<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2025-10-03","gaps":[],"covered":["EBA Q&A 2025_7482 — Q&A — SCA exception for Contactless only terminals (SoftPOS) [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2025-7482-sca-exception-for-contactless-only-terminals-softpos-in","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7482-sca-exception-for-contactless-only-terminals-softpos-in","title":"EBA Q&A 2025_7482 — Q&A — SCA exception for Contactless only terminals (SoftPOS) [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2025-7482-sca-exception-for-contactless-only-terminals-softpos-in","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 3 October 2025","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7482","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"626a91beab89f1d4","change_date":null,"nearest_versions":["2025-10-03"],"first_text_date":null,"correction_applies":false,"versions":["2025-10-03"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7482-sca-exception-for-contactless-only-terminals-softpos-in/versions/2025-10-03","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7482-sca-exception-for-contactless-only-terminals-softpos-in/versions/2025-10-03/rev/626a91beab89f1d4","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7482-sca-exception-for-contactless-only-terminals-softpos-in/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7482-sca-exception-for-contactless-only-terminals-softpos-in/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 3 Oct 2025 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2025-10-03","question_submitted_on":"2025-06-13","locators":{"published_on":"EBA Q&A register entry 2025_7482, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2025_7482, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2025_7482 — Q&A — SCA exception for Contactless only terminals (SoftPOS) [Final Q&A]"
shortTitle: "EBA Q&A 2025_7482 — Q&A — SCA exception for Contactless only terminals (SoftPOS) [Final Q&A]"
answer_id: EBA_QA_2025_7482
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 97 PSD2"
date: 3 October 2025
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7482
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 3 October 2025"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7482"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2025_7482, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2025-10-03"
  question_submitted_on: "2025-06-13"
  locators:
    published_on: "EBA Q&A register entry 2025_7482, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2025_7482, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 3 Oct 2025 [Final Q&A]**

*Final Q&A · EBA Q&A register, 3 October 2025 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7482)*

| | |
|---|---|
| **Full title** | EBA Q&A 2025_7482 — Q&A — SCA exception for Contactless only terminals (SoftPOS) \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2025_7482 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 3 October 2025; question submitted 13 June 2025 |
| **Legal basis** | Article 97 PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**SCA exception for Contactless only terminals (SoftPOS) in case of emergency**

### Question

We are in the process of developing a backup solution for our SoftPOS terminal application, intended for use during exceptional circumstances such as cyber-attacks or other disruptions to internet connectivity and acquirer systems.

As SoftPOS terminals operate exclusively with contactless transactions, and contactless transactions does not support Offline PIN, it is technically not possible to perform Strong Customer Authentication (SCA) in offline mode.

We would like to confirm whether, under these conditions, it is acceptable to process offline contactless transactions without applying SCA and follow Directive (EU) 2015/2366 article 0 (15)

### Background

In Denmark, as well as in several other countries, legislative efforts are underway that will require all payment solutions—including SoftPOS terminals—to support offline processing.

To comply with the upcoming regulations, we must ensure that offline processing is supported, regardless of the authentication methods available.

***

### Answer

Article 97(1)(b) of Directive 2015/2366/EU (PSD2) prescribes that the payment service provider (PSP) shall apply ‘strong customer authentication (SCA) where the payer initiates an electronic payment transaction’.

Therefore, in the case where the payer initiates an electronic card-based payment transaction at a Software Point of Sale (POS), the issuer shall apply Strong Customer Authentication (SCA) to that transaction, unless an exemption from SCA applies in accordance with Articles 11– 18 of the Delegated Regulation (EU) 2018/389. Other exemptions from SCA, including for emergency situations, than those specified within the Delegated Regulation are not available.

In the specific case described by the submitter where a payment transaction is initiated at a software POS during a cyber attack or disruption to internet connectivity or acquirer's system, SCA should be applied, unless the payment transaction can be subject to an SCA exemption.

It should also be noted that, as clarified in Q&A 2018\_4055, the PIN can be transmitted and verified offline, provided that it meets the requirements of Articles 6(1), 22(1) and 22(4) of the Delegated Regulation.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7482)

## Related Level 1 articles

- [Article 97 — Authentication](../../../articles/97.md)