After-effects of PSD2

What PSD2 Means

The Payment Services Directive (PSD2) affects online payment transactions and credit card payments in particular. Its goal is to provide greater security for all parties involved in online payment transactions. On the one hand, it increases security in the payment process through Strong Customer Authentication; on the other hand, it eliminates legal uncertainties by adapting the legal framework to new market developments.

Under PSD2, as of 14/09/2019, users must authenticate for certain transactions using Strong Customer Authentication. This generally applies to accesses to the online account, the initiation of a customer-driven electronic payment transaction, and transactions with potential for fraud.

Strong Customer Authentication means that at least two of the three factors—possession (e.g. card or smartphone), knowledge (e.g. PIN or security question), and inherence (fingerprint, facial recognition)—must now be requested. To increase security in online payment transactions on the one hand, but keep the process consumer-friendly on the other, PSD2 permits exceptions. For example, this applies to accessing account transactions for up to a maximum of 90 days.

Account-servicing banks are now obligated to grant third-party providers access to the account via a new interface (Access to Account, XS2A) if the customer has previously given consent to the third-party provider for access. The interfaces and the implementation of exceptions present challenges for banks, which is why third-party providers are temporarily permitted access via the old interface.

Card-issuing payment service providers such as American Express, VISA, and MasterCard must likewise implement Strong Customer Authentication. By incorporating PSD2 requirements into their international 3D Secure 2 standard, if successful, PSD2 could also be translated into applicable law in non-EU countries.

PSD2 legally defines various third-party providers and creates new classes of payment service providers. Such new payment service providers include payment initiation service providers like PayPal and account information service providers that, for example, query customer creditworthiness. Through the open interface, they can now access customer accounts following customer consent.

Why PSD2 Is Still Occupying Stakeholders

The implementation of PSD2 was supposed to be fully completed by 14/09/2019. However, meeting the deadline presents difficulties for several parties involved, which is why PSD2 continues to occupy stakeholders even after the cutoff date. This applies in particular to companies that receive card payments. However, open interfaces also present challenges for banks, leading BaFin to request improvements from account-servicing banks in this context.

Therefore, in a press release dated 21/08/2019, BaFin extended the deadline to ensure that online payment processes remain smooth for customers. Companies that did not implement PSD2 by 14/09/2019 will not be held liable, provided they can prove they are working on implementation. The current level of security is to be maintained until implementation under PSD2 is complete. When this transition period expires will be announced by BaFin in consultation with other European supervisory authorities. In the meantime, BaFin urges stakeholders to adapt their infrastructures to PSD2 as quickly as possible.

Outlook

While stakeholders are still busy implementing PSD2, the industry is already anticipating adjustments in the form of PSD3. This is exemplified by the Berlin Group—a joint working group that set the goal of unified XS2A interfaces—which leaves room for future adaptations due to changing legal requirements.

What is clear is that PSD2 in its current form already forces banks to deal with market trends to which they had not paid sufficient attention in the past. While innovative FinTechs were already threatening banks' business models beforehand, PSD2 now intentionally intensifies competition even further. Banks must develop new business models.