{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2023-09-29","gaps":[],"covered":["EBA Q&A 2023_6827 — Q&A — Trusted Beneficiaries [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2023-6827-trusted-beneficiaries","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2023-6827-trusted-beneficiaries","title":"EBA Q&A 2023_6827 — Q&A — Trusted Beneficiaries [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2023-6827-trusted-beneficiaries","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 29 September 2023","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6827","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"ecc933baca8a8454","change_date":null,"nearest_versions":["2023-09-29"],"first_text_date":null,"correction_applies":false,"versions":["2023-09-29"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2023-6827-trusted-beneficiaries/versions/2023-09-29","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2023-6827-trusted-beneficiaries/versions/2023-09-29/rev/ecc933baca8a8454","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2023-6827-trusted-beneficiaries/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2023-6827-trusted-beneficiaries/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 29 Sep 2023 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2023-09-29","question_submitted_on":"2023-06-14","locators":{"published_on":"EBA Q&A register entry 2023_6827, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2023_6827, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6827","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2023-6827-trusted-beneficiaries.md","body_sha256":"25181bab2ea84af5751284055b5dab49393536c2540a8a3e26be848af4e3fac2"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2023_6827 — Q&A — Trusted Beneficiaries [Final Q&A]\"\nshortTitle: \"EBA Q&A 2023_6827 — Q&A — Trusted Beneficiaries [Final Q&A]\"\nanswer_id: EBA_QA_2023_6827\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 97(1) PSD2\"\ndate: 29 September 2023\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6827\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 29 September 2023\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6827\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2023_6827, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2023-09-29\"\n  question_submitted_on: \"2023-06-14\"\n  locators:\n    published_on: \"EBA Q&A register entry 2023_6827, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2023_6827, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 29 Sep 2023 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 29 September 2023 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6827)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2023_6827 — Q&A — Trusted Beneficiaries \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2023_6827 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 29 September 2023; question submitted 14 June 2023 |\n| **Legal basis** | Article 97(1) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Trusted Beneficiaries**\n\n### Question\n\nPlease clarify whether under Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication (hereinafter: RTS on SCA & CSC) is it allowed to use the same SCA element to authorize a payment and at the same time (using the same session ID) approve (technically using by a checkbox) the payee as a trusted beneficiary? If it is allowed, the payment service user (hereinafter: PSU) shall be informed (prior to authorisation) by an approval SCA element (SMS) about the payment execution and about modifying the list of the trusted beneficiaries as well?\n\n### Background\n\nWe identified a fraudulent transaction pattern where fraudsters have gained credentials of a PSU and the fraudsters have creating a mobile app and have initiated a payment at the first time with an extremely low amount and atthe same time it is possible to set their own account as trusted beneficiary by using a checkbox in the mobile app wich the fraudsters have done. After the fraudsters have saved their own account as trusted beneficiary they can initiate and execute any payments without SCA.\n\nAccording to the Article 13(1) of RTS on SCA & CSC the payment service provider (hereinafter: PSP) shall apply SCA where a PSU creates or amends a list of trusted beneficiaries. The answer to Q&A 4338 states that adding a payee to a trusted beneficiary list requires the application of SCA, including when done prior to the initiation of a payment.\n\n***\n\n### Answer\n\nArticle 97(1)(b) of Directive 2015/2366/EU (PSD2) requires payment service providers (PSPs) to apply strong customer authentication (SCA) when the payer initiates an electronic payment transaction.\n\nQ&A 4141 clarified that, when initiating a payment while within the same session in which SCA was performed to access account data, one of the elements used at the time the customer accessed its payment account online (including via a mobile app) may be reused in compliance with Article 4 of the Commission Delegated Regulation (EU) 2018/389, provided that the other element of SCA is carried out at the time the payment is initiated and the dynamic linking element required under Article 97(2) PSD2 (for remote payment transactions) is present and linked to that latter element.\n\nFurther, the principle set out in Q&A 4141 may be applied in the specific case described by the submitter. This means that one of the authentication elements used for initiating an electronic payment transaction may be reused when the payer adds a payee to the trusted beneficiaries list under Article 13 of the Delegated Regulation within the same session.\n\nHowever, reusing the same two SCA elements applied for initiating an electronic payment transaction when adding a payee to the trusted beneficiaries list under Article 13 of the Delegated Regulation is not compliant with the legal requirements.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6827)\n\n## Related Level 1 articles\n\n- [Article 97 — Authentication](../../../articles/97.md)\n"}