<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2024-06-14","gaps":[],"covered":["EBA Q&A 2023_6863 — Q&A — Mobile Banking Services and SCA in the same app [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2023-6863-mobile-banking-services-and-sca-in-the-same-app","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2023-6863-mobile-banking-services-and-sca-in-the-same-app","title":"EBA Q&A 2023_6863 — Q&A — Mobile Banking Services and SCA in the same app [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2023-6863-mobile-banking-services-and-sca-in-the-same-app","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 14 June 2024","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6863","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"32cfc8d6dd71e18a","change_date":null,"nearest_versions":["2024-06-14"],"first_text_date":null,"correction_applies":false,"versions":["2024-06-14"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2023-6863-mobile-banking-services-and-sca-in-the-same-app/versions/2024-06-14","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2023-6863-mobile-banking-services-and-sca-in-the-same-app/versions/2024-06-14/rev/32cfc8d6dd71e18a","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2023-6863-mobile-banking-services-and-sca-in-the-same-app/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2023-6863-mobile-banking-services-and-sca-in-the-same-app/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 14 Jun 2024 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2024-06-14","question_submitted_on":"2023-08-08","locators":{"published_on":"EBA Q&A register entry 2023_6863, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2023_6863, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2023_6863 — Q&A — Mobile Banking Services and SCA in the same app [Final Q&A]"
shortTitle: "EBA Q&A 2023_6863 — Q&A — Mobile Banking Services and SCA in the same app [Final Q&A]"
answer_id: EBA_QA_2023_6863
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 98 PSD2"
date: 14 June 2024
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6863
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 14 June 2024"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6863"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2023_6863, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2024-06-14"
  question_submitted_on: "2023-08-08"
  locators:
    published_on: "EBA Q&A register entry 2023_6863, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2023_6863, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 14 Jun 2024 [Final Q&A]**

*Final Q&A · EBA Q&A register, 14 June 2024 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6863)*

| | |
|---|---|
| **Full title** | EBA Q&A 2023_6863 — Q&A — Mobile Banking Services and SCA in the same app \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2023_6863 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 14 June 2024; question submitted 8 August 2023 |
| **Legal basis** | Article 98 PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Mobile Banking Services and SCA in the same app**

### Question

We use a mobile app, software installed in a separate sandbox on a multi-purpose device, for the elements of strong customer authentication. Is it correct to assume that Article 9 (in COMMISSION DELEGATED REGULATION (EU) 2018/ 389) does not prevent us from offering mobile banking services through the same app?

### Background

Article 9 - 3 (a) mentions the "use of separated secure execution environments through the software installed inside the multi-purpose device". It is not 100% clear, how this use of a separated execution environment applies to mobile banking services.

***

### Answer

In accordance with Article 9(1) of the Delegated Regulation (EU) 2018/389, payment service providers (PSPs) shall ‘ensure that the use of the elements of strong customer authentication referred to in Articles 6, 7 and 8 is subject to measures which ensure that, in terms of technology, algorithms and parameters, the breach of one of the elements does not compromise the reliability of the other elements’. In addition, Article 9(2) requires that PSPs and ‘shall adopt security measures, where any of the elements of strong customer authentication or the authentication code itself is used through a multi-purpose device, to mitigate the risk which would result from that multi-purpose device being compromised.

Article 9 of the Delegated Regulation introduces requirements for the independence of authentication elements and their security. Article 9 does not restrict PSPs from carrying out mobile banking services and authentication of payment transactions through the same mobile applications.

Finally, it should be noted that the requirements of Art. 9(3)(a) of the Delegated Regulation apply with regard to the two authentication elements. It is for payment service providers to ensure that the authentication approaches are compliant with these requirements.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6863)

## Related Level 1 articles

- [Article 98 — Regulatory technical standards on authentication and communication](../../../articles/98.md)