Knowledge element of SCA.

According to Article 4, point (30) of Directive (EU) 2015/2366 (PSD2), ‘strong customer authentication’ (SCA) means “an authentication based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data”. An API key may constitute a valid SCA knowledge element, provided that the Payment Service Provider (PSP) complies with all applicable requirements under Commission Delegated Regulation (EU) 2018/389 (the RTS on SCA). This includes: The obligation under Article 6(1) to adopt measures to mitigate the risk that elements categorised as knowledge are uncovered by or disclosed to unauthorised parties. The requirement under Article 9 to ensure the independence of the SCA elements. The obligation under Article 24(2)(b) to ensure that the association, by means of a remote channel, of the Payment Service User (PSU)'s identity with the personalised security credentials and with authentication devices or software is performed using strong customer authentication. While memorisation is not explicitly required, an SCA knowledge element should be known only to the user and not accessible to unauthorised parties or retrievable by the system itself. Additionally, the API key, as an SCA factor, should be associated with the PSU in accordance with Article 24(2)(b) of the Delegated Regulation. In the case described by the submitter, the association with the PSU does not appear to meet the requirements of Article 24(2)(b), as only one valid SCA factor is used (possession via a one-time password). As clarified in the EBA Opinion (EBA-Op-2018-04), a user ID does not constitute a valid knowledge element. Based on the information provided by the submitter, it cannot be concluded whether the requirements of Articles 6(1) and 9 of the Delegated Regulation are met. In conclusion, whether an API key qualifies as a knowledge element depends on its implementation.