--- title: "EBA Q&A 2021_6298 — Q&A — Clarification on the protection requirements [Final Q&A]" shortTitle: "EBA Q&A 2021_6298 — Q&A — Clarification on the protection requirements [Final Q&A]" answer_id: EBA_QA_2021_6298 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 6(1) PSD2" date: 14 October 2022 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6298 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 14 October 2022" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6298" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2021_6298, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2022-10-14" question_submitted_on: "2021-11-29" locators: published_on: "EBA Q&A register entry 2021_6298, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2021_6298, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 14 Oct 2022 [Final Q&A]** *Final Q&A · EBA Q&A register, 14 October 2022 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6298)* | | | |---|---| | **Full title** | EBA Q&A 2021_6298 — Q&A — Clarification on the protection requirements \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2021_6298 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 14 October 2022; question submitted 29 November 2021 | | **Legal basis** | Article 6(1) PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Clarification on the protection requirements of a CustomerID when included in a payer-presented QR-code for the initiation of (instant) credit transfers at the Point of Interaction (POI)** ### Question Are the Customer ID’s security measures (e.g., encryption, tokenisation, transport layer security) mentioned under Q&A 5476 to be always applied in any payer-presented QR code, regardless of who generates it (e.g., including a non-PSP)? ### Background In accordance with the clarifications provided under Q&A 5476, the Customer ID facilitates the identification of the Payment Services User (PSU) for the purpose of authentication but is not in itself a valid Strong Customer Authentication (SCA) element. Therefore, it cannot be considered as a Personalised Security Credentials (PSC). However, Customer ID is not available to third parties other than the payment service user and the payment service provider, and its disclosure can be used to carry out fraud. Therefore, taking also into account the provisions of the EBA Guidelines on ICT and security risk management, the Customer ID cannot be included in a cleartext in a payer-presented QR-code for the initiation of credit transfers at the Point of Interaction without any security measures (e.g., encryption, tokenisation, transport layer security) ensuring its confidentiality during the QR-code life-cycle. When reviewing the clarification received under Q&A 5476, the Multi-Stakeholder Group (MSG) on Mobile initiated SEPA (Instant) Credit Transfers (MSCT) debated whether such security measures would apply to any payer-presented QR-code, regardless of who generates the code, or whether the obligation to encrypt/tokenise the CustomerID would only be applicable to entities authorised under PSD2 (Directive (EU) 2015/2366) and subject to the EBA Guidelines on ICT and security risk management, as a minority of the group is of the view that non-regulated entities or consumers should be allowed to generate a QR-code containing the Customer ID in clear-text. *** ### Answer Q&A 5476 clarified that Customer ID is not available to third parties other than the payment service user and the payment service provider, and its disclosure can be used to carry out fraud. Therefore, taking also into account Guidelines 3.4.1 and 3.4.4 of the Guidelines on ICT and security risk management, the Customer ID cannot be included in a cleartext in a payer-presented QR-code for the initiation of credit transfers at the point of interaction without any security measures (e.g. encryption, tokenisation, transport layer security) ensuring its confidentiality during the QR-code life-cycle. The clarification provided in Q&A 5476 covers the security measures that should be applied when the Customer ID is included in a QR code and do not distinguish between different parties that may generate the QR code. Accordingly, the security measures for the Customer ID should be applied in any payer-presented QR code, regardless of who generates the QR code. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2021_6298) ## Related Level 1 articles - [Article 6 — Control of the shareholding](../../../articles/6.md)