EU Financial Regulatory Q&A Database

"Push based" authentication and SCA requirements

Directive 2015/2366/EU (PSD2) · Art. Article 98

SCA for contactless payments at a POS executed via a mobile device

Directive 2015/2366/EU (PSD2) · Art. 97

Authentication code

Directive 2015/2366/EU (PSD2) · Art. 97

Failed Authentication Code

Directive 2015/2366/EU (PSD2) · Art. 97

Whitelisting

Directive 2015/2366/EU (PSD2) · Art. 97

Delayed or deferred PIN for wearable devices

Directive 2015/2366/EU (PSD2) · Art. 98

Authorisation for the provision of PIS and AIS on behalf of other legal entities belonging to the same corporate group / Autorizzazione ad offrire servizi di PIS e AIS per conto di altre Legal Entity appartenenti allo stesso Gruppo societario

Directive 2015/2366/EU (PSD2) · Art. 98

Relying on vendor mechanisms processing the biometric data for strong customer authentication; Multiple fingerprint samples stored on a mobile device and used for purpose of user authentication.

Directive 2015/2366/EU (PSD2) · Art. 98

SCA profiles and multiple-use of devices

Directive 2015/2366/EU (PSD2) · Art. 97

Tokenised card details as a SCA possession element.

Directive 2015/2366/EU (PSD2) · Art. 97

Insurance policy on minimum monetary amount of the professional indemnity insurance of PSD2

Directive 2015/2366/EU (PSD2) · Art. 5

Reporting of e-commerce card-based payment transactions falling within the scope of EBA Opinion EBA-Op-2019-06 for which no strong customer authentication was applied

Directive 2015/2366/EU (PSD2) · Art. 96

Data breakdown on fraud by different card functions for cash withdrawals

Directive 2015/2366/EU (PSD2) · Art. 96

Recording of card payments

Directive 2015/2366/EU (PSD2) · Art. 96

Recording of e-money

Directive 2015/2366/EU (PSD2) · Art. 96

Reporting of fraud by the acquirers

Directive 2015/2366/EU (PSD2) · Art. 96

Reporting of PISP initiated payments

Directive 2015/2366/EU (PSD2) · Art. 96

Reporting of PISP transactions

Directive 2015/2366/EU (PSD2) · Art. 96

Direct debts fraud reporting

Directive 2015/2366/EU (PSD2) · Art. 96

Reporting of card transactions that are out-of-scope from the requirement for SCA

Directive 2015/2366/EU (PSD2) · Art. 96

Transaction risk analysis (TRA) exemption – Calculation of fraud rate – Impact of unauthorized transactions on issuers and acquirers

Directive 2015/2366/EU (PSD2) · Art. 98

Report of fraud rates by issuers and acquirers

Directive 2015/2366/EU (PSD2) · Art. 96

Strong Customer Authentication (SCA) possession element requirement for cryptographic validation

Directive 2015/2366/EU (PSD2) · Art. Article 98

Electronic chip transactions authenticated with a hand signature

Directive 2015/2366/EU (PSD2) · Art. 96

Scope of contingency mechanism

Directive 2015/2366/EU (PSD2) · Art. 98

Define what is “given period of time”

Directive 2015/2366/EU (PSD2) · Art. 98

EBA register providing a list of third party providers (TPPs)

Directive 2015/2366/EU (PSD2) · Art. Article 15

Separation of factors for strong customer authentication

Directive 2015/2366/EU (PSD2) · Art. 97

Exemptions from Strong Customer Authentication (SCA): credit transfers

Directive 2015/2366/EU (PSD2) · Art. 15

Unattended terminals and Transaction Risk Analysis (TRA) exemption and related Payment Service Providers (PSP)’s liabilities rules

Directive 2015/2366/EU (PSD2) · Art. 97 and 74.2

Categories of Registration

Directive 2015/2366/EU (PSD2) · Art. 15 and Annex 1

Dynamic linking: transactions for which the final amount is unknown and may be lower or higher than authenticated amount

Directive 2015/2366/EU (PSD2) · Art. 97

Signature on a paper slip from a payment terminal, as a factor in a two-factor SCA

Directive 2015/2366/EU (PSD2) · Art. 98

Definition of payee for dynamic linking

Directive 2015/2366/EU (PSD2) · Art. 97

Dynamic Linking for batch payments

Directive 2015/2366/EU (PSD2) · Art. 97

Dynamic linking for batch transactions

Directive 2015/2366/EU (PSD2) · Art. 97

Data authentication standards

Directive 2015/2366/EU (PSD2) · Art. 97

Scope of ‘initiation of an electronic payment transaction’

Directive 2015/2366/EU (PSD2) · Art. 97

Confidentiality of the application cryptogram for EMV transactions

Directive 2015/2366/EU (PSD2) · Art. 97

Unsuccessful authentications and declined transactions effect on the counters of cumulative amount and number of consecutive transactions

Directive 2015/2366/EU (PSD2) · Art. 98

Compliance with SCA in offline mode on an aircraft without internet connection

Directive 2015/2366/EU (PSD2) · Art. 97

Transaction Risk Analysis (TRA) exemption – Time period for calculation of initial fraud rate

Directive 2015/2366/EU (PSD2) · Art. 98

3 month notification period on interface changes to ASPSPs’ interfaces

Directive 2015/2366/EU (PSD2) · Art. 98

Applicability of exemption under RTS Article 16 for payee’s PSPs (acquirers)

Directive 2015/2366/EU (PSD2) · Art. 98

Applicability of exemption under RTS Article 11 for payee’s PSPs (acquirers)

Directive 2015/2366/EU (PSD2) · Art. 98

Contactless payments at point of sale - Applications of the conditions

Directive 2015/2366/EU (PSD2) · Art. 97

Contactless counting

Directive 2015/2366/EU (PSD2) · Art. 98

Application of limits for Strong customer authentication (SCA) exemption

Directive 2015/2366/EU (PSD2) · Art. Articles 11 and 16 of RTS

Criteria for the application of the transaction risk analysis (TRA) exemption – Relevant fraud rates

Directive 2015/2366/EU (PSD2) · Art. 97

Application of the low-value contactless exemption – Calculation of limits at Primary Account Number (PAN) / account level or at device / token level

Directive 2015/2366/EU (PSD2) · Art. 97