Q&A 2018_4359 clarified that a direct debit transaction is not subject to strong customer authentication (SCA), as it is defined in the PSD2 as a transaction initiated by the payee. It also clarified that in cases where the mandate given by the payer to the payee to initiate one or several such transactions is provided through a remote channel, the setting up of such a mandate is subject to strong customer authentication. In such circumstances however, pursuant to the wording of Article 97 PDS2, which only sets obligations to payment service providers (PSP), SCA is only necessary where a PSP is involved in the setting up of such a mandate. Mandates given by the payer to the payee set up without the direct involvement of the payer’s PSP are not subject to SCA.

Disclaimer:

This question goes beyond matters of consistent and effective application of the regulatory framework. A Directorate General of the Commission (Directorate General for Financial Stability, Financial services and Capital Markets Union) has prepared the answer, albeit that only the Court of Justice of the European Union can provide definitive interpretations of EU legislation. This is an unofficial opinion of that Directorate General, which the European Banking Authority publishes on its behalf. The answers are not binding on the European Commission as an institution. You should be aware that the European Commission could adopt a position different from the one expressed in such Q&As, for instance in infringement proceedings or after a detailed examination of a specific case or on the basis of any new legal or factual elements that may have been brought to its attention.