Pursuant to Article 97 (1)(b) Directive 2015/2366/EU (PSD2), Member States shall ensure that a payment service provider applies strong customer authentication (SCA) when the payer initiates an electronic payment transaction. As stated in Q&A 2018_4031, card-based payment transactions are considered as payment transactions initiated by the payer through the payee and thus fall under Article 97(1)(b) PSD2.

Recital 95 of PSD2 clarifies that “There does not seem to be a need to guarantee the same level of protection to payment transactions initiated and executed with modalities other than the use of electronic platforms or devices, such as paper-based payment transactions, mail orders or telephone orders.” 

Accordingly, remote non-electronic payment transactions that are initiated and executed via a mail order or telephone order can be considered out of scope of the SCA requirement. Therefore, as card-based payment transactions qualify as electronic payment transactions, card-based transactions initiated by the payer through the payee cannot be considered out of scope of the SCA requirement.

Disclaimer:

The answers clarify provisions already contained in the applicable legislation. They do not extend in any way the rights and obligations deriving from such legislation nor do they introduce any additional requirements for the concerned operators and competent authorities. The answers are merely intended to assist natural or legal persons, including competent authorities and Union institutions and bodies in clarifying the application or implementation of the relevant legal provisions. Only the Court of Justice of the European Union is competent to authoritatively interpret Union law. The views expressed in the internal Commission Decision cannot prejudge the position that the European Commission might take before the Union and national courts.