Article 13(2) of the Commission Delegated Regulation (EU) 2018/389 states that where the payee is on ‘a’ list of trusted beneficiaries previously created by the payer, strong customer authentication (SCA) may not apply. Further, Article 13(1) of the Delegated Regulation states that SCA applies where the payer creates or amends the list through the payer’s account servicing payment service provider (ASPSP). Article 13 refers to ‘a’ list and ‘the payer’. Under Article 4(8) of PSD2, ‘payer’ is defined as “a natural or legal person who holds a payment account and allows a payment order from that payment account, or, where there is no payment account, a natural or legal person who gives a payment order”. Accordingly, the list would refer to the one created by each account holder.

The exemption should be applied on an account by account basis. Nevertheless, the decision whether a list of trusted beneficiaries applies to more than one account and the corresponding process of authentication, will depend upon the agreement between the ASPSP and the payment service user. Where a power of attorney (PoA) is in place, the list to be considered is that of the payer on whose behalf the PoA holder is acting.

In the event of a joint account each account holder may have its own trusted beneficiary list. In this case, the list to be considered should be the list of the acting account holder at the time the payment is initiated. It is for the contract between the payment service users (PSU) and the ASPSP to determine whether it is possible or not to have a different trusted beneficiary list for each account holder or group of account holders using the account.