EBA · 2025_7605 Rejected question

Obstacle assessment of requiring an additional SCA for PIS within an existing authenticated AIS session

Regulation
Directive 2015/2366/EU (PSD2)
Article
Article: 98, para. Paragraph: 1
Topic
Strong customer authentication and common and secure communication (incl. access)
Submitted by
Other
Submitted
2025-10-17
Browse PSD2 Register → More Q&As on this regulation →

Question

If a Payment Service User (PSU) initiates a payment (PIS) immediately after establishing a session for an Account Information Service (AIS) (for which SCA has already been performed), does the ASPSP's requirement for an additional, separate SCA—such as the need to fully log in to the mobile banking app before the payment confirmation screen is displayed—solely to access the payment function (and preceding the dynamic linking SCA) constitute an obstacle under Article 32(3) of the RTS?

Background

Article 32(3) of the RTS prohibits obstacles, and the EBA Opinion on obstacles (EBA/OP/2020/10), particularly paragraph 26, addresses the issue of requiring multiple Strong Customer Authentications (SCAs) for a single payment initiation. A common user journey involves a PSU first establishing an authenticated session with their ASPSP via an AISP to view their account information, for which SCA is applied. Immediately thereafter, within the same continuous session, the PSU decides to initiate a payment (PIS) through the same TPP. In this scenario, some ASPSPs require the PSU to perform a second, separate SCA (e.g., a full login to their mobile banking app) merely to "access" the payment functionality, before being presented with the payment details for a third SCA (the dynamic linking one). This practice imposes an additional, seemingly redundant SCA event into what should be a seamless user journey, creating friction and confusion for the user.
No answer published yet.

Original source: European Banking Authority, Q&A ID 2025_7605

This Q&A is published by European Banking Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.

Similar Q&As

Authentication process of the PSU with the ASPSP in a combined AIS and PIS journey in a redirection approach

Answered 2025-10-03

Obstacle assessment of a mandatory client segment selection screen in a redirection journey

Answered 2026-06-12

Application of SCA for confirmation of funds requests made by a PISP

Answered 2023-01-27

Definition of "equivalent authentication procedure" for journeys initiated from a mobile application

Answered 2026-06-12

Obstacle to the provision of payment initiation and account information services

Answered 2021-04-23

More Q&As on this topic

Definition of "equivalent authentication procedure" for journeys initiated from a mobile application

Answered 2026-06-12

Obstacle assessment of a mandatory client segment selection screen in a redirection journey

Answered 2026-06-12

Clarification of the scope of the term "authentication procedures" in the context of the RTS and the EBA Opinion on obstacles

Answered 2026-06-12

SCA exception for Contactless only terminals (SoftPOS) in case of emergency

Answered 2025-10-03

the use of strong and widely recognized encryption techniques

Answered 2025-10-03

📋 Track EU financial regulation continuously

Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.

Start free trial → Learn more

14-day free trial. No credit card required.