Applicability of the low-value contactless exemption to contactless-only devices

Article 11 of the Commission Delegated Regulation (EU) 2018/389  (RTS on Strong customer authentication and secure communication) does not define a technical method on how the counter be reset or what device or terminal to use when performing strong customer authentication (SCA). However, Article 11 envisages two different limits, i.e. either a cumulative monetary amount or a maximum number of transactions to be met until SCA should be applied again. The requirement for payment service providers, as highlighted in paragraph 43 of the EBA Opinion on the implementation of the RTS on SCA and secure communication is to have a counter in place and to perform SCA every time the threshold has been reached, provided that such method complies with the requirements on SCA laid out in this Delegated Regulation, and in particular Articles 4 to 9. Consequently, a reset of these two limits could be effected only by an SCA that is performed with the actual payment instrument to which the exemption should apply, regardless of whether this instrument is contactless or not. This means that any out-of-band solution would need to be performed with the payment initiation through a given payment instrument. This follows from the objective of the two limits being to prevent a payment instrument with a contactless functionality that is lost or stolen, being used indefinitely. In the specific case described, this means that the out-of-band mechanism would need to enable the subsequent payment initiation that requires SCA once the limit has been reached; the mechanism could not operate independently from the payment initiation itself.