Paragraph 43 of the EBA Opinion on the implementation of the Commission Delegated Regulation (EU) 2018/389 [RTS on Strong customer authentication and secure communication] (EBA-Op-2018-04) explains that the cumulative limit set in Articles 11 and 16 of the  Commission Delegated Regulation (EU) 2018/389 “is either the limit based on the number of transactions or the monetary amount (but not both)”.

Consequently, it is possible to make cumulative transactions above €150 under Article 11 (or €100 under Article 16 respectively) without the application of strong customer authentication (SCA) if less than five transactions have been made after the last application of SCA; conversely, it is possible to perform more than 5 transactions without SCA if the sum of all these transactions is below 150 € under Article 11 (or €100 under Article 16 respectively).

The EBA Opinion further states that “this means that it may be preferable for payment service providers (PSPs) to decide at the outset which cumulative limit they use (rather than on a transaction-by-transaction basis”. Consequently, the PSP may decide at the outset whether it will apply:

1. the cumulative monetary limit of €150 under Article 11 (€100 under Article 16), in which case the number of transactions could exceed 5, and apply it consistently for all transactions; or
2. the limit based on the number of transactions, in which case the amount of the transactions could exceed €150 (€100 under Article 16), and apply it consistently for all transactions.

In addition, as clarified in Q&A 2018_4182, PSPs may decide to apply these exemptions on a transaction-per-transaction basis, in which case the PSP would apply the exemption when either or both of the limits under (i) and/or (ii) above are reached.

The application of the exemptions under Articles 11 and 16 is without prejudice to the possibility for PSPs, based on their fraud management procedures, to request the application of SCA before any of the limits is reached.