How does EBA Single Rulebook Q&A clarify SCA ambiguities?

How does the EBA Single Rulebook Q&A clarify SCA ambiguities?#

The EBA Single Rulebook Q&A answers questions from banks and payment service providers about PSD2 and the Regulatory Technical Standards (RTS) on Strong Customer Authentication (SCA). Each answer gives the view of the European Banking Authority (EBA), or of the European Commission where EU law itself needs interpreting.

The answers are not law. The EBA states that "answers to Q&As have no binding force in law". National supervisors still use them to check compliance.

Two EBA opinions add detail: the 2018 opinion on the implementation of the RTS and the 2019 opinion on the elements of SCA. The binding rules are in Delegated Regulation (EU) 2018/389.

Which SCA questions does the EBA clarify?#

The EBA guidance on SCA covers five areas. The rules come from PSD2 and the RTS. The Q&A and the opinions say how the EBA expects them to be applied.

Two independent elements from different categories#

SCA needs at least two independent elements from different categories: knowledge, possession and inherence. Independence comes from PSD2 Article 4(30) and RTS Article 9. The requirement for different categories is the EBA's interpretation (2018 opinion, paragraph 33).

Q&A 2020_5619 confirms it: providers "should apply strong customer authentication (SCA) by using at least two independent elements from different categories". A password plus a security question is not SCA.

Exemptions: trusted beneficiaries, recurring payments and TRA#

The RTS treats these as three separate exemptions, each with its own conditions.

• Trusted beneficiaries (Article 13): the payer added the payee to a list with SCA. No fraud-rate threshold.
• Recurring transactions (Article 14): SCA applies when a series with the same amount and payee is created, changed or paid for the first time. No fraud-rate threshold.
• Transaction Risk Analysis (Article 18): remote transactions up to EUR 500 can skip SCA if a real-time risk analysis passes and the provider's fraud rate stays at or below the reference rates in the RTS annex. For card payments these are 0.13% up to EUR 100, 0.06% up to EUR 250 and 0.01% up to EUR 500. For credit transfers they are 0.015%, 0.01% and 0.005%.

Dynamic linking for payments#

Dynamic linking means the authentication code is specific to the amount and the payee. Under RTS Article 5, the payer must see both before authenticating, and any change to either invalidates the code.

The RTS does not prescribe a technology. Q&A 2020_5366 confirms that no specific technical solution is required.

With passkeys, one common approach is to build the challenge from the transaction. The bank hashes the amount, the payee and a random value into the challenge. The passkey signs that challenge, so the signature only fits this exact payment. If the amount or payee changes, the hash changes and the signature no longer matches.

Biometrics as an inherence element#

A fingerprint or face scan counts as one element: inherence. On its own it is not SCA, because the two elements must come from different categories.

Q&A 2020_5353 adds that the biometric must meet RTS Article 8 by itself, including a very low rate of false acceptance. The 2019 opinion (paragraphs 39 and 42) accepts a device-bound app or key combined with a PIN or biometric as two elements.

Cross-border payments with one leg outside the EEA#

SCA applies in full when both payment service providers are in the EEA. If one of them is outside, the 2018 opinion (paragraph 32) requires SCA "only on a best-effort basis".

For card payments to a merchant outside the EEA, Q&A 2018_4233 leaves the choice to the issuer if it cannot enforce SCA: block the payment or carry the liability under PSD2 Article 73.

Has the EBA recognized passkeys as SCA-compliant?#

The EBA has made no specific statement on passkeys, either for or against. No Q&A answer, opinion or technical standard mentions passkeys, FIDO or WebAuthn. The EBA stays technology-neutral, and its lists of compliant elements are "not intended to be exhaustive" (2019 opinion, paragraph 22).

The 2019 opinion (paragraph 26) does accept "the exchange of (public and private) keys" as possession if the key is bound to the device, for example "keys stored in the secure element of a device". With a device PIN or biometric, that makes two elements. This is how device-bound passkeys work.

Two points need attention:

• Synced passkeys: a passkey copied across devices through a cloud account weakens the device binding the EBA asks for. Whether it still counts as possession is not settled.
• Dynamic linking: a WebAuthn assertion signs the challenge. If the bank builds the challenge as a hash of amount and payee, the signature is bound to both. The bank still has to show amount and payee to the payer in its own interface. Secure Payment Confirmation signs both directly, but browser support is still limited.

Read the full article#

About Corbado

Corbado is the Passkey Intelligence Platform for large-scale CIAM teams running consumer authentication. We help you see what IDP logs and generic analytics tools can't: where passkeys, passwords, OTP, social login and fallback journeys succeed, stall or fail, which devices and browsers create friction, and when an OS update silently breaks login. Two products: Corbado Observe layers process mining and observability across authentication journeys. Corbado Connect adds managed passkeys with analytics built in alongside your IDP. VicRoads runs passkeys for 5M+ users with Corbado (more than 80% passkey activation rate). Talk to a Passkey Expert →