Data authentication standards

The authentication of the payment card based on combined data authentication (CDA) and dynamic data authentication (DDA), as currently observed in the market, could meet the requirements of the elements categorised as possession under Article 7 of the  Commission Delegated Regulation (EU) 2018/389   for non-remote card-based payment transactions.  Moreover, CDA and DDA can be used for the generation of the authentication code, which should be compliant with the requirements of Article 4 of the Delegated Regulation. In line with the requirements of the Delegated Regulation, issuers should identify in their solutions which messages/data fields (or a combination of them) generate the “authentication code” and the dynamic element to prove the possession. In addition, as clarified in Table 3 of the EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06) , a static PIN could constitute a ‘knowledge’ element. It should be noted that card set-ups designed by issuers, other than those relying on CDA/DDA, could be compliant with the requirements of the Delegated Regulation. Finally, it should be noted that it is for each payment service provider to identify which are the authentication elements and authentication codes of their solutions and to prove that they meet the requirements of the Delegated Regulation.