EBA outlines changes to strong customer authentication

22 Feb 2017 03:07 PM

A speech from EBA chairperson has given some details on final changes to RTS for PSD2.

The European Banking Authority (EBA) has announced that, following a highly controversial consultation, it will relax the requirements for strong customer authentication (SCA) under the PSD2.

In a speech recently, Andrea Enria, the Chairperson of the European Banking Authority, described planned changes its draft Regulatory Technical Standards (RTS) on how online payments should operate under the PSD2. The final version of the RTS is expected to be released in a few days along with an 100-page list of all comments raised in the consultation and the EBA's response.

The PSD2 gave the EBA the task of determining the balance between security of online payments and ease of use for the consumer by imposing requirements on when strong customer authentication must be used - i.e. when, for example, customers will have to enter additional information (such as a PIN number or a verified by Visa type passcode) to authenticate themselves when they make a payment. It is key to note that the RTS will have direct effect in national law – i.e. there will be no implementation law at national level: the requirements will apply in the UK as they are written by the EBA.

The main changes to the draft RTS announced by Mr Enria are as follows:

• There will be two new exemptions: (i) when ‘transaction risk analysis' is used - the automated tracking of consumer’s habitual types of payment and (ii) for unattended terminals (such as transport or parking). This will be reviewed, to check it is sufficiently secure, 18 months after the RTS come into force.
• The threshold past which SCA must be used is increased from €10 to €30. 
• The practice of 'screen scraping' (also called 'direct access') will be banned once the RTS come into force.
• Banks will be required to provide a dedicated interface for TPPs to access customer information which has the same level of availability and performance as the interface customers use to access their own online banking.

The final RTS have to be approved by the European Commission and the European Parliament, and the Commission has been heavily involved in the changes now announced. If, however, the Parliament were still not satisfied, it is possible for them to reject (but not amend) the standards and send them back to the EBA for further revision.

The full version of Mr Enria speech is here.

techUK is planning a seminar to discuss the detail soon after the final RTS are released – keep an eye out on the website for further details.