--- title: "EBA Q&A 2023_6820 — Q&A — Exemption from strong customer authentication [Final Q&A]" shortTitle: "EBA Q&A 2023_6820 — Q&A — Exemption from strong customer authentication [Final Q&A]" answer_id: EBA_QA_2023_6820 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 98 PSD2" date: 29 September 2023 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6820 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 29 September 2023" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6820" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2023_6820, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2023-09-29" question_submitted_on: "2023-06-06" locators: published_on: "EBA Q&A register entry 2023_6820, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2023_6820, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 29 Sep 2023 [Final Q&A]** *Final Q&A · EBA Q&A register, 29 September 2023 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6820)* | | | |---|---| | **Full title** | EBA Q&A 2023_6820 — Q&A — Exemption from strong customer authentication \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2023_6820 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 29 September 2023; question submitted 6 June 2023 | | **Legal basis** | Article 98 PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Exemption from strong customer authentication** ### Question Do the revisions to Art.10 set out in Commission Delegated Regulation (EU) 2022/2360 of 3 August 2022 amending the regulatory technical standards laid down in Delegated Regulation (EU) 2018/389 as regards the 90-day exemption for account access mean that a payment service user or account information service provider is now limited to accessing only the account balance OR the transaction details for the last 90 days when availing of the revised exemption? ### Background Article 10(1) of Delegated Regulation (EU) 2018/389 provided that, “Payment service providers shall be allowed not to apply strong customer authentication, subject to compliance with the requirements laid down in Article 2 and to paragraph 2 of this Article and, where a payment service user is limited to accessing either or both of the following items online without disclosure of sensitive payment data: (a) the balance of one or more designated payment accounts; (b) the payment transactions executed in the last 90 days through one or more designated payment accounts. Commission Delegated Regulation (EU) 2022/2360 has revised Art.10 and introduced a new Art.10a which now provide: Art.10(1) Payment service providers shall be allowed not to apply strong customer authentication, subject to compliance with the requirements laid down in Article 2, where a payment service user is accessing its payment account online directly, provided that access is limited to one of the following items online without disclosure of sensitive payment data: the balance of one or more designated payment accounts; the payment transactions executed in the last 90 days through one or more designated payment accounts. Art. 10a(1) Payment service providers shall not apply strong customer authentication where a payment service user is accessing its payment account online through an account information service provider, provided that access is limited to one of the following items online without disclosure of sensitive payment data: (a) the balance of one or more designated payment accounts; (b) the payment transactions executed in the last 90 days through one or more designated payment accounts. Under the original Art.10 exemption, a payment service user could access “either or both of”, meaning the account balance AND/OR transaction details whereas in both the revised Art.10 and the new Art.10a access is limited to “one of” the account balance or transaction details which would seem to restrict the levels of access enjoyed today. Did the Commission intend to introduce such a material change with the revised wording, and if so, why? *** ### Answer Article 10(1) of Delegated Regulation (EU) 2018/389, as amended by Commission Delegated Regulation (EU) 2022/2360, allows Payment service providers (PSPs) not to apply strong customer authentication (SCA), where a payment service user (PSU) is accessing its payment account online directly, “provided that access is limited to one of the following items online without disclosure of sensitive payment data: (a) the balance of one or more designated payment accounts; (b) the payment transactions executed in the last 90 days through one or more designated payment accounts”. Furthermore, Article 10a(1) of Delegated Regulation (EU) 2018/389, as amended by Commission Delegated Regulation (EU) 2022/2360, requires PSPs not to apply SCA where a PSU is accessing its payment account online through an account information service provider (AISP), “provided that access is limited to one of the following items online without disclosure of sensitive payment data: (a) the balance of one or more designated payment accounts; (b) the payment transactions executed in the last 90 days through one or more designated payment accounts”. In relation to the above, recital 4 of Commission Delegated Regulation (EU) 2022/2360 clarifies that the above exemption from SCA “should be limited to access to the balance and the recent transactions of a payment account without disclosure of sensitive payment data”. It follows from the above that the exemptions in Articles 10 and 10a also apply where the access request refers to both the payment account balance and the last 90-days transaction history, provided that the other conditions set out in the Delegated Regulation (EU) 2018/389 are met. In this regard, the scope of data that can be accessed using the exemptions in Article 10 and 10a remains the same as before the amendments introduced by Commission Delegated Regulation (EU) 2022/2360. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6820) ## Related Level 1 articles - [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)