EBA · 2018_4400 Final Q&A

Secure corporate payment processes and protocols

Regulation
Directive 2015/2366/EU (PSD2)
Article
98, para. 1
Topic
Strong customer authentication and common and secure communication (incl. access)
Submitted by
Credit institution
Submitted
2018-12-04
Answered
2019-06-14
Answer provided by
ESAs (EBA, ESMA, EIOPA)
Browse PSD2 Register → More Q&As on this regulation →

Question

Are USB drives (containing a certificate) used only by corporate clients compatible with RTS requirements? Can USB drives be considered as payment processes exempted from strong customer authentication ?

Background

Article 17 of the RTS on strong customer authentication and common secure communication creates an exemption from strong customer authentication based on the Secure corporate payment processes and protocols. PSPs are allowed not to apply SCA, in respect of legal persons initiating electronic payment transactions through the use of dedicated payment processes or protocols that are only made available to payers who are not consumers. The question arises because there is no dynamic link (mandatory according to Article 5 of the RTS) in this process. An X.509 certificate is a digital certificate that uses the widely accepted international X.509 public key infrastructure (PKI) standard to verify that a public key belongs to the user, computer or service identity contained within the certificate. In our bank, the certificate (hosted in a USB key) is intended exclusively for a payers who are not consumers.

Answer

Article 17 of the Commission Delegated Regulation (EU) 2018/389 states that “Payment service providers shall be allowed not to apply strong customer authentication, in respect of legal persons initiating electronic payment transactions through the use of dedicated payment processes or protocols that are only made available to payers who are not consumers, where the competent authorities are satisfied that those processes or protocols guarantee at least equivalent levels of security to those provided [in PSD2]”. This article refers to “the use of dedicated payment processes or protocols” to “initiate electronic payment transactions” but does not refer to a process used to carry out a specific element that may be required for the purpose of payment initiation, such as the authentication of the payment service user, for instance using an USB certificate.

Original source: European Banking Authority, Q&A ID 2018_4400

This Q&A is published by European Banking Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.

Similar Q&As

Exemption for secure corporate payment processes and protocols

Answered 2019-06-07

Exemption of secure corporate payment processes and protocols

Answered 2021-02-26

Applicability of exemption from strong customer authentication (SCA) under Article 17 for card payments

Answered 2018-12-14

Legal requirements for the authentication procedure when SCA exemptions are applied for remote payment transactions

Answered 2021-04-09

Transport and parking exemption for parking and electric vehicle charging

Answered 2021-01-15

More Q&As on this topic

Definition of "equivalent authentication procedure" for journeys initiated from a mobile application

Answered 2026-06-12

Obstacle assessment of a mandatory client segment selection screen in a redirection journey

Answered 2026-06-12

Clarification of the scope of the term "authentication procedures" in the context of the RTS and the EBA Opinion on obstacles

Answered 2026-06-12

SCA exception for Contactless only terminals (SoftPOS) in case of emergency

Answered 2025-10-03

the use of strong and widely recognized encryption techniques

Answered 2025-10-03

📋 Track EU financial regulation continuously

Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.

Start free trial → Learn more

14-day free trial. No credit card required.