{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-05-19","gaps":[],"covered":["EBA Q&A 2025_7678 — Q&A — Clarification on the use of PSU-linked tokens [Rejected question] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2025-7678-clarification-on-the-use-of-psu-linked-tokens-in-payment","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7678-clarification-on-the-use-of-psu-linked-tokens-in-payment","title":"EBA Q&A 2025_7678 — Q&A — Clarification on the use of PSU-linked tokens [Rejected question]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2025-7678-clarification-on-the-use-of-psu-linked-tokens-in-payment","status":"rejected question","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 19 May 2026","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7678","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"a2c111d945e1ee76","change_date":null,"nearest_versions":["2026-05-19"],"first_text_date":null,"correction_applies":false,"versions":["2026-05-19"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7678-clarification-on-the-use-of-psu-linked-tokens-in-payment/versions/2026-05-19","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7678-clarification-on-the-use-of-psu-linked-tokens-in-payment/versions/2026-05-19/rev/a2c111d945e1ee76","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7678-clarification-on-the-use-of-psu-linked-tokens-in-payment/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2025-7678-clarification-on-the-use-of-psu-linked-tokens-in-payment/relations","source_line":"Question published in the EBA Q&A tool · no answer · not legislation · published 19 May 2026 [Rejected question]","attribution":{"prepared_by":"not stated in the document","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_question","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2026-05-19","question_submitted_on":"2025-12-30","locators":{"published_on":"EBA Q&A register entry 2025_7678, field 'Rejected publishing date'","question_submitted_on":"EBA Q&A register entry 2025_7678, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7678","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2025-7678-clarification-on-the-use-of-psu-linked-tokens-in-payment.md","body_sha256":"b9f9f0f698682ab1853389d773a41441fb2e91556cf029516e73178289182562"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2025_7678 — Q&A — Clarification on the use of PSU-linked tokens [Rejected question]\"\nshortTitle: \"EBA Q&A 2025_7678 — Q&A — Clarification on the use of PSU-linked tokens [Rejected question]\"\nanswer_id: EBA_QA_2025_7678\nstatus: \"Rejected question\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: withdrawn\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"PSD2\"\ndate: 19 May 2026\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7678\nlifecycle: \"Rejected question\"\ntext_version: \"EBA Q&A register, 19 May 2026\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7678\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"not stated in the document\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Other\"\n    locator: \"EBA Q&A register entry 2025_7678: no answer; the register names only the 'Type of submitter'\"\ndocument_type: \"qa_question\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2026-05-19\"\n  question_submitted_on: \"2025-12-30\"\n  locators:\n    published_on: \"EBA Q&A register entry 2025_7678, field 'Rejected publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2025_7678, field 'Submission date'\"\nlifecycle_label: \"Rejected question\"\n---\n\n**Question published in the EBA Q&A tool · no answer · not legislation · published 19 May 2026 [Rejected question]**\n\n*Rejected question · EBA Q&A register, 19 May 2026 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7678)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2025_7678 — Q&A — Clarification on the use of PSU-linked tokens \\[Rejected question\\] |\n| **Prepared by** | Not stated in the document |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2025_7678 |\n| **Document type** | Q&A |\n| **Legal nature** | No answer · not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 19 May 2026; question submitted 30 December 2025 |\n| **Legal basis** | PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Clarification on the use of PSU-linked tokens in payment initiation services under the RTS**\n\n### Question\n\nIn the context of payment initiation services, we would appreciate clarification from the EBA as to whether an ASPSP may require a PISP to use a specific token replacing the PSU’s online banking credentials, and whether such token must be reused by the PISP across the different stages of the payment order, in particular at the payment initiation stage and for subsequent query following the execution of the payment order. Furthermore, we would welcome clarification on the conditions under which this practice would be compatible with the provisions of Commission Delegated Regulation (EU) 2018/389.\n\n### Background\n\nSome ASPSPs, following the initial authentication of the PSU, issue tokens that are persistently linked to a specific PSU rather than being tied to a specific payment order. This operational approach raises significant security risks and introduces unnecessary operational complexity for PISPs, as it requires them to store and manage such tokens for reuse in subsequent stages of the payment initiation process and to transmit them in successive interactions with the ASPSP.\n\nFrom the perspective of Commission Delegated Regulation (EU) 2018/389, this practice is particularly problematic, as authentication mechanisms and personalised security credentials are required to be strictly linked to a specific payment transaction, including its amount and payee, in accordance with the dynamic linking principle set out in Article 5. In this respect, the issuance of long-lived tokens linked to the PSU, rather than to a specific payment order, may undermine the requirements for Strong Customer Authentication (SCA), as it enables the initiation of new payment orders on behalf of the PSU, during the validity period of the token, without the PSU being required to undergo a new strong authentication process.\n\nFurthermore, the use of tokens that, in practice, replicate the functionality of the PSU’s online banking credentials may conflict with Articles 30 and 36 of the Delegated Regulation, insofar as it facilitates ongoing access or the initiation of payment transactions without transaction-specific authentication and without the explicit involvement of the PSU. This increases the risk of misuse, weakens the PSU’s control over payment transactions, and may be considered incompatible with the security and consumer protection objectives underpinning the PSD2 regulatory framework.\n\n***\n\n### Answer\n\nThis question has been rejected because the matter it refers to is already covered in the answer to Q&A 7261.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2025_7678)\n"}