On 21 June 2019, the European Banking Authority (“EBA”) published its Opinion on Strong Customer Authentication (“SCA”) elements under PSD2 (EBA-Op-2019-06) where they amongst others, stipulated that national competent authorities (“NCAs”) may decide to work with the relevant stakeholders in their countries to provide limited additional time after 14 September 2019 to allow issuers to migrate to authentication approaches that are SCA compliant and acquirers to migrate their merchants to solutions that support SCA. This flexibility was permitted provided that these payment service providers (“PSPs”) have (i) set up a migration plan, (ii) have agreed the plan with their NCA, and (iii) execute their plan in an expedited manner. This Opinion did not expressly state how long this additional time can be. The extension period was expected to be understood as a period of supervisory flexibility and not a period of a simple non-application of the SCA. Not everyone in the industry fully understood the subtle difference between the two.
Many NCAs reacted to the possibility of an extension and announced that they will allow additional time for the SCA implementation in their country. The EBA announced today that all of them offered certain flexibly. However, as the length of the additional time was not initially fixed by the EBA different periods were announced by different NCAs ranging from 12 months (e.g. Hungary) to 18 Months (e.g. UK, France, Denmark). An example of a NCA’s reaction to the EBA’s Opinion is the publication of the FCA announcement on its website on 2 September 2019 where it provides time until 14 March 2021 for e-commerce card transactions to apply SCA. Certain other NCAs did not specify the additional time required and stated that they will follow the EBA’s guidance on this point, which was, according to their statement, expected to be published by the end of 2019 (e.g. Slovenia).
Certain PSPs providing acquiring services such as Stripe commented that while they may be exempt due to a delay in their country, issuing banks in non delayed countries will most likely require SCA to approve transactions, and Stripe have therefore explained on their website to their merchants that due to this they will still need to be prepared to authenticate these transactions. This would help prevent an increase in payment declines as enforcement of these requirements ramps up across banks in the EU.
The EBA’s opinion published today the expected guideline and it sets the deadline and the process for completing migration to SCA for e-commerce card based transactions. In order to be able to make a well-informed decision as to the most appropriate deadline and the actions that the industry should take until then, the EBA and NCAs carried out a fact-finding survey in July and August 2019. The survey was sent to issuing PSPs, acquiring PSPs, and EU and national merchants and consumer associations. Following this survey, the EBA is of the view that migration plans of PSPs, including the implementation and testing by merchants, should be completed by 31 December 2020, namely a period of about 15 months as of 14 September 2019. Furthermore, the EBA recommended that, where required, NCAs communicate to PSPs in their jurisdiction that the supervisory flexibility they have exercised after 14 September 2019 does not represent a delay in the application date of the SCA requirements in PSD2 and the EBA’s Technical Standards. Rather, it means that NCAs will focus on monitoring migration plans instead of pursuing immediate enforcement actions against PSPs that are not compliant with the SCA requirements before 31 December 2020.
Furthermore, the EBA notes that consumers will be protected against fraud as required by the law and NCAs should, therefore, communicate to their PSPs that the liability regime under Article 74 of the PSD2, applies without delay, and that issuing and acquiring PSPs are therefore still liable for unauthorised payment transactions. For this reason, as explained by the EBA, PSPs have a self-interest to migrate to SCA-compliant solutions and approaches in an expedited way.
Finally, the EBA sets out the action to be taken by the NCAs during the migration period and the related deadline for each action which should allow the NCAs time to ensure that PSPs follow their migration plans and that they keep track of the progress made. These actions are divided into two categories: (i) towards the issuing PSPs and (ii) towards the acquiring PSPs, and the EBA Opinion sets out specific deadlines for each, which need to be adhered to.
If you need legal and/or regulatory advice in relation to the above or other payments related legal topic we are available to assist.