Application of limits for Strong customer authentication (SCA) exemption

The  Commission Delegated Regulation (EU) 2018/389  does not specify how payment service providers (PSPs) should apply the counters for the purpose of deciding whether an exemption under Articles 11 and 16 of the Delegated Regulation may apply or not. The  EBA Opinion on the implementation of the regulatory technical standards on strong customer authentication and common and secure communication, EBA-Op-2018-04 , states in paragraph 43 that “it may be preferable for PSPs to decide at the outset which cumulative limit they use (rather than on a transaction-by-transaction basis), as it may otherwise be confusing for consumers”. This has also been clarified in  Q&A 2018_4225 . Nevertheless, in the event that PSPs decide to apply the exemptions on a transaction-per-transaction basis, they would need to simultaneously check whether either of the limits under Article 11(b) and Article 11(c) of the Delegated Regulation (or Article 16(b) and Article 16(c) respectively) has been reached and apply strong customer authentication (SCA) as soon as either or both limits are reached. The application of the exemptions under Articles 11 and 16 is without prejudice to the possibility for PSPs, based on their fraud management procedures, to request the application of SCA before any of the limits is reached.