Do transactions at vending machines without PIN pad require Strong Customer Authentication (SCA)?

Transactions at vending machines without PIN pad should not require SCA.  The issuer is unable to perform SCA and can only decline transactions if the contactless exemption under Article 11 does not apply.

Recital 11 of the RTS reads: "It is also appropriate to establish an exemption for the case of electronic payment transactions initiated at unattended terminals where the use of strong customer authentication may not always be easy to apply due to operational reasons (e.g. to avoid queues and potential accidents at toll gates or for other safety or security risks).”

The same rationale of “operational reasons” should apply to transactions at vending machines.  The very low amounts of these transactions, the impossibility to apply SCA and the need for a fast purchase would justify an exemption.

Article 97(1)(b) of PSD2 states that Member States shall ensure that a payment service provider applies strong customer authentication (SCA) where the payer initiates an electronic payment transaction. This is the case for payment transactions at vending machines unless the transaction qualifies for an exemption as defined in Commission Delegated Regulation (EU) 2018/389. The Delegated Regulation defines two exemptions applicable to proximity payments, one for contactless payments at point of sale, under Article 11, and another for electronic payment transactions at unattended terminals for transport fares and parking fees under Article 12. The contactless payment exemption may apply to those vending machines where contactless payments can be used. However, the exemption under Article 12 of the Delegated Regulation only applies to ‘transport fares and parking fees’ and does not apply to vending machines providing other goods and services, such as providing the facility to buy food or beverages.

The Delegated Regulation also foresees a number of exemptions for remote payment transactions. In the case where the payment transaction is carried out remotely (e.g. initiated through a mobile phone) without any link to the physical vending machine, such transactions could be considered remote transactions and potentially benefit from other exemptions from the application of SCA under the Delegated Regulation.