Payment Services Regulations – Strong Customer Authentication (SCA) Update

In July we published a briefing on the Payment Services Regulations 2017, which are the regulations by which the UK has implemented the EU’s revised Payment Services Directive 2015/2366 commonly known as “PSD2”, including the requirement for ‘strong customer authentication’ (SCA), the aspect of PSD2 most relevant to traders, to be implemented by 14^th September 2019.

Because PSD2 applies to payment services providers (PSPs) but affects a number of other parties, such as online retailers, a number of groups previously complained to the European Banking Authority that they were not properly prepared for SCA. In response, the EBA announced that it could not legally delay the 14th September 2019 implementation date, but that it was prepared to be flexible and to grant limited additional time for migration to PSPs that had an agreed migration plan in place with their national competent authority.

On 13 August 2019, the UK’s competent authority, the Financial Conduct Authority (FCA), announced that it has agreed an 18 months plan to implement SCA with the e-commerce industry of card issuers, payments firms and online retailers in the UK, and that it will not take enforcement action against PSPs prior to this date provided that any non-compliance is within those areas covered by the migration plan and there is evidence that the PSP has taken the necessary steps to comply with the plan. This means that, subject to those conditions, the UK’s e-commerce market can work towards SCA compliance by 14 March 2021.

The position in other EU countries varies. Our present understanding is that:

• The Irish Central Bank has also confirmed that it will recognise a period of migration for e-commerce transactions only, but a defined period has not yet been specified.
• The German regulator BaFin published guidance in April 2019 seeking to limit the scope of the SCA requirements, but it has not yet published any details as to a delay in the implementation date.
• The French regulator Banque de France has announced a migration plan under which the majority of services are to be SCA compliant by December 2020 and complete compliance achieved by 2022.
• Polish, Italian and Swedish regulators are due to make announcements in relation to SCA compliance shortly.