Article 10 of Regulation (EU) 2018/389 – RTS on strong customer authentication and secure communication provides an exemption from SCA when a PSU accesses limited payment account information that are the balance or payment transactions data on the last 90 days.

Many ASPSP's websites and TPP's applications actually show to the PSU, who accesses its payment account(s) online, payment transactions data on more than the last 90 days (meaning older data / data on payment transactions executed before).

As such, for a PSU accessing its payment accounts online (banking website for instance) without SCA :

When he/she scrolls the payment transactions and gets to older transactions (meaning here older than 90 days ago) then a SCA should be done ;
When he/she uses the search engine to look for an old transaction (meaning here older than 90 days ago) then a SCA should be done ;
When he/she uses PFM services (personal finance management) which usually show old transactions (meaning here older than 90 days ago) then a SCA should be done.

As a consequence, we note that the objective of the Article 10 - which allows PSPs, for payment account information access, to apply SCA only every 90 days – cannot be reached. With current practices of ASPSP’s websites and TPP’s websites (which show payment transactions older than 90 days ago), there is no interest for PSPs to use the SCA exemption of article 10.2.b) because with the today’s customer habits and uses (refer to the 3 examples above, the PSP will have to apply a SCA right after the PSU’s access . The requirement to consider the date of the payment transaction wipes out the purpose of applying the exemption described in Article 10.