EBA · 2018_4226 Final Q&A

Contactless payments at point of sale - Applications of the conditions

Regulation
Directive 2015/2366/EU (PSD2)
Article
97
Topic
Strong customer authentication and common and secure communication (incl. access)
Submitted by
Credit institution
Submitted
2018-09-05
Answered
2019-02-08
Answer provided by
ESAs (EBA, ESMA, EIOPA)
Browse PSD2 Register → More Q&As on this regulation →

Question

What activity can be considered a proper application of strong customer authentication according to the Article 11 Paragraph b of the Commission Delegated Regulation (EU) 2018/389?

Background

We need to specify list of activities which are able to reset 150 € limit or 5 transaction limit for the card. Currently, we allow contactless transactions without strong authentication (PIN) for a cumulative limit of xxx € for x-days period (no CVM). This limit is divided into two parts.First part is dedicated for the offline authorizations (in chip), when this limit is exceeded, the online authorization (in our host) is required, where the second part of this limit is set (online). When the maximum amount for the offline authorizations is exceeded, the authorization (such as contactless payment) is declined. In such a case client gets a standard decline message which does not contain any information on why was the transaction declined nor that it is still possible to authorize the transaction as a contact transaction (with a PIN).

Answer

The exemption under Article 11 of the Commission Delegated Regulation (EU) 2018/389 applies to contactless electronic payment transactions at point of sale, where strong customer authentication (SCA) does not apply. When the cumulative monetary amount or the maximum number of transactions without SCA is reached, the limit will be reset at the next non-remote payment transaction, contactless or not, where SCA is applied. This means that the counter could be reset either at a point of sale or an ATM transaction. The application of SCA for a remote transaction would not reset this limit. In addition, as clarified in paragraph 43 of the EBA Opinion on the implementation of the RTS on Strong customer authentication and secure communication, “the cumulative limit is either the limit based on the number of transactions or the monetary amount (but not both)”.

Original source: European Banking Authority, Q&A ID 2018_4226

This Q&A is published by European Banking Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.

Similar Q&As

Contactless payments at point of sale - Applications of the conditions

Answered 2019-10-11

Applicability of the low-value contactless exemption to contactless-only devices

Answered 2019-01-11

Application of limits for Strong customer authentication (SCA) exemption

Answered 2019-10-11

Contactless counting

Answered 2019-10-11

SCA exception for Contactless only terminals (SoftPOS) in case of emergency

Answered 2025-10-03

More Q&As on this topic

Definition of "equivalent authentication procedure" for journeys initiated from a mobile application

Answered 2026-06-12

Obstacle assessment of a mandatory client segment selection screen in a redirection journey

Answered 2026-06-12

Clarification of the scope of the term "authentication procedures" in the context of the RTS and the EBA Opinion on obstacles

Answered 2026-06-12

SCA exception for Contactless only terminals (SoftPOS) in case of emergency

Answered 2025-10-03

the use of strong and widely recognized encryption techniques

Answered 2025-10-03

📋 Track EU financial regulation continuously

Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.

Start free trial → Learn more

14-day free trial. No credit card required.