{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2025-08-29","gaps":[],"covered":["EBA Q&A 2024_7286 — Q&A — Knowledge element of SCA. [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2024-7286-knowledge-element-of-sca","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2024-7286-knowledge-element-of-sca","title":"EBA Q&A 2024_7286 — Q&A — Knowledge element of SCA. [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2024-7286-knowledge-element-of-sca","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 29 August 2025","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7286","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"1fa6713df6a2d585","change_date":null,"nearest_versions":["2025-08-29"],"first_text_date":null,"correction_applies":false,"versions":["2025-08-29"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2024-7286-knowledge-element-of-sca/versions/2025-08-29","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2024-7286-knowledge-element-of-sca/versions/2025-08-29/rev/1fa6713df6a2d585","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2024-7286-knowledge-element-of-sca/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2024-7286-knowledge-element-of-sca/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 29 Aug 2025 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2025-08-29","question_submitted_on":"2024-12-18","locators":{"published_on":"EBA Q&A register entry 2024_7286, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2024_7286, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7286","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2024-7286-knowledge-element-of-sca.md","body_sha256":"e5d2067df3564d5c2ce684bc220bc6249c9a6c4ed37957a36f45327fb1314100"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2024_7286 — Q&A — Knowledge element of SCA. [Final Q&A]\"\nshortTitle: \"EBA Q&A 2024_7286 — Q&A — Knowledge element of SCA. [Final Q&A]\"\nanswer_id: EBA_QA_2024_7286\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"PSD2\"\ndate: 29 August 2025\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7286\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 29 August 2025\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7286\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2024_7286, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2025-08-29\"\n  question_submitted_on: \"2024-12-18\"\n  locators:\n    published_on: \"EBA Q&A register entry 2024_7286, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2024_7286, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 29 Aug 2025 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 29 August 2025 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7286)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2024_7286 — Q&A — Knowledge element of SCA. \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2024_7286 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 29 August 2025; question submitted 18 December 2024 |\n| **Legal basis** | PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Knowledge element of SCA.**\n\n### Question\n\nCan an API key be considered as a Knowledge element of SCA?\n\n### Background\n\nSCA means an authentication based on the use of two or more elements categorized as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent.\n\nThe financial entity has chosen to use for SCA the combination of the possession element and the knowledge element.\n\nThe financial entity has only corporate customers.\n\nFor the possession element the customer has to set-up a HSM in its own environment, generate a key-pair, store the private key in the HSM and send via a secure connection the public key to the financial entity.\n\nFor the knowledge key, the customer has to log in to the financial entity portal, based on an userid and an OTP(One Time Password, received from the financial entity), and create what the financial entity calls an API-key. The API key is created by the financial entity and during the creation the key is shown in plain text for a very short moment. After the creation the API Key cannot be viewed in plain text again. The customer must securely store the API key. The financial entity suggests to store the API Key in for example a file, database, key vault or HSM. This could also be the same HSM as used by the customer for the private key of the possession element.\n\nThe hash of the API key is stored by the financial entity. The hash is used by the financial entity to valid the use of the knowledge element at the authorisation of the transaction done by the customer.\n\nFor the initiation of transactions the customer has to sign with his private key and to copy the API key as knowledge element in the financial entity portal.\n\n***\n\n### Answer\n\nAccording to Article 4, point (30) of Directive (EU) 2015/2366 (PSD2), ‘strong customer authentication’ (SCA) means “an authentication based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data”.\n\nAn API key may constitute a valid SCA knowledge element, provided that the Payment Service Provider (PSP) complies with all applicable requirements under Commission Delegated Regulation (EU) 2018/389 (the RTS on SCA). This includes:\n\nThe obligation under Article 6(1) to adopt measures to mitigate the risk that elements categorised as knowledge are uncovered by or disclosed to unauthorised parties.\n\nThe requirement under Article 9 to ensure the independence of the SCA elements.\n\nThe obligation under Article 24(2)(b) to ensure that the association, by means of a remote channel, of the Payment Service User (PSU)'s identity with the personalised security credentials and with authentication devices or software is performed using strong customer authentication.\n\nWhile memorisation is not explicitly required, an SCA knowledge element should be known only to the user and not accessible to unauthorised parties or retrievable by the system itself.\n\nAdditionally, the API key, as an SCA factor, should be associated with the PSU in accordance with Article 24(2)(b) of the Delegated Regulation. In the case described by the submitter, the association with the PSU does not appear to meet the requirements of Article 24(2)(b), as only one valid SCA factor is used (possession via a one-time password). As clarified in the EBA Opinion (EBA-Op-2018-04), a user ID does not constitute a valid knowledge element. Based on the information provided by the submitter, it cannot be concluded whether the requirements of Articles 6(1) and 9 of the Delegated Regulation are met.\n\nIn conclusion, whether an API key qualifies as a knowledge element depends on its implementation.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7286)\n"}