SCA for token replacement
Is SCA required for the replacement of a tokenized card happening in the background without any ‘action by the payer’ under Article 97(1)(c) PSD2 in the following cases:
Expiry of the token and update of the token
Replacement of the card, and the new card has a different BIN/Account Range (e.g., for product graduation, such as standard to gold, or simple BIN management) and/or different functionalities
Technical and/or configuration changes to the issuer’s BIN configuration (such as migrating from 6 to 8 digit BINs)
In all these cases, the existing tokenized credentials have been initially associated with SCA to the user under Article 24(2)(b) RTS, and this is solely a technical replacement of the token.
credentials have been initially associated with SCA to the user under Article 24(2)(b) RTS, and this is solely a technical replacement of the token.
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2022_6464 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 24/05/2022 |
Date of publication: 31/01/2023
SCA applicability / Application of SCA at tokenisation stage
Does the authentication to unlock the mobile device count as one of the elements of strong customer authentication when a payment service user is tokenising a card on an e-wallet solution such as Apple Pay?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2021_6145 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 31/08/2021 |
Date of publication: 31/01/2023
Application of SCA to issuing a payment instrument and tokenisation
Is strong customer authentication (SCA) required when a Payment Service Provider (PSP) issues a payment instrument or creates a token?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2020_5622 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 16/11/2020 |
Date of publication: 31/01/2023
Authentication procedures that ASPSPs’ interfaces are required to support (using re-direction)
In a pure redirection-based approach, can an ASPSP, which is not offering a mobile web browser to its PSU’s, decide not to support an authentication via a mobile web browser authentication page (no app-to-mobile web browser or mobile web browser-to-mobile web browser redirection) for PISPs/AISPs on the basis of duly justified security risks, without being considered a breach of Article 97 (5) PSD2 and Article 30(2) of the RTS on SCA and CSC and/or an obstacle under Article 32(3) of the RTS on SCA and CSC?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2021_6321 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 20/12/2021 |
Date of publication: 27/01/2023
Application of SCA for confirmation of funds requests made by a PISP
1) Should two SCAs be applied when a fund confirmation is made by a PISP? i.e. one for fund confirmation and one for payment initiation?
2) Should ASPSPs provide confirmation to a CoF request made by a PISP before or after the payment is submitted?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2021_6280 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 16/11/2021 |
Date of publication: 27/01/2023
Arbitrating between security and obstacles
Can an Account Servicing Payment Service Provider (ASPSP) know a mobile phone number inside of the Third Party Provider (TPP)’s organisation in order to send a decryption password to the TPP out-of-band via SMS?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2021_6156 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 01/09/2021 |
Date of publication: 27/01/2023
Ability of Payee’s PSP to apply exemptions from SCA in credit transfers
Can the Payee’s Payment Services Provider (PSP) apply an exemption from strong customer authentication (SCA) in credit transfers that are initiated through the payee?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2021_5845 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 12/05/2021 |
Date of publication: 27/01/2023
Transactions initiated via electronic mail (email)
Do transactions initiated via electronic mail (email) qualify as initiations pursuant to Article 97 para. 1 (b) PSD2 and are therefore subject to the RTS SCA requirements?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2021_6315 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 15/12/2021 |
Date of publication: 06/01/2023
Change of TPP access rights for AIS consent by the PSU prior to authorisation
A clarification / harmonised guidance on the Scope of the Bank Offered Consent, as defined in the Berlin Group standard, is needed.
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2021_6246 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 19/10/2021 |
Date of publication: 14/10/2022
Future-dated payments and recurring transactions
When it comes to recurring transactions and future-dated payments, would an implementation of the PSD2-interface that requires that the TPPs store the payment details until due date, and not until due date are they allowed to send the transactions to the ASPSP for execution, satisfy the requirements in Opinion on the implementation of the RTS on SCA and SCA (EBA-Op-2018-04) of June 13, 2018' paragraph 29, in cases where the ASPSP itself offers future-dated payments and recurring transactions in their mobile/web-bank application?
If the answer to the preceding question is yes, what then is the meaning of the statement '… a PISP has the right to initiate the same transactions that the ASPSP offers to its own PSUs, such as … recurring transactions, … and future-dated payments'?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2021_6318 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 16/12/2021 |
Date of publication: 14/10/2022
API functionality
Is it allowed to use a dedicated PSD2 interface by a TPP that identifies itself with an eIDAS certificate for purposes other than those specified in Article 30(1)(b) - (c) of the RTS on strong customer authentication (SCA) and secure communication?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2022_6392 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 10/03/2022 |
Date of publication: 14/10/2022
Clarification of remote payment for dynamic linking
Is a SEPA Credit Transfer (SCT) transaction, whereby a user mobile phone interacts locally via Near Field Communication (NFC) with a merchant payment terminal to initiate the SCT transaction, whereby the user mobile phone does not communicate remotely over a mobile network for this purpose but whereby the payment terminal connects on-line to a payment system and handles the required strong customer authentication (SCA) through this on-line channel, considered an electronic remote payment transaction?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2020_5247 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 12/05/2020 |
Date of publication: 13/04/2022
Payment Initiation Service - Batch payment / bulk payment
Can you apply the PSD2 non-discrimination principle to batch/bulk payment?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2021_6236 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 12/10/2021 |
Date of publication: 13/04/2022
Application of the exemption under Article 10 RTS and EBICS T
Can an Account Servicing Payment Service Provider (ASPSP) consider that it is not applying the Article 10 Exemption under the Commission Delegated Regulation (EU) 2018/389 “at all” where it permits its Payment Services Users (PSUs) to access balances and transactions information through another direct interface (such as Electronic Banking Internet Communication Standard (EBICS) T) with no systematic or daily strong customer authentication (SCA)?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2021_6235 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 12/10/2021 |
Date of publication: 13/04/2022
Re-engineering by TPP of the ASPSP’s redirect API and PSU customer journey
May a Payment Initiation Services Provider (PISP) connect to the dedicated interface of the ASPSP, only to subsequently embed (“screen scrape”) the redirection approach into their own environment, without redirecting the PSU to the ASPSP’s mobile banking app, for authentication?
Are Third-Party Providers (TPPs) allowed to re-engineer the customer journey designed by the ASPSP to the effect that authentication of the PSU will take place in the TPP domain?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2021_6044 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 21/06/2021 |
Date of publication: 13/04/2022
SCA requirements with dynamic linking for mobile initiated credit transfers (MSCTs)
Can mobile initiated credit transfers (MSCT) solutions whereby a proximity technology (e.g. NFC, QR-code, BLE, etc.) is used for the exchange of payer identification data between the payer’s mobile device and the payee’s payment terminal but a mobile network is used (e.g. by a dedicated app) on the payer’s mobile device for the payer authentication, be considered as a proximity payment whereby strong customer authentication (SCA) may apply without requiring dynamic linking?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2020_5367 |
Topic: Other topics |
Date of submission: 14/07/2020 |
Date of publication: 13/04/2022
Individual's name to return in AISP/PISP calls
Is the name returned in an Account Information Service Provider (AISP) / Payment Initiation Service Provider (PISP) call expected to be that of the Payment Service User (PSU) who has initiated the transaction with the Third Party Provide (TPP), or of the actual account owner/holder?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2020_5165 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 09/03/2020 |
Date of publication: 18/03/2022
Mount unattended contactless device on general goods vending machines
With the limits described in Articles 11 and 16 of the Regulatory Technical Standards on strong customer authentication and secure communication under Directive 2015/2366/EU (PSD2), could a vendor mount an unattended "contactless only" device without pinpad on a general goods vending machine?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2020_5288 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 03/06/2020 |
Date of publication: 11/03/2022
Definition of an electronic remote payment transaction
What are the demarcation criteria of the term „remote payment transaction“, which is an essential term in the RTS on SCA and CSC?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2019_4594 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 04/03/2019 |
Date of publication: 21/01/2022
SCA for staff assisted electronic channel
Please clarify where a customer is physically present and identified in branch, the strong customer authentication (SCA) requirements if that customer completes a Standing Order instruction (Setup, Amend or Cancel) or initiates a credit transfer through a staff assisted electronic channel (i.e. tablet device)?
Legal act: Directive 2015/2366/EU (PSD2)
COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
ID: 2020_5124 |
Topic: Strong customer authentication and common and secure communication (incl. access) |
Date of submission: 13/02/2020 |
Date of publication: 21/01/2022
