EBA · 2019_4693 Final Q&A

Scope of the corporate SCA exemption.

Regulation
Directive 2015/2366/EU (PSD2)
Article
98, para. 1
Topic
Strong customer authentication and common and secure communication (incl. access)
Submitted by
Other
Submitted
2019-05-02
Answered
2019-06-14
Answer provided by
ESAs (EBA, ESMA, EIOPA)
Browse PSD2 Register → More Q&As on this regulation →

Question

Does the corporate SCA exemption apply only if the payer initiates (and transmits) payments directly to their ASPSP and not for payments transmitted via a 3rd party service provider (i.e. a PISP)?

Background

Prior to the application of PSD2, in the corporate banking space many Payment Initiation Service Providers (PISPs) offered multi-banking services to corporates (e.g. via a browser front end or mobile app). These PISPs connected to the AISP via 'secure corporate payment processes and protocols' such as SWIFTNet, the Electronic Internet Banking Communication Standard (EBICS) or via 'host-to-host' protocols such as Secure FTP (SFTP). Many of these PISPs may choose to retain their existing connections as opposed to migrating to a new XS2A API. The text of the PSD2 directive does not appear to distinguish between PISPs that connect to ASPSP's via a certified PSD2 dedicated interface (XS2A API's) and those that connect via other dedicated 'secure corporate payment processes and protocols'. The text of Article 17 refers to "the use of dedicated payment processes or protocols that are only made available to payers who are not consumers". There is no mention of PISP's using these 'dedicated payment processes or protocols' in this article.

Answer

‘Payment initiation’ as a process in Article 17 of the Commission Delegated Regulation (EU) 2018/389  is not to be confused with payment initiation services; the latter referring to a payment that is initiated by a third party. Further, in accordance with Article 66(1) of PSD2, a payer has the right to make use of a payment initiation service provider (PISP) to initiate a payment. In the case where a payer uses a PISP to initiate a payment, as clarified in paragraph 39 of the EBA Opinion on the implementation of the RTS on strong customer authentication and secure communication (EBA-Op-2018-04) , it is the responsibility of the account servicing payment service provider (ASPSP) to identify whether or not an exemption applies, including the exemption under Article 17 of the Delegated Regulation.

Original source: European Banking Authority, Q&A ID 2019_4693

This Q&A is published by European Banking Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.

Similar Q&As

Applicability of exemption under RTS Article 16 for payee’s PSPs (acquirers)

Answered 2019-10-11

Obligatory nature of the SCA and exemption based on transaction risk analysis

Answered 2018-10-19

Applicability of exemption under RTS Article 11 for payee’s PSPs (acquirers)

Answered 2019-10-11

Exemption of secure corporate payment processes and protocols

Answered 2021-02-26

Application of the exemption under Article 10 RTS and EBICS T

Answered 2022-04-13

More Q&As on this topic

Definition of "equivalent authentication procedure" for journeys initiated from a mobile application

Answered 2026-06-12

Obstacle assessment of a mandatory client segment selection screen in a redirection journey

Answered 2026-06-12

Clarification of the scope of the term "authentication procedures" in the context of the RTS and the EBA Opinion on obstacles

Answered 2026-06-12

SCA exception for Contactless only terminals (SoftPOS) in case of emergency

Answered 2025-10-03

the use of strong and widely recognized encryption techniques

Answered 2025-10-03

📋 Track EU financial regulation continuously

Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.

Start free trial → Learn more

14-day free trial. No credit card required.