What Possession elements are compatible with Strong Customer Authentication (SCA) requirements?

The following summarises the European Banking Authority (<a href="/glossarycollection/european-banking-authority" style="color:#48277C;" target="_blank" title="European Banking Authority">EBA</a>) view on what does and does not constitute a possession element under the Regulatory Technical Standards (<a href="/glossarycollection/regulatory-technical-standards" style="color:#48277C;" target="_blank" title="Regulatory Technical Standards">RTS</a>) on Strong Customer Authentication* (<a href="/glossarycollection/strong-customer-authentication" style="color:#48277C;" target="_blank" title="Strong Customer Authentication">SCA</a>): 

Possession of a device evidenced by an OTP generated by, or received on, a device (hardware or software token generator, SMS OTP); 

Possession of a device evidenced by a signature generated by a device (hardware or software token); 

Card or device evidenced through a QR code (or photo TAN) scanned from an external device; 

App or browser with possession evidenced by device binding — such as through a security chip embedded into a device; 

Card evidenced by a card reader; 

Card with possession evidenced by a dynamic card security code; 

App installed on the device. 

The following do not constitute possession elements: 

card with possession evidenced by card details (printed on the card); 

and, 

Card with possession evidenced by a printed element (such as an OTP list). 

*Compliance with SCA requirements is dependent on the specific approach used in the implementation of the elements.