SMS OTP and credit card as a two authentication factor

Paragraph 35 of the EBA Opinion on the Implementation of the RTS on SCA and CSC (EBA-Op-2018-04 ), stated that the card details and security code printed on the card would not constitute a knowledge element. In addition, while a card with a dynamic card security code may constitute a possession element, it would not constitute a knowledge element. Table 2 of the EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06) , notes that a Card with possession evidenced by either card details (printed on the card) or by a printed element (such as an OTP list) is not a compliant ‘possession’ element, for approaches currently observed. In relation to the above, card details cannot be used as a valid factor in a two-factor Strong Customer Authentication (SCA) under Directive 2015/2366/EU (PSD2) and the Commission Delegated Regulation (EU) 2018/389 . With regard to the SMS OTP, as clarified in Q&A 2018_4039 a one-time password sent via SMS would constitute a possession element and should therefore comply with the requirements under Article 7 of the Delegated Regulation. This was also reflected in Table 2 of the EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06) .