{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2022-10-14","gaps":[],"covered":["EBA Q&A 2022_6392 — Q&A — API functionality [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2022-6392-api-functionality","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2022-6392-api-functionality","title":"EBA Q&A 2022_6392 — Q&A — API functionality [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2022-6392-api-functionality","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 14 October 2022","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6392","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"bd9333a7a151593e","change_date":null,"nearest_versions":["2022-10-14"],"first_text_date":null,"correction_applies":false,"versions":["2022-10-14"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2022-6392-api-functionality/versions/2022-10-14","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2022-6392-api-functionality/versions/2022-10-14/rev/bd9333a7a151593e","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2022-6392-api-functionality/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2022-6392-api-functionality/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 14 Oct 2022 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2022-10-14","question_submitted_on":"2022-03-10","locators":{"published_on":"EBA Q&A register entry 2022_6392, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2022_6392, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6392","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2022-6392-api-functionality.md","body_sha256":"bdd0d86e4c87d856d6f2c89220cc1baa270f8fa7b5690c013334cf220fc185b6"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2022_6392 — Q&A — API functionality [Final Q&A]\"\nshortTitle: \"EBA Q&A 2022_6392 — Q&A — API functionality [Final Q&A]\"\nanswer_id: EBA_QA_2022_6392\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 98(1) PSD2\"\ndate: 14 October 2022\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6392\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 14 October 2022\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6392\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2022_6392, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2022-10-14\"\n  question_submitted_on: \"2022-03-10\"\n  locators:\n    published_on: \"EBA Q&A register entry 2022_6392, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2022_6392, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 14 Oct 2022 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 14 October 2022 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6392)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2022_6392 — Q&A — API functionality \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2022_6392 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 14 October 2022; question submitted 10 March 2022 |\n| **Legal basis** | Article 98(1) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**API functionality**\n\n### Question\n\nIs it allowed to use a dedicated PSD2 interface by a TPP that identifies itself with an eIDAS certificate for purposes other than those specified in Article 30(1)(b) - (c) of the RTS on strong customer authentication (SCA) and secure communication?\n\n### Background\n\nTPP has informed us that it uses API requests to the Production PSD2 API for purposes other than payment initiation or access to account information, namely, monitoring API availability. What's more, these API requests are part of the monitoring service offered on the market, which is used, among others, by some national competent authorities.\n\nPSD2 and specifically RTS define the dedicated interface's purposes (Article 30(1)(b) and (c)of RTS on strong customer authentication (SCA) and secure communication).\n\nFurthermore, Article 34(3)(a) defines the requirements for what needs to be included in the certificates the TPP uses for identification.\n\nThe roles for payment institutions are (I) account servicing, (ii) payment initiation; (iii) account information; (iv) issuing of card-based payment instruments.\n\nThese roles are reflected in the eIDAS certificates. None of them refers to the monitoring activity. Use of the actual request for monitoring purposes can also affect the conversion and error rates, as the request is counted as failed.\n\n***\n\n### Answer\n\nIn accordance with Article 34(1) of Commission Delegated Regulation (EU) 2018/389, payment service providers (PSPs) shall rely, for the purpose of identification of third party providers (TPPs) as referred to in Article 30(1)(a), on eIDAS certificates. Article 34(3) provides that the eIDAS certificate shall specify the role of the PSP as ‘account servicing’, ’payment initiation’; ‘account information’ and/or ‘issuing of card-based payment instruments’. As clarified in the EBA Opinion on the use of eIDAS certificates under the RTS on SCA and CSC (EBA-Op-2018-7), these four roles can be assigned to PSPs that have been authorised to provide the respective payment services as referred to in Annex I to PSD2.\n\nAt the same time, TPPs should ensure that they comply with their respective obligations under Articles 66 and 67 of Directive 2015/2366/EU (PSD2) including the requirement to not access any data for purposes other than for the provision of the payment initiation service or, respectively, the account information service as explicitly requested by the payment service user.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6392)\n\n## Related Level 1 articles\n\n- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)\n"}