<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2022-10-14","gaps":[],"covered":["EBA Q&A 2022_6392 — Q&A — API functionality [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2022-6392-api-functionality","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2022-6392-api-functionality","title":"EBA Q&A 2022_6392 — Q&A — API functionality [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2022-6392-api-functionality","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 14 October 2022","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6392","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"bd9333a7a151593e","change_date":null,"nearest_versions":["2022-10-14"],"first_text_date":null,"correction_applies":false,"versions":["2022-10-14"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2022-6392-api-functionality/versions/2022-10-14","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2022-6392-api-functionality/versions/2022-10-14/rev/bd9333a7a151593e","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2022-6392-api-functionality/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2022-6392-api-functionality/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 14 Oct 2022 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2022-10-14","question_submitted_on":"2022-03-10","locators":{"published_on":"EBA Q&A register entry 2022_6392, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2022_6392, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2022_6392 — Q&A — API functionality [Final Q&A]"
shortTitle: "EBA Q&A 2022_6392 — Q&A — API functionality [Final Q&A]"
answer_id: EBA_QA_2022_6392
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 98(1) PSD2"
date: 14 October 2022
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6392
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 14 October 2022"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6392"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2022_6392, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2022-10-14"
  question_submitted_on: "2022-03-10"
  locators:
    published_on: "EBA Q&A register entry 2022_6392, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2022_6392, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 14 Oct 2022 [Final Q&A]**

*Final Q&A · EBA Q&A register, 14 October 2022 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6392)*

| | |
|---|---|
| **Full title** | EBA Q&A 2022_6392 — Q&A — API functionality \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2022_6392 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 14 October 2022; question submitted 10 March 2022 |
| **Legal basis** | Article 98(1) PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**API functionality**

### Question

Is it allowed to use a dedicated PSD2 interface by a TPP that identifies itself with an eIDAS certificate for purposes other than those specified in Article 30(1)(b) - (c) of the RTS on strong customer authentication (SCA) and secure communication?

### Background

TPP has informed us that it uses API requests to the Production PSD2 API for purposes other than payment initiation or access to account information, namely, monitoring API availability. What's more, these API requests are part of the monitoring service offered on the market, which is used, among others, by some national competent authorities.

PSD2 and specifically RTS define the dedicated interface's purposes (Article 30(1)(b) and (c)of RTS on strong customer authentication (SCA) and secure communication).

Furthermore, Article 34(3)(a) defines the requirements for what needs to be included in the certificates the TPP uses for identification.

The roles for payment institutions are (I) account servicing, (ii) payment initiation; (iii) account information; (iv) issuing of card-based payment instruments.

These roles are reflected in the eIDAS certificates. None of them refers to the monitoring activity. Use of the actual request for monitoring purposes can also affect the conversion and error rates, as the request is counted as failed.

***

### Answer

In accordance with Article 34(1) of Commission Delegated Regulation (EU) 2018/389, payment service providers (PSPs) shall rely, for the purpose of identification of third party providers (TPPs) as referred to in Article 30(1)(a), on eIDAS certificates. Article 34(3) provides that the eIDAS certificate shall specify the role of the PSP as ‘account servicing’, ’payment initiation’; ‘account information’ and/or ‘issuing of card-based payment instruments’. As clarified in the EBA Opinion on the use of eIDAS certificates under the RTS on SCA and CSC (EBA-Op-2018-7), these four roles can be assigned to PSPs that have been authorised to provide the respective payment services as referred to in Annex I to PSD2.

At the same time, TPPs should ensure that they comply with their respective obligations under Articles 66 and 67 of Directive 2015/2366/EU (PSD2) including the requirement to not access any data for purposes other than for the provision of the payment initiation service or, respectively, the account information service as explicitly requested by the payment service user.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6392)

## Related Level 1 articles

- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)