SCA exception for Contactless only terminals (SoftPOS) in case of emergency

Article 97(1)(b) of  Directive 2015/2366/EU (PSD2)  prescribes that the payment service provider (PSP) shall apply ‘strong customer authentication (SCA) where the payer initiates an electronic payment transaction’. Therefore, in the case where the payer initiates an electronic card-based payment transaction at a Software Point of Sale (POS), the issuer shall apply Strong Customer Authentication (SCA) to that transaction, unless an exemption from SCA applies in accordance with Articles 11– 18 of the  Delegated Regulation (EU) 2018/389 . Other exemptions from SCA, including for emergency situations, than those specified within the Delegated Regulation are not available. In the specific case described by the submitter where a payment transaction is initiated at a software POS during a cyber attack or disruption to internet connectivity or acquirer's system, SCA should be applied, unless the payment transaction can be subject to an SCA exemption. It should also be noted that, as clarified in  Q&A 2018_4055 , the PIN can be transmitted and verified offline, provided that it meets the requirements of Articles 6(1), 22(1) and 22(4) of the Delegated Regulation.