{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2025-10-03","gaps":[],"covered":["EBA Q&A 2025_7376 — Q&A — the use of strong and widely recognized encryption [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2025-7376-the-use-of-strong-and-widely-recognized-encryption","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7376-the-use-of-strong-and-widely-recognized-encryption","title":"EBA Q&A 2025_7376 — Q&A — the use of strong and widely recognized encryption [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2025-7376-the-use-of-strong-and-widely-recognized-encryption","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 3 October 2025","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7376","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"964eb98e5d1dc5e0","change_date":null,"nearest_versions":["2025-10-03"],"first_text_date":null,"correction_applies":false,"versions":["2025-10-03"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7376-the-use-of-strong-and-widely-recognized-encryption/versions/2025-10-03","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7376-the-use-of-strong-and-widely-recognized-encryption/versions/2025-10-03/rev/964eb98e5d1dc5e0","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7376-the-use-of-strong-and-widely-recognized-encryption/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7376-the-use-of-strong-and-widely-recognized-encryption/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 3 Oct 2025 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2025-10-03","question_submitted_on":"2025-03-10","locators":{"published_on":"EBA Q&A register entry 2025_7376, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2025_7376, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7376","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2025-7376-the-use-of-strong-and-widely-recognized-encryption.md","body_sha256":"baee767a88decb9d42c44831fc11b869d05e4c65a2966e8a002f8527afa413e5"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2025_7376 — Q&A — the use of strong and widely recognized encryption [Final Q&A]\"\nshortTitle: \"EBA Q&A 2025_7376 — Q&A — the use of strong and widely recognized encryption [Final Q&A]\"\nanswer_id: EBA_QA_2025_7376\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 97(1) PSD2\"\ndate: 3 October 2025\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7376\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 3 October 2025\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7376\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2025_7376, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2025-10-03\"\n  question_submitted_on: \"2025-03-10\"\n  locators:\n    published_on: \"EBA Q&A register entry 2025_7376, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2025_7376, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 3 Oct 2025 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 3 October 2025 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7376)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2025_7376 — Q&A — the use of strong and widely recognized encryption \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2025_7376 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 3 October 2025; question submitted 10 March 2025 |\n| **Legal basis** | Article 97(1) PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**the use of strong and widely recognized encryption techniques**\n\n### Question\n\nAll strong and widely recognized encryption techniques (e.g. RSA and ECC) currently available on the market must be provided by the account servicing payment service providers or only that encryption technique which is indicated in the documentation of the technical specification of the API in accordance with Article 30(3) of the RTS on SCA & CSC shall be provided?\n\n### Background\n\nPursuant to Article 35(1) of RTS on SCA & CSC account servicing payment service providers, payment service providers (hereinafter: ASPSPs) issuing card-based payment instruments, account information service providers and payment initiation service providers shall ensure that, when exchanging data by means of the internet, secure encryption is applied between the communicating parties throughout the respective communication session in order to safeguard the confidentiality and the integrity of the data, using strong and widely recognised encryption techniques.\n\nHowever, in this context, the SCAr does not regulate whether payment service providers are obliged to use (adopt) only one or more of the strong and widely recognised encryption techniques (e.g. currently RSA and ECC), as indicated in the technical specification documentation of the access interface in accordance with the second subparagraph of Article 30(3) of the the RTS on SCA & CSC.\n\nSome ASPSPs have decided not to provide all strong and widely recognized encryption techniques only RSA and this caused refused API call connections because of the use of an ECC algorithm certificate.\n\n***\n\n### Answer\n\nArticle 35(1) of the Commission Delegated Regulation (EU) 2018/389 (RTS SCA&CSC) prescribes that 'account servicing payment service providers (ASPSP), payment service providers issuing card-based payment instruments (CBPII), account information service providers (AISP) and payment initiation service providers (PISP) shall ensure that, when exchanging data by means of the internet, secure encryption is applied between the communicating parties throughout the respective communication session in order to safeguard the confidentiality and the integrity of the data, using strong and widely recognised encryption techniques.'\n\nIn that regard, any strong and widely recognised encryption techniques can be used to safeguard the confidentiality and the integrity for the exchange of data.\n\nAccordingly, an ASPSP that has indicated a particular encryption technique in documentation of the technical specification of the application programming interface (API) that meets the requirements of Article 35(1), would not be required to provide all strong and widely recognised encryption techniques.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7376)\n\n## Related Level 1 articles\n\n- [Article 97 — Authentication](../../../articles/97.md)\n"}