Authentication code

Article 97(1) of Directive 2015/2366/EU (PSD2) states that payment service providers (PSPs)  “shall apply strong customer authentication (SCA) where the payer: (a) accesses its payment account online; (b) initiates an electronic payment transaction; (c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.” Adding a payment card to a digital wallet is an action which may imply a risk of payment fraud or other abuses and thus would require the application of SCA. This means that, in the case described by the submitter, the payer would need to apply SCA for accessing its payment account via its mobile application, and apply a second SCA when adding the payment card to a digital wallet. Q&A 2018_4141 clarified that, when initiating a payment while within the same session in which SCA was performed to access account data, one of the elements used at the time the customer accessed its payment account online (including via a mobile app) may be reused in compliance with Article 4 of the Commission Delegated Regulation (EU) 2018/389 , provided that the other element of SCA is carried out at the time the payment is initiated and the dynamic linking element required under Article 97(2) PSD2 (for remote payment transactions) is present and linked to that latter element. Further, the principle set out in Q&A 2018_4141 may be applied in the specific case described by the submitter. This means that one of the authentication elements used for accessing the payment account (via the mobile app) may be reused when adding the payment card to a digital wallet within the same session and within the same app, provided that the requirements of Articles 4, 6, 7, 8 and 9 of the Delegated Regulation are met.