EBA · 2018_4342 Final Q&A

Chip and Signature cards and their inclusion in the remit of RTS Article 11

Regulation
Directive 2015/2366/EU (PSD2)
Article
98, para. 4
Topic
Strong customer authentication and common and secure communication (incl. access)
Submitted by
Credit institution
Submitted
2018-10-24
Answered
2021-04-09
Answer provided by
ESAs (EBA, ESMA, EIOPA)
Browse PSD2 Register → More Q&As on this regulation →

Question

Is cardholder signature a strong method of authentication when transacting with card present? If so, is there a requirement to ensure that on Chip and Signature cards we step up to signature from contactless after 5 contactless /cumulative value of 150 euros? If a signature is not considered to be strong customer authentication (SCA), are chip and signature cards exempt from SCA requirements under Article 11 of the RTS on strong customer authentication and secure communication?

Background

Chip and Signature cards are generally issued to cardholders who have trouble remembering PIN/entering PIN on a key pay etc. These are typically customers who are vulnerable/have disabilities. Forcing them to use PIN at terminals (aside from ATMs) may be considered discrimination. Forcing customers to step up from contactless to signature is also a bad customer journey especially if the terminal is not attended e.g self servce in a supermarket.

Answer

Q&A 2018_4237 clarifies that a signature on a paper slip cannot be considered a valid factor in a two-factor strong customer authentication (SCA) under Directive 2015/2366/EU (PSD2) and the Commission Delegated Regulation (EU) 2018/389 for approaches currently observed in the market. Accordingly, while the exemption under Article 11 of the Delegated Regulation may be used for card-based payment transactions relying on chip and signature on a paper slip, provided that the respective thresholds are met, it would not be possible to apply SCA by using the chip and a signature only after the thresholds have been reached. In this case, the issuer of the payment card would need to ensure that other forms of authentication compliant with the requirements of PSD2 and the Delegated Regulation are applied.

Original source: European Banking Authority, Q&A ID 2018_4342

This Q&A is published by European Banking Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.

Similar Q&As

Signature on a paper slip from a payment terminal, as a factor in a two-factor SCA

Answered 2020-05-15

Contactless counting

Answered 2019-10-11

Signature performed on the screen of a digital device as a factor in a two-factor SCA

Answered 2018-12-21

Contactless payments at point of sale - Applications of the conditions

Answered 2019-02-08

Legal requirements for the authentication procedure when SCA exemptions are applied for remote payment transactions

Answered 2021-04-09

More Q&As on this topic

Definition of "equivalent authentication procedure" for journeys initiated from a mobile application

Answered 2026-06-12

Obstacle assessment of a mandatory client segment selection screen in a redirection journey

Answered 2026-06-12

Clarification of the scope of the term "authentication procedures" in the context of the RTS and the EBA Opinion on obstacles

Answered 2026-06-12

SCA exception for Contactless only terminals (SoftPOS) in case of emergency

Answered 2025-10-03

the use of strong and widely recognized encryption techniques

Answered 2025-10-03

📋 Track EU financial regulation continuously

Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.

Start free trial → Learn more

14-day free trial. No credit card required.