--- title: "EBA Q&A 2023_6767 — Q&A — App to app redirection with biometrics for PIS [Final Q&A]" shortTitle: "EBA Q&A 2023_6767 — Q&A — App to app redirection with biometrics for PIS [Final Q&A]" answer_id: EBA_QA_2023_6767 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 97 PSD2" date: 29 September 2023 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6767 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 29 September 2023" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6767" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2023_6767, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2023-09-29" question_submitted_on: "2023-03-31" locators: published_on: "EBA Q&A register entry 2023_6767, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2023_6767, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 29 Sep 2023 [Final Q&A]** *Final Q&A · EBA Q&A register, 29 September 2023 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6767)* | | | |---|---| | **Full title** | EBA Q&A 2023_6767 — Q&A — App to app redirection with biometrics for PIS \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2023_6767 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 29 September 2023; question submitted 31 March 2023 | | **Legal basis** | Article 97 PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **App to app redirection with biometrics for PIS** ### Question Are ASPSPs required to offer redirected authentication with biometrics to users accessing their payment accounts through an AISP or initiating a payment through a PISP, if they offer redirected authentication with biometrics to users accessing accounts or initiating payments directly via the ASPSP? ### Background A growing number of ASPSPs allow their users to authenticate using the ASPSP’s dedicated authentication app as one of the two SCA factors categorised as possession when directly accessing their payment accounts or initiating a payment with the ASPSP. In these mobile payments use cases, the user is automatically redirected from the bank app to the dedicated authentication app, where biometrics satisfy the inherence criteria of SCA. However, these ASPSPs do not offer the same authentication procedure for users accessing accounts or initiating payments via an AISP or PISP. Instead, these users are only allowed to authenticate via an embedded or decoupled method and using manual input of account credentials - often involving a 6-12 digit number assigned by the ASPSP to the PSU which is difficult to memorise. The EBA has clarified in the Opinion on obstacles under Article 32(3) of the RTS on SCA and CSC (page 4) that if the interfaces provided by ASPSPs do not support all the authentication procedures made available by the ASPSP to its PSUs, that represents a breach of Art. 30(2) RTS and an obstacle under Article 32(3) RTS. Furthermore, the same EBA Opinion clarifies that “ASPSPs that enable their PSUs to authenticate using biometrics when directly accessing their payment accounts or initiating a payment, and that require the PSU to authenticate with the ASPSP to use AISPs/PISPs’ services, should also enable their PSUs to use biometrics to authenticate with the ASPSP in a PIS or AIS journey.” *** ### Answer Article 30(2) of the Delegated Regulation (EU) 2018/389 (RTS on SCA&CSC) requires account servicing payment service providers (ASPSPs) to ensure that the access interfaces provided to account information service providers (AISPs) and payment initiation service providers (PISPs) in accordance with Article 30(1) of that Regulation do not prevent AISPs and PISPs from relying upon the authentication procedure(s) provided by the ASPSP to its payment service users (PSUs). As clarified in EBA Opinion on the implementation of the RTS on SCA&CSC (EBA-Op-2018-04), this means that the method(s) of carrying out the authentication of the PSU (i.e. redirection, decoupled, embedded or a combination thereof) that ASPSPs should support will depend on the authentication procedures made available by the ASPSP to its PSUs and should support all these authentication procedures. Furthermore, paragraph 12 of the EBA Opinion on obstacles under Article 32(3) of the RTS on SCA&CSC (EBA/OP/2020/10) clarifies that ASPSPs that enable their PSUs to authenticate using biometrics when directly accessing their payment accounts or initiating a payment, and that require their PSUs to authenticate with the ASPSP to use AISPs/PISPs’ services, should also enable their PSUs to use biometrics to authenticate with the ASPSP when using the services of an AISP or PISP. It follows from the above that ASPSPs offering redirected authentication with biometrics to PSUs accessing accounts or initiating payments directly via the ASPSP should also enable their PSUs to use biometrics to authenticate with the ASPSP when using the services of an AISP or PISP. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6767) ## Related Level 1 articles - [Article 97 — Authentication](../../../articles/97.md)