
psd2 delay, sca deadline
Sweeping changes that PSD2 brings are for the benefit of both fintechs and customers but as with any such shift, bumps in the road and delays are almost inevitable. SCA in particular seems to be causing loss of sleep to many a fintech and retailer.
IN A NUTSHELL
The implementation of PSD2 has encountered roadblocks with regards to the implementation of Strong Customer Authentication. Scheduled to take effect on September 14th, 2019, the multi-factor authentication protocol is expected to provide both customers and fintechs with safety and security for all proximity and remote transactions over any channel.
SCA employs three
distinct features, any two of which may be combined for authentication:
knowledge in the form of passwords or PINs; possession in the form of tokens,
smart cards or mobile handsets; and inherence, in the form of biometric data,
such as fingerprints.
The implementation of SCA comes simultaneously with the advent of open banking and the sharing of banks' account details and transactions with third parties via APIs and was expected to improve open banking's security.
EBA STATEMENT
However, the European Banking Authority
has recently released a statement, giving out the official opinion that the
implementation of SCA has not been running according to schedule due to the
complexity of its requirements, the lack of preparedness of the industries
affected as well as the potential for significant impact the SCA will have on
customers. It has also been pointed out that some banks and financial service
providers have been reluctant to hand over data to customers, citing compliance
and risk management.
The statement comes after multiple
comments and requests for delay, including the one by the European Payment
Service Providers for Merchants, a non-profit trade association that has
conducted research among its clients and concluded that retailers simply aren't
ready.

EXTENSIONS, EXTENSIONS, EXTENSIONS
The EBA had therefore advised the various
national authorities across the EU to provide limited additional time for
preparation and execution. While this extension may provide many fintechs and
retailers an opportunity to finish their preparations, it is advised they do
not count on another extension.
Firms providing SCA-implementation tools and aid are expected to take a hit since the delay may incite many fintechs to postpone their plans but any decrease in their business is expected to be only temporary and in fact experience an uptick once the extended deadline begins approaching.
HOW MANY (NOT) UP TO DATE?
Research by Finextra reveals that 41% of 442 European banks surveyed had failed to meet the March 2019 deadline for implementation, in large part because they could not provide a testing environment for third party service providers. Without these tests, it cannot be confirmed if the banks' APIs will connect with third party providers and allow them to provide customers with their services.
With regards to the extensions Ralf Ohlhausen, Executive Advisor at PPRO, commented: "Thankfully, the UK regulator has realised that not just the card networks would have faced a cliff edge on 14th September, but that TPPs would actually have an even bigger problem then. Given that the APIs in all the other countries are 18 months behind and that they don’t have an OBIE coordinating the implementations, I can only hope that they will allow a much longer adjustment period."
SCA HAS WON A BIT OF TIME
In light of these developments, the UK
Financial Conduct Authority has recently agreed to extend the deadline
regarding the implementation of Strong Customer Authentication in the payments
and e-commerce industry. The eighteen
month long extension comes as a welcome respite from stress for card
issuers, payments service providers and online retailers alike. Especially
considering the FCA does not intend to enforce action against companies that
have not met the relevant requirements from September 14, 2019, as long as
there is clear evidence said companies have taken the necessary steps to comply
with the implementation plan.
However, there have been new changes in the deadline extension. The European Banking Authority has elected to move the deadline for the migration to SCA by another 15 months, to 31 December 2020. The original deadline has long passed, but the EBA already acknowledged in June that it would have to provide an extension due to challenges arising from a complex payments market, when seeing the obstacles and problems companies were faced with.
However, there have been new changes in the deadline extension. The European Banking Authority has elected to move the deadline for the migration to SCA by another 15 months, to 31 December 2020.

The original deadline has long passed, but the EBA already acknowledged in June that it would have to provide an extension due to challenges arising from a complex payments market, when seeing the obstacles and problems companies were faced with.