psd2 delay, sca deadline

Sweeping changes that PSD2 brings are for the benefit of both fintechs and customers but as with any such shift, bumps in the road and delays are almost inevitable. SCA in particular seems to be causing loss of sleep to many a fintech and retailer.

IN A NUTSHELL

The implementation of PSD2 has encountered roadblocks with regards to the implementation of Strong Customer Authentication. Scheduled to take effect on September 14th, 2019, the multi-factor authentication protocol is expected to provide both customers and fintechs with safety and security for all proximity and remote transactions over any channel.

SCA employs three distinct features, any two of which may be combined for authentication: knowledge in the form of passwords or PINs; possession in the form of tokens, smart cards or mobile handsets; and inherence, in the form of biometric data, such as fingerprints.

The implementation of SCA comes simultaneously with the advent of open banking and the sharing of banks' account details and transactions with third parties via APIs and was expected to improve open banking's security.

EBA STATEMENT

However, the European Banking Authority has recently released a statement, giving out the official opinion that the implementation of SCA has not been running according to schedule due to the complexity of its requirements, the lack of preparedness of the industries affected as well as the potential for significant impact the SCA will have on customers. It has also been pointed out that some banks and financial service providers have been reluctant to hand over data to customers, citing compliance and risk management.

The statement comes after multiple comments and requests for delay, including the one by the European Payment Service Providers for Merchants, a non-profit trade association that has conducted research among its clients and concluded that retailers simply aren't ready.

EXTENSIONS, EXTENSIONS, EXTENSIONS

The EBA had therefore advised the various national authorities across the EU to provide limited additional time for preparation and execution. While this extension may provide many fintechs and retailers an opportunity to finish their preparations, it is advised they do not count on another extension.

Firms providing SCA-implementation tools and aid are expected to take a hit since the delay may incite many fintechs to postpone their plans but any decrease in their business is expected to be only temporary and in fact experience an uptick once the extended deadline begins approaching.

HOW MANY (NOT) UP TO DATE?

Research by Finextra reveals that 41% of 442 European banks surveyed had failed to meet the March 2019 deadline for implementation, in large part because they could not provide a testing environment for third party service providers. Without these tests, it cannot be confirmed if the banks' APIs will connect with third party providers and allow them to provide customers with their services.

With regards to the extensions Ralf Ohlhausen, Executive Advisor at PPRO, commented: "Thankfully, the UK regulator has realised that not just the card networks would have faced a cliff edge on 14th September, but that TPPs would actually have an even bigger problem then. Given that the APIs in all the other countries are 18 months behind and that they don’t have an OBIE coordinating the implementations, I can only hope that they will allow a much longer adjustment period."

SCA HAS WON A BIT OF TIME

In light of these developments, the UK Financial Conduct Authority has recently agreed to extend the deadline regarding the implementation of Strong Customer Authentication in the payments and e-commerce industry. The eighteen month long extension comes as a welcome respite from stress for card issuers, payments service providers and online retailers alike. Especially considering the FCA does not intend to enforce action against companies that have not met the relevant requirements from September 14, 2019, as long as there is clear evidence said companies have taken the necessary steps to comply with the implementation plan.

However, there have been new changes in the deadline extension. The European Banking Authority has elected to move the deadline for the migration to SCA by another 15 months, to 31 December 2020. The original deadline has long passed, but the EBA already acknowledged in June that it would have to provide an extension due to challenges arising from a complex payments market, when seeing the obstacles and problems companies were faced with.

The original deadline has long passed, but the EBA already acknowledged in June that it would have to provide an extension due to challenges arising from a complex payments market, when seeing the obstacles and problems companies were faced with.