On 21 June 2019, the European Banking Authority (EBA) published an opinion on the elements of strong customer authentication (SCA) under the revised Payment Services Directive (PSD2).

The opinion provides a non-exhaustive list of the authentication approaches currently observed in the market and states whether or not they are considered to be SCA compliant. The opinion does so separately for each of the three SCA elements of knowledge, possession and inherence, and also provides clarifications regarding combinations of these elements.

The opinion also explains that sufficient time has been available for the industry to prepare for the application date of the SCA (14 September 2019). However, it also acknowledges that some firms not directly subject to the PSD2 (such as e-merchants) may not be ready by the application date. The EBA therefore accepts that, on an exceptional basis, Member State competent authorities may provide some stakeholders with limited additional time.