Question ID:
Legal Act:
Directive 2015/2366/EU (PSD2)
Strong customer authentication and common and secure communication (incl. access)
COM Delegated or Implementing Acts/RTS/ITS/GLs:
Regulation (EU) 2018/389 - RTS on strong customer authentication and secure communication
Article 11 - Contactless payments at point of sale
Type of submitter:
Credit institution
Subject Matter:
Contactless counting

For the purpose of counting previous cumulative contactless transactions in order to assess the eligibility of the exemption in Article 11 of the RTS, should contactless transactions initiated outside of the EEA be included?

Background on the question:

The question is relevant as it affects the consistency and practical application of the contactless exemption in Article 11 of the RTS. When assessing whether there have been more than 5 contactless transactions since the last application of SCA on that payment instrument, it is necessary to know whether to count contactless transactions originating outside of the EEA. This will affect whether the exemption applies or not.

Date of submission:
Published as Final Q&A:
EBA Answer:

Q&A 2018_4233 addresses the question of whether strong customer authentication (SCA) applies to one-leg payment transactions. In particular, said Q&A clarifies that for ‘payment transactions where more than one payment service provider (PSP) is involved, if one of the PSPs is located within the Union, SCA has to be applied in accordance with Article 97 of PSD2 and the Commission Delegated Regulation (EU) 2018/389 to those parts of the transactions which are carried out within the Union.

In addition, Q&A 2018_4030 clarifies that ‘if both PSPs are, or the sole PSP in a payment transaction is, located within the Union SCA has to be applied in accordance with Article 97 PSD2 and the Delegated Regulation’.

This means that PSPs should include in the calculation of the limits under Article 11 of the Delegated Regulation only those contactless payment transactions initiated via the payment instrument with a contactless functionality that are subject to the application of SCA.

In relation to the above, it is not mandatory for the PSP to include in the calculation of the limits, under Article 11(a) and (b) of the Delegated Regulation, the cross-border transactions where the payer’s PSP (the issuer) is located in the EEA and the payee’s PSP (the acquirer) is located outside the EEA. However, if the issuer decides to include card-based payments where the acquirer is located outside the Union into the calculation of the limits under Article 11 of the Delegated Regulation, it should not be prevented from so doing

Final Q&A