EBA · 2018_4230 Final Q&A

Contactless transactions - SCA

Regulation
Directive 2015/2366/EU (PSD2)
Article
98
Topic
Strong customer authentication and common and secure communication (incl. access)
Submitted by
Credit institution
Submitted
2018-09-05
Answered
2019-08-09
Answer provided by
ESAs (EBA, ESMA, EIOPA)
Browse PSD2 Register → More Q&As on this regulation →

Question

Does the cumulative count / authorised sum amount apply to any contactless authorisation request, regardless if the request was approved or not?

Background

The context of the question is around the practical methodology for calculating whether or not for each contactless transaction the contactless exemption available cited in Article 11 of the RTS could be used. The questions is relevant as it raises an issue as to the practical and consistent application across the industry of the exemption.  The third of the three conditions for exemption from SCA in Article is: c) the number of consecutive contactless electronic payment transactions initiated via the payment instrument offering a contactless functionality since the last application of strong customer authentication does not exceed five. The submitted question seeks to answer whether the authorisation decision of the previous five contactless transactions affects whether they are counted or not. I.e. does 'initiated' include all attempted transactions, or only those that were authorised and approved by the issuer?

Answer

Article 11 of the Commission Delegated Regulation (EU) 2018/389 refers to the counting of contactless electronic payment transactions that have been executed.  Further, Article 11(a) specifies an individual transaction limit of €50 and Article 11(b) refers to the cumulative amount of contactless electronic payment transactions that have been debited. Accordingly, when counting the number of transactions for the purpose of the alternative cumulative limit under Article 11(c), only those transactions that have been executed need to be included. However, if a Payment Service Provider (PSP) wishes to include all authorised transactions, regardless of whether they have been executed or not, it is not prevented from so doing.

Original source: European Banking Authority, Q&A ID 2018_4230

This Q&A is published by European Banking Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.

Similar Q&As

Contactless payments at point of sale - Applications of the conditions

Answered 2019-10-11

Unsuccessful authentications and declined transactions effect on the counters of cumulative amount and number of consecutive transactions

Answered 2019-12-06

Contactless counting

Answered 2019-10-11

Contactless payments at point of sale - Applications of the conditions

Answered 2019-02-08

Applicability of the low-value contactless exemption to contactless-only devices

Answered 2019-01-11

More Q&As on this topic

Definition of "equivalent authentication procedure" for journeys initiated from a mobile application

Answered 2026-06-12

Obstacle assessment of a mandatory client segment selection screen in a redirection journey

Answered 2026-06-12

Clarification of the scope of the term "authentication procedures" in the context of the RTS and the EBA Opinion on obstacles

Answered 2026-06-12

SCA exception for Contactless only terminals (SoftPOS) in case of emergency

Answered 2025-10-03

the use of strong and widely recognized encryption techniques

Answered 2025-10-03

📋 Track EU financial regulation continuously

Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.

Start free trial → Learn more

14-day free trial. No credit card required.