{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2023-09-29","gaps":[],"covered":["EBA Q&A 2023_6820 — Q&A — Exemption from strong customer authentication [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2023-6820-exemption-from-strong-customer-authentication","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2023-6820-exemption-from-strong-customer-authentication","title":"EBA Q&A 2023_6820 — Q&A — Exemption from strong customer authentication [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2023-6820-exemption-from-strong-customer-authentication","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 29 September 2023","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6820","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"b53f25e499d513e1","change_date":null,"nearest_versions":["2023-09-29"],"first_text_date":null,"correction_applies":false,"versions":["2023-09-29"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2023-6820-exemption-from-strong-customer-authentication/versions/2023-09-29","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2023-6820-exemption-from-strong-customer-authentication/versions/2023-09-29/rev/b53f25e499d513e1","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2023-6820-exemption-from-strong-customer-authentication/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2023-6820-exemption-from-strong-customer-authentication/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 29 Sep 2023 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2023-09-29","question_submitted_on":"2023-06-06","locators":{"published_on":"EBA Q&A register entry 2023_6820, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2023_6820, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6820","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2023-6820-exemption-from-strong-customer-authentication.md","body_sha256":"7be9941ac4e7fb7193a5c2870a8b76d1aedda298f4003cb15840aab9775894b8"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2023_6820 — Q&A — Exemption from strong customer authentication [Final Q&A]\"\nshortTitle: \"EBA Q&A 2023_6820 — Q&A — Exemption from strong customer authentication [Final Q&A]\"\nanswer_id: EBA_QA_2023_6820\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 98 PSD2\"\ndate: 29 September 2023\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6820\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 29 September 2023\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6820\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2023_6820, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2023-09-29\"\n  question_submitted_on: \"2023-06-06\"\n  locators:\n    published_on: \"EBA Q&A register entry 2023_6820, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2023_6820, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 29 Sep 2023 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 29 September 2023 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6820)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2023_6820 — Q&A — Exemption from strong customer authentication \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2023_6820 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 29 September 2023; question submitted 6 June 2023 |\n| **Legal basis** | Article 98 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Exemption from strong customer authentication**\n\n### Question\n\nDo the revisions to Art.10 set out in Commission Delegated Regulation (EU) 2022/2360 of 3 August 2022 amending the regulatory technical standards laid down in Delegated Regulation (EU) 2018/389 as regards the 90-day exemption for account access mean that a payment service user or account information service provider is now limited to accessing only the account balance OR the transaction details for the last 90 days when availing of the revised exemption?\n\n### Background\n\nArticle 10(1) of Delegated Regulation (EU) 2018/389 provided that,\n\n“Payment service providers shall be allowed not to apply strong customer authentication, subject to compliance with the requirements laid down in Article 2 and to paragraph 2 of this Article and, where a payment service user is limited to accessing either or both of the following items online without disclosure of sensitive payment data:\n\n(a) the balance of one or more designated payment accounts;\n\n(b) the payment transactions executed in the last 90 days through one or more designated payment accounts.\n\nCommission Delegated Regulation (EU) 2022/2360 has revised Art.10 and introduced a new Art.10a which now provide:\n\nArt.10(1)\n\nPayment service providers shall be allowed not to apply strong customer authentication, subject to compliance with the requirements laid down in Article 2, where a payment service user is accessing its payment account online directly, provided that access is limited to one of the following items online without disclosure of sensitive payment data:\n\nthe balance of one or more designated payment accounts;\n\nthe payment transactions executed in the last 90 days through one or more designated payment accounts.\n\nArt. 10a(1)\n\nPayment service providers shall not apply strong customer authentication where a payment service user is accessing its payment account online through an account information service provider, provided that access is limited to one of the following items online without disclosure of sensitive payment data:\n\n(a) the balance of one or more designated payment accounts;\n\n(b) the payment transactions executed in the last 90 days through one or more designated payment accounts.\n\nUnder the original Art.10 exemption, a payment service user could access “either or both of”, meaning the account balance AND/OR transaction details whereas in both the revised Art.10 and the new Art.10a access is limited to “one of” the account balance or transaction details which would seem to restrict the levels of access enjoyed today. Did the Commission intend to introduce such a material change with the revised wording, and if so, why?\n\n***\n\n### Answer\n\nArticle 10(1) of Delegated Regulation (EU) 2018/389, as amended by Commission Delegated Regulation (EU) 2022/2360, allows Payment service providers (PSPs) not to apply strong customer authentication (SCA), where a payment service user (PSU) is accessing its payment account online directly, “provided that access is limited to one of the following items online without disclosure of sensitive payment data:\n\n(a) the balance of one or more designated payment accounts;\n\n(b) the payment transactions executed in the last 90 days through one or more designated payment accounts”.\n\nFurthermore, Article 10a(1) of Delegated Regulation (EU) 2018/389, as amended by Commission Delegated Regulation (EU) 2022/2360, requires PSPs not to apply SCA where a PSU is accessing its payment account online through an account information service provider (AISP), “provided that access is limited to one of the following items online without disclosure of sensitive payment data:\n\n(a) the balance of one or more designated payment accounts;\n\n(b) the payment transactions executed in the last 90 days through one or more designated payment accounts”.\n\nIn relation to the above, recital 4 of Commission Delegated Regulation (EU) 2022/2360 clarifies that the above exemption from SCA “should be limited to access to the balance and the recent transactions of a payment account without disclosure of sensitive payment data”.\n\nIt follows from the above that the exemptions in Articles 10 and 10a also apply where the access request refers to both the payment account balance and the last 90-days transaction history, provided that the other conditions set out in the Delegated Regulation (EU) 2018/389 are met. In this regard, the scope of data that can be accessed using the exemptions in Article 10 and 10a remains the same as before the amendments introduced by Commission Delegated Regulation (EU) 2022/2360.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6820)\n\n## Related Level 1 articles\n\n- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)\n"}