Question ID:
Legal Act:
Directive 2015/2366/EU (PSD2)
Strong customer authentication and common and secure communication (incl. access)
COM Delegated or Implementing Acts/RTS/ITS/GLs/Recommendations:
Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
Disclose name of institution / entity:
Type of submitter:
Credit institution
Subject Matter:
Contactless payments at point of sale - Applications of the conditions

With respect to Article 11 Paragraph b) of the RTS can we setup control for either 150 € or 5 transactions?

Background on the question:

We understand Paragraph b) in a way that it is possible for us (credit instituttion) to choose whether to control 150 € limit or 5 transactions limit or both of them. We consider that these levels are set individually per each card separatelly.

Does this mean that if we apply the limit for 5 transactions, the client is able to make transactions above 150 € without SCA, as long as its done in 5 or less transactions? Similarly, could the client perform more than 5 transactions if they are all below 150 €?

Date of submission:
Published as Final Q&A:
EBA Answer:

Paragraph 43 of the EBA Opinion on the implementation of the Commission Delegated Regulation (EU) 2018/389 [RTS on Strong customer authentication and secure communication] (EBA-Op-2018-04) explains that the cumulative limit set in Articles 11 and 16 of the  Commission Delegated Regulation (EU) 2018/389 “is either the limit based on the number of transactions or the monetary amount (but not both)”.

Consequently, it is possible to make cumulative transactions above €150 under Article 11 (or €100 under Article 16 respectively) without the application of strong customer authentication (SCA) if less than five transactions have been made after the last application of SCA; conversely, it is possible to perform more than 5 transactions without SCA if the sum of all these transactions is below 150 € under Article 11 (or €100 under Article 16 respectively).

The EBA Opinion further states that “this means that it may be preferable for payment service providers (PSPs) to decide at the outset which cumulative limit they use (rather than on a transaction-by-transaction basis”. Consequently, the PSP may decide at the outset whether it will apply:

  1. the cumulative monetary limit of €150 under Article 11 (€100 under Article 16), in which case the number of transactions could exceed 5, and apply it consistently for all transactions; or
  2. the limit based on the number of transactions, in which case the amount of the transactions could exceed €150 (€100 under Article 16), and apply it consistently for all transactions.

In addition, as clarified in Q&A 2018_4182, PSPs may decide to apply these exemptions on a transaction-per-transaction basis, in which case the PSP would apply the exemption when either or both of the limits under (i) and/or (ii) above are reached.

The application of the exemptions under Articles 11 and 16 is without prejudice to the possibility for PSPs, based on their fraud management procedures, to request the application of SCA before any of the limits is reached.

Final Q&A
Answer prepared by:
Answer prepared by the EBA.