Article 97(1)(b) of PSD2 states that Member States shall ensure that a payment service provider applies strong customer authentication (SCA) where the payer initiates an electronic payment transaction. This is the case for payment transactions at vending machines unless the transaction qualifies for an exemption as defined in Commission Delegated Regulation (EU) 2018/389. The Delegated Regulation defines two exemptions applicable to proximity payments, one for contactless payments at point of sale, under Article 11, and another for electronic payment transactions at unattended terminals for transport fares and parking fees under Article 12. The contactless payment exemption may apply to those vending machines where contactless payments can be used. However, the exemption under Article 12 of the Delegated Regulation only applies to ‘transport fares and parking fees’ and does not apply to vending machines providing other goods and services, such as providing the facility to buy food or beverages.

The Delegated Regulation also foresees a number of exemptions for remote payment transactions. In the case where the payment transaction is carried out remotely (e.g. initiated through a mobile phone) without any link to the physical vending machine, such transactions could be considered remote transactions and potentially benefit from other exemptions from the application of SCA under the Delegated Regulation.