PSD2 Strong Customer Authentication for Crypto EMT Wallets

By the Guardian team Updated November 2026 6 min read

Quick answer. Yes, in the EBA's view. Its June 2025 opinion (EBA/Op/2025/08) says PSD2 SCA must apply to accessing custodial e-money token wallets and before initiating EMT transfers. It advised authorities not to prioritize enforcement until 2 March 2026.

Watch: PSD2 Strong Customer Authentication for Crypto EMT Wallets 1:45

Video transcript

Does PSD2 strong customer authentication apply to custodial e-money token wallets? In the EBA's view, yes, and the grace period is over.

MiCA treats e-money tokens as electronic money. The EBA concluded their custody and transfer must be as secure as any other payment service.

The June 2025 opinion told authorities not to prioritize enforcement until 2 March 2026. Now these services need a PSD2 license or payment partner.

SCA applies at wallet login and before sending tokens, even to a customer's own wallet. Our reading adds address changes, two factor changes and withdrawal API keys.

That means at least two independent factors. Codes work once, a block follows five failed tries at most, and idle sessions end within five minutes.

Each code must also be tied to the amount and payee. We read the payee as the destination address. Guardian's Synthetix review found withdrawal signatures covering neither.

Skipping SCA moves the loss to you. Under PSD2, unless the payer acted fraudulently, they bear no losses, and the grace period never suspended that rule.

Test it like an attacker. Skip the SCA step and call the withdrawal API. Change the amount or address after approval. Replay a code. Withdraw with a read-only key.

Guardian's offchain pentests attack login, session and withdrawal flows, function by function. Read the full article, or talk to Guardian at guardian.security.

MiCA deems e-money tokens (EMTs) to be electronic money (Article 48(2)). That makes them "funds" under PSD2, and pulls some CASP services into payments law.

On 10 June 2025 the EBA set out which services that covers. It told authorities to insist on strong customer authentication (SCA) and fraud reporting, after a grace period.

That grace period ended on 2 March 2026. In the EBA's view, custodial EMT wallet logins and transfers now need the same authentication as any other payment service.

This article explains the technical and security side of EBA/Op/2025/08 and the PSD2 strong customer authentication rules. It is not legal advice; confirm how it applies to you with counsel.

Why the EBA Applies SCA

The EBA advised national authorities to treat three things as payment services or accounts under PSD2.

Transfers of EMTs carried out by a CASP on behalf of clients.
Custody and administration of EMTs, where it allows transfers to and from third parties.
A custodial wallet that can send and receive EMTs to and from third parties, as a payment account.

Exchanging crypto-assets for funds or other crypto-assets is not a payment service in its view.

On security, it concluded that "the custody and transfer of EMTs need to be as secure as all other payment services subject to PSD2" (paragraph 44).

So PSD2 Articles 97 and 98, and the SCA rules adopted under them, "have to apply" to custodial EMT wallet access and before EMT transfers.

Status and dates

Date	Document	What it does
10 June 2025	EBA/Op/2025/08, a No Action letter	Enforcement of SCA and fraud reporting deprioritized until 2 March 2026
12 February 2026	EBA/OP/2026/01	Advises authorities on unlicensed CASPs after 2 March
2 March 2026	End of transition	PSD2 license or PSP partner needed for these services

One date differs: the 2025 opinion's summary runs the licensing transition "until 1 March 2026". Its paragraph 18 and the February opinion use 2 March.

The February opinion advises authorities to let CASPs with pending applications that meet four conditions continue, without marketing or new clients. Others should be made to cease and offboard clients.

The advice runs until the future Payment Services Regulation applies and PSD3's transposition deadline passes, unless the EBA reassesses it sooner.

Withdrawals to a client's own wallet count. First-party EMT transfers "would still qualify as payment transactions" (EBA/Op/2025/08, paragraph 71).

Two Independent Factors

PSD2 defines SCA as two or more independent elements categorized as knowledge, possession and inherence (Article 4(30)).

The SCA RTS, Delegated Regulation (EU) 2018/389, adds the engineering:

Breaching one element must not compromise the others (Article 9(1)).
SCA on a phone or other multi-purpose device needs separated secure execution environments and tamper checks (Article 9(2), (3)).
Possession elements must resist replication (Article 7(2)).
Each authentication code is accepted once and cannot be forged (Article 4(1), (2)).
Failures do not reveal which element was wrong; at most five failed tries before a block (Article 4(3)).
Sessions end after at most 5 minutes without activity (Article 4(3)(d)).

Linking to Amount and Address

For remote payments, PSD2 requires SCA that will "dynamically link the transaction to a specific amount and a specific payee" (Article 97(2)).

RTS Article 5 spells it out:

The payer sees the amount and the payee.
The authentication code is specific to that amount and payee.
The code accepted matches the original amount and payee.
Any change to either invalidates the code.

Our reading: for an EMT withdrawal, the payee is the destination address. The opinion does not say how dynamic linking maps onto addresses, so agree it with your authority.

Either way, execute only the amount and address the user approved.

Guardian's public review of Synthetix's withdrawal backend shows the same gap. Signatures did not cover withdrawal amount or destination, so a tampered request still verified (H-15).

Where SCA Is Required

PSD2 Article 97(1) requires SCA when the payer accesses its account online or initiates an electronic payment. It also covers "any action through a remote channel which may imply a risk of payment fraud or other abuses".

Wallet flow	Basis
Logging in to the wallet	Account access, Article 97(1)(a); EBA paragraph 44
Sending or withdrawing EMTs	Payment initiation, Article 97(1)(b) and (2)
Adding or changing a withdrawal address	Risky remote action; trusted payee lists need SCA (RTS Article 13(1))
Changing 2FA, email or phone	Risky remote action, Article 97(1)(c)
Creating API keys that can withdraw	Risky remote action, Article 97(1)(c)

The opinion names only wallet access and transfer initiation. The last three rows are our reading of Article 97(1)(c).

Exemptions and API Access

The SCA RTS exemptions a wallet will reach for:

Balance views: balance and 90-day history, with SCA at first access and every 180 days (Article 10, as amended in 2022).
Trusted beneficiaries: payees the user listed, with SCA to create or change the list (Article 13).
Own accounts: transfers between one person's accounts at the same provider (Article 15).
Low value: up to €30, within €100 or five transactions since the last SCA (Article 16).
Transaction risk analysis: low-risk remote payments, if fraud rates stay under reference rates (Article 18).
Corporate protocols: dedicated processes for non-consumers that the authority accepts (Article 17).

The opinion does not say how each exemption fits EMT transfers. Read literally, Article 15 needs both accounts at the same provider, which an external wallet is not.

RTS Article 2 requires transaction monitoring behind both SCA and its exemptions. It must weigh compromised credentials, known fraud scenarios and signs of malware.

API keys and automated access

The opinion is silent on API keys.

Our reading: beyond Article 17 for corporate clients, no exemption obviously covers a standing key that can withdraw. Keep withdrawal rights off keys by default.

Liability and Fraud Reporting

Skipping SCA moves the loss to you. PSD2 Article 74(2): where the provider "does not require strong customer authentication, the payer shall not bear any financial losses unless the payer has acted fraudulently".

The EBA's grace period never suspended that rule. It told authorities to remind CASPs of it (paragraph 45).

Fraud reporting under PSD2 Article 96(6) had the same grace period. After it, the EBA advised authorities to require only selected data on EMT transactions:

E-money payment transactions, split by remote and non-remote initiation.
Within each, those authenticated with SCA and without it.
Losses due to fraud, per liability bearer.

Log the authentication method on every transfer. You cannot report the split if you never recorded it.

Testing SCA in Wallet Flows

Call the withdrawal API directly, skipping the SCA step. Does the server refuse?
Change the amount or address after authenticating. Is the code rejected?
Replay an authentication code. Is it accepted only once?
Add an address, then withdraw at once. Did the change need SCA?
Withdraw with a read-only or trading key. Is it refused?

How Guardian Helps

Guardian's pentests for fintechs attack the flows that authenticate users, authorize actions and approve withdrawals, function by function.

Web app pentests cover authentication, session handling and value-moving flows. API pentests cover key scoping and revocation, per-object authorization, rate limiting and replay.

Frequently Asked Questions

Does PSD2 strong customer authentication apply to crypto wallets?

In the EBA's view, yes for custodial wallets holding e-money tokens that can send them to third parties. SCA applies to wallet access and before EMT transfers. Enforcement was deprioritized only until 2 March 2026 (EBA/Op/2025/08).

Do withdrawals to a customer's own wallet need SCA?

They are transfers. The EBA says first-party EMT transfers still qualify as payment transactions (EBA/Op/2025/08), and initiating one falls under PSD2 Article 97(1)(b). Whether any exemption applies is a question for your authority.

What happens if a wallet provider skips SCA?

Under PSD2 Article 74(2), the payer bears no financial losses unless they acted fraudulently, so the provider carries them. The EBA's grace period never suspended this rule.

Does the EBA opinion cover bitcoin or other crypto-assets?

No. It addresses services with e-money tokens, which MiCA deems electronic money. DORA separately requires CASPs to implement policies and protocols for strong authentication mechanisms (Article 9(4)(d)).

Sources

Test your login and withdrawal flows against SCA

Guardian pentests the path from wallet login to EMT transfer, including sessions, value-moving flows and API keys.

Talk to Guardian Explore fintech security