EBA publishes Opinion on the deadline and process for SCA migration for e-commerce card-based payment transactions
On 16 October 2019, the European Banking Authority (EBA) published an Opinion on the deadline and process for the completion of the migration to Strong Customer Authentication (SCA) under the revised Payment Services Directive 2015/2366 (PSD2) for e-commerce card-based payment transactions (Opinion). Although the Opinion is directed towards NCAs, it will also be useful to Payment Service Providers (PSPs), card schemes and payment service users, including merchants.
The Opinion follows the publication of the earlier 21 June 2019 opinion of the EBA on the elements of SCA. The June opinion acknowledged that National Competent Authorities (NCAs) may provide limited additional time for e-commerce card-based payment transactions to allow card-issuing PSPs to migrate to authentication approaches that are compliant with SCA and acquiring PSPs to migrate their merchants to solutions that support SCA.
The latest EBA Opinion seeks to communicate the extension of the period of supervisory flexibility for the migration plans of PSPs as well as testing by merchants, from 14 September 2019 to 31 December 2020. This extension of the deadline follows responses from firms stating that they would prefer at least 18 months to effect a “smooth” migration of their e-commerce card-based payment ecosystem to SCA-compliant approaches and solutions as well as a “consistent” and “harmonised” implementation of SCA under a “single common deadline”.
The EBA considered the above responses and acknowledged that the suggestion of an extended deadline was in anticipation of the completion of the 3DS v.2.2 communication protocol currently under development by some of the major card schemes. This protocol would provide for the application of all SCA exemptions as set out in the Regulatory Technical Standards as well as transactions currently out of the scope of SCA requirements. An example of such a transaction being payee initiated transactions. However, the EBA also found that most issuing and acquiring PSPs in half of the EU member states would “be ready with SCA-compliant solutions and approaches by the end of 2019”.
The EBA also recommended in the Opinion that where necessary, NCAs should communicate to PSPs within their jurisdiction that the supervisory flexibility granted by the EBA does not amount to a delay in the application date of the SCA requirements in PSD2 and the RTS, as the requirements would still apply from 14 September 2019 onwards. NCAs however, will not take enforcement actions against PSPs should they comply with the milestones and expected actions found within the Opinion. In addition, the Article 74 PSD2 liability regime establishing a PSPs liability for unauthorised payment transactions will still apply and NCAs should communicate this fact to PSPs accordingly.
The Opinion also sets out “milestones” and “expected actions” from NCAs towards issuing PSPs and acquiring PSPs in the build-up to the new 31 December 2020 deadline of the SCA migration period. These tables of actions conclude with the EBA producing both a report on the status of SCA-compliance by issuing PSPs and a report on the status of SCA-compliance by acquiring PSPs, to be delivered by the EBA in Q1 of 2021.
Contrastingly, NCAs in France, Denmark and the UK have already announced a timeframe of 18 months of regulatory forbearance. Whether these NCAs will now revise these time horizons to be consistent with the EBA’s Opinion of 12 months is yet to be determined.