{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-06-12","gaps":[],"covered":["EBA Q&A 2025_7607 — Q&A — Definition of equivalent authentication procedure [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2025-7607-definition-of-equivalent-authentication-procedure-for","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7607-definition-of-equivalent-authentication-procedure-for","title":"EBA Q&A 2025_7607 — Q&A — Definition of equivalent authentication procedure [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2025-7607-definition-of-equivalent-authentication-procedure-for","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 12 June 2026","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7607","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"6351e56e5e79eddd","change_date":null,"nearest_versions":["2026-06-12"],"first_text_date":null,"correction_applies":false,"versions":["2026-06-12"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7607-definition-of-equivalent-authentication-procedure-for/versions/2026-06-12","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7607-definition-of-equivalent-authentication-procedure-for/versions/2026-06-12/rev/6351e56e5e79eddd","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7607-definition-of-equivalent-authentication-procedure-for/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7607-definition-of-equivalent-authentication-procedure-for/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 12 Jun 2026 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2026-06-12","question_submitted_on":"2025-10-17","locators":{"published_on":"EBA Q&A register entry 2025_7607, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2025_7607, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7607","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2025-7607-definition-of-equivalent-authentication-procedure-for.md","body_sha256":"a326555c0ddb86f3ce517df79dc2feb6c8e4efc6388ccc3d50e49bf90da31866"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2025_7607 — Q&A — Definition of equivalent authentication procedure [Final Q&A]\"\nshortTitle: \"EBA Q&A 2025_7607 — Q&A — Definition of equivalent authentication procedure [Final Q&A]\"\nanswer_id: EBA_QA_2025_7607\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"PSD2\"\ndate: 12 June 2026\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7607\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 12 June 2026\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7607\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2025_7607, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2026-06-12\"\n  question_submitted_on: \"2025-10-17\"\n  locators:\n    published_on: \"EBA Q&A register entry 2025_7607, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2025_7607, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 12 Jun 2026 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 12 June 2026 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7607)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2025_7607 — Q&A — Definition of equivalent authentication procedure \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2025_7607 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 12 June 2026; question submitted 17 October 2025 |\n| **Legal basis** | PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Definition of \"equivalent authentication procedure\" for journeys initiated from a mobile application**\n\n### Question\n\nWhen a Payment Service User (PSU) initiates a service from a Third Party Provider's (TPP) mobile application, what is the correct \"equivalent authentication procedure\" of the ASPSP that should be used as the benchmark for assessing whether \"unnecessary steps\" have been added? Is it the ASPSP's mobile web browser authentication journey, or is it the ASPSP's native mobile banking application authentication journey?\n\n### Background\n\nParagraph 15 of the EBA Opinion on obstacles (EBA/OP/2020/10) prohibits ASPSPs from adding \"unnecessary steps\" to the customer journey compared to the \"equivalent authentication procedure\" offered in their direct channels.\n\nThere is a significant ambiguity in practice as to what constitutes the \"equivalent authentication procedure\" when a service is initiated from a TPP's native mobile application. Many ASPSPs possess both a mobile web browser interface and a native mobile banking application, with the latter typically offering a much more seamless and user-friendly authentication experience (e.g., using biometrics without additional steps).\n\nWhen a PSU initiates a journey from a TPP's mobile app, these ASPSPs often redirect the user to their mobile web browser journey. They then argue that any additional steps in this journey are compliant as long as they mirror the steps in their direct mobile web channel. This ignores the existence of their superior native mobile app channel. It is unclear which of the ASPSP's direct channels should serve as the correct benchmark for comparison in a mobile-to-mobile context.\n\n***\n\n### Answer\n\nArticle 32(3) of Commission Delegated Regulation (EU) 2018/389 requires account servicing payment service providers (ASPSPs) that have implemented a dedicated interface to ensure that the interface does not create obstacles to the provision of payment initiation and account information services.\n\nAs clarified in paragraphs 6, 7 and 15 of the EBA Opinion on obstacles under Article 32(3) of the RTS on SCA and CSC (EBA/OP/2020/10), the authentication procedure with the ASPSP as part of an AIS or PIS journey should not include unnecessary steps or require the payment service user (PSU) to provide unnecessary or superfluous information compared to the way in which the PSU can authenticate when directly accessing their payment accounts or initiating a payment with the ASPSP.\n\nParagraph 16 of that Opinion also clarified that if the PSU is using an AISP or PISP’s services via the AISP/PISP’s mobile app, ASPSPs that have implemented a redirection or decoupled approach and that enable their PSUs to authenticate using the ASPSP’s authentication app (a mobile banking app or a dedicated/decoupled app) to directly access their payment accounts or initiate a payment should enable that:\n\n(i) the PSU is redirected from the AISP/PISP’s app to the ASPSP’s authentication app, without any additional and unnecessary steps in-between (such as the PSU being redirected first to the ASPSP’s mobile browser environment); and that\n\n(ii) after authentication with the ASPSP, the PSU is automatically redirected back to the AISP/PISP’s app, without, for example, the PSU having to manually reopen the TPP’s app, which would be an obstacle.\n\nThe assessment of whether unnecessary steps have been added must be based on a comparison with the way in which the PSU can authenticate when directly accessing their payment account or initiating a payment with the ASPSP. Accordingly, where a PSU uses the services of an AISP/PISP via an app provided by the AISP/PISP, and the ASPSP enables direct authentication via its mobile banking application, the relevant point of comparison is the ASPSP’s mobile banking authentication procedure. In such circumstances, introducing additional steps in the AIS or PIS journey that are not part of the ASPSP’s mobile app authentication procedure may constitute an obstacle within the meaning of Article 32(3) of the RTS.\n\nBy contrast, where the PSU initiates AIS or PIS in a mobile browser environment, and the ASPSP’s authentication procedure available to PSUs is also performed via a mobile web interface, benchmarking against that mobile web authentication procedure would be appropriate.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7607)\n"}