In accordance with the clarifications provided under Q&A 5476, the Customer ID facilitates the identification of the Payment Services User (PSU) for the purpose of authentication but is not in itself a valid Strong Customer Authentication (SCA) element. Therefore, it cannot be considered as a Personalised Security Credentials (PSC). However, Customer ID is not available to third parties other than the payment service user and the payment service provider, and its disclosure can be used to carry out fraud. Therefore, taking also into account the provisions of the EBA Guidelines on ICT and security risk management, the Customer ID cannot be included in a cleartext in a payer-presented QR-code for the initiation of credit transfers at the Point of Interaction without any security measures (e.g., encryption, tokenisation, transport layer security) ensuring its confidentiality during the QR-code life-cycle.

When reviewing the clarification received under Q&A 5476, the Multi-Stakeholder Group (MSG) on Mobile initiated SEPA (Instant) Credit Transfers (MSCT) debated whether such security measures would apply to any payer-presented QR-code, regardless of who generates the code, or whether the obligation to encrypt/tokenise the CustomerID would only be applicable to entities authorised under PSD2 (Directive (EU) 2015/2366) and subject to the EBA Guidelines on ICT and security risk management, as a minority of the group is of the view that non-regulated entities or consumers should be allowed to generate a QR-code containing the Customer ID in clear-text.