{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2023-09-29","gaps":[],"covered":["EBA Q&A 2022_6526 — Q&A — Evidences / Records to be stored by account servicing [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2022-6526-evidences-records-to-be-stored-by-account-servicing-payment","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2022-6526-evidences-records-to-be-stored-by-account-servicing-payment","title":"EBA Q&A 2022_6526 — Q&A — Evidences / Records to be stored by account servicing [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2022-6526-evidences-records-to-be-stored-by-account-servicing-payment","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 29 September 2023","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6526","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"8d5d70f9d6118f9c","change_date":null,"nearest_versions":["2023-09-29"],"first_text_date":null,"correction_applies":false,"versions":["2023-09-29"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2022-6526-evidences-records-to-be-stored-by-account-servicing-payment/versions/2023-09-29","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2022-6526-evidences-records-to-be-stored-by-account-servicing-payment/versions/2023-09-29/rev/8d5d70f9d6118f9c","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2022-6526-evidences-records-to-be-stored-by-account-servicing-payment/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2022-6526-evidences-records-to-be-stored-by-account-servicing-payment/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 29 Sep 2023 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2023-09-29","question_submitted_on":"2022-07-22","locators":{"published_on":"EBA Q&A register entry 2022_6526, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2022_6526, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6526","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2022-6526-evidences-records-to-be-stored-by-account-servicing-payment.md","body_sha256":"9d7110e5be179b2d458c01cf4dc287b375a6b69be9959ab701f39a6e537f17aa"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2022_6526 — Q&A — Evidences / Records to be stored by account servicing [Final Q&A]\"\nshortTitle: \"EBA Q&A 2022_6526 — Q&A — Evidences / Records to be stored by account servicing [Final Q&A]\"\nanswer_id: EBA_QA_2022_6526\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 72 PSD2\"\ndate: 29 September 2023\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6526\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 29 September 2023\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6526\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2022_6526, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2023-09-29\"\n  question_submitted_on: \"2022-07-22\"\n  locators:\n    published_on: \"EBA Q&A register entry 2022_6526, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2022_6526, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 29 Sep 2023 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 29 September 2023 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6526)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2022_6526 — Q&A — Evidences / Records to be stored by account servicing \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2022_6526 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 29 September 2023; question submitted 22 July 2022 |\n| **Legal basis** | Article 72 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Evidences / Records to be stored by account servicing payment service providers (ASPSP) for payment initiation service (PIS) and account information service (AIS) requests**\n\n### Question\n\nShall ASPSP keep record of PIS requests received through a PISP and evidences on the authenticity and execution of these payment transactions when SCA is managed by ASPSP ?\n\nShall ASPSP keep record of the consent of the PSU and also of the AIS requests received through an AISP ?\n\nFor both evidences is there any specific retention period ?\n\n### Background\n\nArticle 72 specifies that when a payment is initiated through a PISP then it burdens to PISP to provide evidences on the authenticity and execution of a payment transaction. However in case an SCA exemption is not applicable and SCA is managed by ASPSP, the PISP cannot provide all evidences without relying on the ASPSP.\n\nAfter an authentication of a PSU, an AISP can request account informations for a period of 90 days before the renewal of the authentication. The consent of the PSU is recorded but the regulation does not contain any requirement regarding the records to keep in relation with AIS requests performed by the AISP during the consent period of 90 days.\n\n***\n\n### Answer\n\nIn accordance with Article 64(2) of Directive 2015/2366/EU (PSD2), “Consent to execute a payment transaction or a series of payment transactions shall be given in the form agreed between the payer and the payment service provider. Consent to execute a payment transaction may also be given via the payee or the payment initiation service provider. In the absence of consent, a payment transaction shall be considered to be unauthorised”. Furthermore, Article 64(4) of PSD2 provides that “The procedure for giving consent shall be agreed between the payer and the relevant payment service provider(s).”\n\nIn accordance with Article 72 of PSD2, “where a payment service user denies having authorised an executed payment transaction or claims that the payment transaction was not correctly executed, it is for the payment service provider to prove that the payment transaction was authenticated, accurately recorded, entered in the accounts and not affected by a technical breakdown or some other deficiency of the service provided by the payment service provider'.\n\nMoreover, Article 29(1) of the Commission Delegated Regulation (EU) 2018/389 (the ‘RTS on SCA&CSC') requires payment service providers (PSPs) to “have processes in place which ensure that all payment transactions and other interactions with the payment services user, with other payment service providers and with other entities, including merchants, in the context of the provision of the payment service are traceable, ensuring knowledge ex post of all events relevant to the electronic transaction in all the various stages. Article 29(2) provides that, for the purpose of Article 29(1), PSPs “shall ensure that any communication session established with the payment services user, other payment service providers and other entities, including merchants, relies among others, on “security mechanisms for the detailed logging of the transaction, including transaction number, timestamps and all relevant transaction data”.\n\nIt follows from the above that account servicing payment service providers (ASPSPs) should keep records of the authorisation of a payment transaction executed by the ASPSP, including, in the case of a transaction initiated through a payment initiation service provider (PISP), evidence regarding the request received from the PISP, as well as evidence that the ASPSP has complied with the requirements in Article 97 of PSD2 and the RTS on SCA&CSC regarding the application of strong customer authentication.\n\nASPSPs should also keep records regarding any access requests to the payment service user (PSU)’ s payment accounts received from account information service providers (AISPs), and evidence that the ASPSP has complied with the requirements in Article 97 of PSD2 and the RTS on SCA&CSC regarding the application of strong customer authentication.\n\nThe relevant retention periods set out in relevant Union law, and where applicable, national law, shall apply.\n\nThis being said, the EBA recalls that, as clarified in paragraph 13 of the EBA Opinion on the implementation of the RTS on SCA&CSC (EBA-Op-2018-04), and paragraph 43 of the EBA Opinion on obstacles under Article 32(3) of the RTS on SCA and CSC, ASPSPs should not check the consent granted by the PSU to TPPs, and that it is the obligation of the PISP/AISP to ensure that it has obtained the PSU’s explicit consent in accordance with Article 66(2) of PSD2 and, respectively, Article 67(2)(a) of PSD2.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2022_6526)\n\n## Related Level 1 articles\n\n- [Article 72 — Evidence on authentication and execution of payment transactions](../../../articles/72.md)\n"}