--- title: "EBA Q&A 2023_6949 — Q&A — Secure corporate payment processes and protocols [Final Q&A]" shortTitle: "EBA Q&A 2023_6949 — Q&A — Secure corporate payment processes and protocols [Final Q&A]" answer_id: EBA_QA_2023_6949 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 97(1) PSD2" date: 27 September 2024 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6949 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 27 September 2024" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6949" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2023_6949, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2024-09-27" question_submitted_on: "2023-12-21" locators: published_on: "EBA Q&A register entry 2023_6949, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2023_6949, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 27 Sep 2024 [Final Q&A]** *Final Q&A · EBA Q&A register, 27 September 2024 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6949)* | | | |---|---| | **Full title** | EBA Q&A 2023_6949 — Q&A — Secure corporate payment processes and protocols \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2023_6949 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 27 September 2024; question submitted 21 December 2023 | | **Legal basis** | Article 97(1) PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Secure corporate payment processes and protocols and inactivity time period** ### Question May the period time of inactivity required by the (EU) 2018/389 - RTS on strong customer authentication and secure communication (hereinafter: RTS on SCA & CSC) Article 4 (3) (d) be changed from 5 minutes to 20 minutes if the exemption based on Article 17 of RTS on SCA & CSC has been granted by the competent authority to the Payment service provider? ### Background During a supervisory inspection the competent authority observed that one of the Payment service providers (hereinafter: PSP) had increased the inactivity period from 5 minutes to 20 minutes in view of the fact that the mentioned PSP had received an exemption from its home National authority under Article 17 of RTS on SCA & CSC. Article 17 of the RTS on SCA & CSC states that payment service providers may decide not to apply strong customer authentication (SCA) “in respect of legal persons initiating electronic payment transactions through the use of dedicated payment processes or protocols that are only made available to payers who are not consumers”, provided competent authorities are satisfied that the levels of security are equivalent to those provided for by Directive 2015/2366/EU (PSD2) however it is not unambiguous, whether the foregoing means that it may also increase the inactivity period from 5 minutes to 20 as this would be contrary to Article 4 (3) (d) of the RTS on SCA & CSC. *** ### Answer Article 17 of the Delegated Regulation (EU) 2018/389 prescribes that ‘payment service providers (PSPs) shall be allowed not to apply strong customer authentication (SCA), in respect of legal persons initiating electronic payment transactions through the use of dedicated payment processes or protocols that are only made available to payers who are not consumers, where the competent authorities are satisfied that those processes or protocols guarantee at least equivalent levels of security to those provided for by Directive (EU) 2015/2366.’ Article 4(3)(d) of the Delegated Regulation provides that PSPs shall ensure that the ‘authentication by means of generating an authentication code includes ... the maximum time without activity by the payer after being authenticated for accessing its payment account online shall not exceed 5 minutes.’ Article 4(3)(d) of the Delegated Regulation introduces a security requirement related to the application of SCA and Article 17 of the Delegated Regulation allows competent authorities to exempt dedicated payment processes or protocols from the application of SCA if these offer equivalent levels of security. Accordingly, where a PSP intends introducing a longer period of inactivity during the authentication to that provided in Article 4(3)(d) of the Delegated Regulation, the PSP should introduce additional or alternative security measures to ensure that the level of security of the payment process or protocol is equivalent to that provided by PSD2. Where no additional or alternative security measures are in place, the time without activity shall not exceed 5 minutes. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2023_6949) ## Related Level 1 articles - [Article 97 — Authentication](../../../articles/97.md)