Perform SCA by reusing an element used in an authentication exempted from SCA

EBA Q&A 2018_4141 clarified that “the Commission Delegated Regulation does not prescribe a time limit for the provision of the two authentication elements necessary for SCA (Strong Customer Authentication) while within a session. When initiating a payment, SCA may therefore be performed when one of the elements used at the time the customer accessed its payment account online (including via a mobile app) is reused in compliance with Article 4, and the other element of SCA is carried out at the time the payment is initiated, provided that the dynamic linking element required under Article 97(2) PSD2 and detailed under Article 5 of the Delegated Regulation is present and linked to that latter element”. Q&A 2018_4141 does not exclude the possibility for payment service providers to make use of the exemption from the application of SCA to payment account information under Article 10 of the Commission Delegated Regulation (EU) 2018/389 . Following the above, it is possible for payment service providers to reuse an element used for accessing payment accounts online under the exemption under Article 10 of the Delegated Regulated when initiating a remote electronic payment transaction within the same session, provide that the conditions set in Q&A 2018_4141 are met.