September 2021 |\n| **Legal basis** | Article 95 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Arbitrating between security and obstacles**\n\n### Question\n\nCan an Account Servicing Payment Service Provider (ASPSP) know a mobile phone number inside of the Third Party Provider (TPP)’s organisation in order to send a decryption password to the TPP out-of-band via SMS?\n\n### Background\n\nAs a general principle of PSD2, security of operations is of utmost importance.\n\nTo achieve security of operations, having a secured communication channel between Account Servicing Payment Service Provider (ASPSP) and Third Party Provider (TPP) for operational purposes (e.g. data exchange during TPP’s onboarding, or communication in case of an incident) can be of value. A simple way to realise this, is to encrypt those communications, and that the ASPSP sends a decryption password to the TPP out-of-band via SMS. This of course requires that the ASPSP knows a mobile phone number inside of the TPP’s organisation, which could be seen as an obstacle in the onboarding process, as it is not strictly necessary.\n\nThis practice could be implemented, but it is not clear today for the financial institution, nor for its supervisory body if such an implementation would be inside of the boundaries of an acceptable interpretation.\n\n***\n\n### Answer\n\nArticle 32(3) of the Commission Delegated Regulation (EU) 2018/389 prescribes that ‘account servicing payment service providers that have put in place a dedicated interface shall ensure that this interface does not create obstacles to the provision of payment initiation and account information services. Such obstacles, may include, among others, preventing the use by payment service providers referred to in Article 30(1) of the credentials issued by account servicing payment service providers to their customers, imposing redirection to the account servicing payment service provider's authentication or other functions, requiring additional authorisations and registrations in addition to those provided for in Articles 11, 14 and 15 of Directive (EU) 2015/2366, or requiring additional checks of the consent given by payment service users to providers of payment initiation and account information services.’\n\nParagraph 50 of the Opinion on obstacles under Article 32(3) of the RTS on SCA&CSC (EBA/OP/2020/10) clarified that ‘additional registrations required by ASPSPs for TPPs to be able to access the PSUs’ payment accounts, or the ASPSPs’ production interface, that go beyond what is technically necessary in order to ensure secure access to payment accounts under the conditions of the RTS, are an obstacle. For example, a requirement imposed by an ASPSP to TPPs to pre-register their contact details with the ASPSP in order for TPPs to have access to the ASPSP’s API is an obstacle. This being said, a registration process that is optional, or that is agreed between the ASPSP and TPPs, is not an obstacle’.\n\nAccordingly, requiring TPPs to provide a mobile phone number to ASPSPs for submission of decryption password via an SMS is an obstacle.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6156)\n\n## Related Level 1 articles\n\n- [Article 95 — Management of operational and security risks](../../../articles/95.md)\n"}