<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2025-08-29","gaps":[],"covered":["EBA Q&A 2024_7286 — Q&A — Knowledge element of SCA. [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2024-7286-knowledge-element-of-sca","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2024-7286-knowledge-element-of-sca","title":"EBA Q&A 2024_7286 — Q&A — Knowledge element of SCA. [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2024-7286-knowledge-element-of-sca","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 29 August 2025","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7286","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"1fa6713df6a2d585","change_date":null,"nearest_versions":["2025-08-29"],"first_text_date":null,"correction_applies":false,"versions":["2025-08-29"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2024-7286-knowledge-element-of-sca/versions/2025-08-29","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2024-7286-knowledge-element-of-sca/versions/2025-08-29/rev/1fa6713df6a2d585","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2024-7286-knowledge-element-of-sca/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2024-7286-knowledge-element-of-sca/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 29 Aug 2025 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2025-08-29","question_submitted_on":"2024-12-18","locators":{"published_on":"EBA Q&A register entry 2024_7286, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2024_7286, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2024_7286 — Q&A — Knowledge element of SCA. [Final Q&A]"
shortTitle: "EBA Q&A 2024_7286 — Q&A — Knowledge element of SCA. [Final Q&A]"
answer_id: EBA_QA_2024_7286
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "PSD2"
date: 29 August 2025
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7286
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 29 August 2025"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7286"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2024_7286, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2025-08-29"
  question_submitted_on: "2024-12-18"
  locators:
    published_on: "EBA Q&A register entry 2024_7286, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2024_7286, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 29 Aug 2025 [Final Q&A]**

*Final Q&A · EBA Q&A register, 29 August 2025 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7286)*

| | |
|---|---|
| **Full title** | EBA Q&A 2024_7286 — Q&A — Knowledge element of SCA. \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2024_7286 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 29 August 2025; question submitted 18 December 2024 |
| **Legal basis** | PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Knowledge element of SCA.**

### Question

Can an API key be considered as a Knowledge element of SCA?

### Background

SCA means an authentication based on the use of two or more elements categorized as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent.

The financial entity has chosen to use for SCA the combination of the possession element and the knowledge element.

The financial entity has only corporate customers.

For the possession element the customer has to set-up a HSM in its own environment, generate a key-pair, store the private key in the HSM and send via a secure connection the public key to the financial entity.

For the knowledge key, the customer has to log in to the financial entity portal, based on an userid and an OTP(One Time Password, received from the financial entity), and create what the financial entity calls an API-key. The API key is created by the financial entity and during the creation the key is shown in plain text for a very short moment. After the creation the API Key cannot be viewed in plain text again. The customer must securely store the API key. The financial entity suggests to store the API Key in for example a file, database, key vault or HSM. This could also be the same HSM as used by the customer for the private key of the possession element.

The hash of the API key is stored by the financial entity. The hash is used by the financial entity to valid the use of the knowledge element at the authorisation of the transaction done by the customer.

For the initiation of transactions the customer has to sign with his private key and to copy the API key as knowledge element in the financial entity portal.

***

### Answer

According to Article 4, point (30) of Directive (EU) 2015/2366 (PSD2), ‘strong customer authentication’ (SCA) means “an authentication based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data”.

An API key may constitute a valid SCA knowledge element, provided that the Payment Service Provider (PSP) complies with all applicable requirements under Commission Delegated Regulation (EU) 2018/389 (the RTS on SCA). This includes:

The obligation under Article 6(1) to adopt measures to mitigate the risk that elements categorised as knowledge are uncovered by or disclosed to unauthorised parties.

The requirement under Article 9 to ensure the independence of the SCA elements.

The obligation under Article 24(2)(b) to ensure that the association, by means of a remote channel, of the Payment Service User (PSU)'s identity with the personalised security credentials and with authentication devices or software is performed using strong customer authentication.

While memorisation is not explicitly required, an SCA knowledge element should be known only to the user and not accessible to unauthorised parties or retrievable by the system itself.

Additionally, the API key, as an SCA factor, should be associated with the PSU in accordance with Article 24(2)(b) of the Delegated Regulation. In the case described by the submitter, the association with the PSU does not appear to meet the requirements of Article 24(2)(b), as only one valid SCA factor is used (possession via a one-time password). As clarified in the EBA Opinion (EBA-Op-2018-04), a user ID does not constitute a valid knowledge element. Based on the information provided by the submitter, it cannot be concluded whether the requirements of Articles 6(1) and 9 of the Delegated Regulation are met.

In conclusion, whether an API key qualifies as a knowledge element depends on its implementation.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7286)