> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qonto.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to make a transfer with PSD2

> The PSD2 rules that apply when you initiate a SEPA transfer through the Business API: sensitive scopes, Verification of Payee, Strong Customer Authentication and trusted beneficiaries.

**PSD2 (Payment Services Directive II)** is a European Union directive that updates the legal framework for payment services. It aims to liberalize the payment industry and boost competition, enhance the security of payment service users, foster innovation in the payments sector, and clearly define the rights and obligations of payment service providers and users.

Initiating a payment is a **sensitive action** regulated under PSD2: to be [PSD2 compliant](https://www.eba.europa.eu/regulation-and-policy/payment-services-and-electronic-money/regulatory-technical-standards-on-strong-customer-authentication-and-secure-communication-under-psd2), Qonto requires [Strong Customer Authentication (SCA)](https://docs.qonto.com/guides/authentication/sca-flows.md) on sensitive actions. This guide puts together what you need to make a SEPA transfer.

> [!TIP]
>
> For a complete, runnable walkthrough (Python and Node.js), see the use case [How to send a SEPA transfer to a trusted beneficiary](https://docs.qonto.com/guides/use-cases/send-sepa-transfer.md).

**1. Get an OAuth 2.0 access token with payment.write**

To execute sensitive actions using SCA, users must have granted access to your application from their account via [OAuth 2.0](https://docs.qonto.com/guides/authentication/oauth-flow.md). Creating a SEPA transfer requires the `payment.write` scope.

`payment.write` is a **sensitive scope**: it allows initiating outbound payments to any beneficiary. If your application uses sensitive scopes, additional approval is required before going to production — **except for Automate your business operations**, which requires no review even for sensitive scopes. See [Sensitive scopes](https://docs.qonto.com/guides/developer-portal/developer-guidelines.md#sensitive-scopes).

**2. Verify the payee**

Call [Verify a SEPA payee](https://docs.qonto.com/api-reference/business-api/transfers/verification-of-payee/index.md) (or the [bulk version](https://docs.qonto.com/api-reference/business-api/transfers/verification-of-payee/bulk-verify-payee.md)) to match the IBAN with the beneficiary name. The `proof_token` included in the response is required for initiating a SEPA transfer and will be valid regardless of the verification result. See [Verification of Payee](https://docs.qonto.com/guides/payments/verification-of-payee.md).

**3. Create the transfer**

Call [Create a SEPA transfer](https://docs.qonto.com/api-reference/business-api/transfers/sepa-transfers/create.md). This operation requires Strong Customer Authentication **unless the beneficiary is trusted** (see below).

When SCA is required, you receive a `428 Precondition Required` response with a `sca_session_token` (valid for 15 minutes), and the user is asked to approve the action with the SCA method you chose in the `X-Qonto-2fa-Preference` header (`paired-device`, `passkey` or `sms-otp`). Poll [Retrieve an SCA session](https://docs.qonto.com/api-reference/business-api/authentication/sca/retrieve-session.md) until it returns `allow`, then repeat the original request with the `X-Qonto-Sca-Session-Token` header (and the same `X-Qonto-2fa-Preference` header, if you sent one). The full flow is described in [Strong Customer Authentication](https://docs.qonto.com/guides/authentication/sca-flows.md#step-by-step-guide).

## Trusted beneficiaries

Trusting a beneficiary is important for API integrations because it enables automated transfers without requiring Strong Customer Authentication (SCA) verification for each transaction. When a beneficiary is not trusted, your users need to verify their identity for each transfer made via partner integrations.

| If you need to... | Use |
| - | - |
| Mark beneficiaries as trusted | [Trust SEPA beneficiaries](https://docs.qonto.com/api-reference/business-api/transfers/sepa-beneficiaries/trust.md) (up to 400 at once), with the `beneficiary.trust` scope. It requires SCA and is available to applications using the **Automate your business operations** or **Embed Qonto business features into your platform** [use case](https://docs.qonto.com/guides/developer-portal/developer-guidelines.md#selecting-your-use-case). |
| Untrust beneficiaries | [Untrust SEPA beneficiaries](https://docs.qonto.com/api-reference/business-api/transfers/sepa-beneficiaries/untrust.md) (up to 400 at once), with the `payment.write` scope. |

> [!NOTE]
>
> Trusting a beneficiary lets your integration initiate transfers to that beneficiary without requiring SCA on every transaction. The actual transfer still requires `payment.write`.

> [!NOTE]
>
> **Note for regular Qonto customers**
>
> If you are not using the API, you can also mark a beneficiary as trusted directly from the Qonto web app by enabling the **"Allow automated transfers"** option on the beneficiary's profile. This option is available on **web only**. [**Learn how to mark a payee as trustworthy →**](https://support-fr.qonto.com/hc/en-us/articles/23947644174993-How-can-I-mark-a-payee-as-trustworthy)

## Test in the Sandbox

You can test sensitive actions in the Sandbox with mocked SCA sessions: see [Testing a sensitive action on the Sandbox environment](https://docs.qonto.com/guides/authentication/sca-flows.md#testing-a-sensitive-action-on-the-sandbox-environment).

## Licensed partners (TPP)

If you are a licensed partner, you must identify yourself through your QSeal certificate when calling our Business API endpoints in Production (cf. [the requirements](https://docs.qonto.com/guides/authentication/qsealc.md)); otherwise you will receive a `401 Unauthorized` error to your API calls. To initiate payments, your license should be a PIS license. More answers in the [PSD2 FAQ](https://docs.qonto.com/faq-articles/api-questions/api-questions-psd2.md).

## Related endpoints

* [Trust SEPA beneficiaries](https://docs.qonto.com/api-reference/business-api/transfers/sepa-beneficiaries/trust.md)
* [Untrust SEPA beneficiaries](https://docs.qonto.com/api-reference/business-api/transfers/sepa-beneficiaries/untrust.md)
* [Create a SEPA transfer](https://docs.qonto.com/api-reference/business-api/transfers/sepa-transfers/create.md)
* [Create a Bulk Transfer](https://docs.qonto.com/api-reference/business-api/transfers/bulk-transfers/create.md)
* [Create a SEPA recurring transfer](https://docs.qonto.com/api-reference/business-api/transfers/recurring-transfers/create.md)