A new month – a new announcement on Strong Customer Authentication (SCA)

For those businesses dealing with card transactions, the last few months have been confusing, starting with the expectation all year that the implementation of PSD2 on 14 September 2019 would require all transactions to comply with the requirements of Strong Customer Authentication. (Covered in a previous article in the Treasurer magazine.)

Given industry feedback and mounting concern over business readiness, the European regulator (the EBA) announced in August that national regulators like the FCA may give some firms extra time to implement SCA. In its Dear CEO letter of 20 August[1], the FCA noted that:

“To support the orderly transition to SCA and avoid a negative impact on consumers and merchants, we will not take enforcement action against firms simply because they do not meet the relevant requirements for SCA from 14 September 2019 in areas covered by the agreed plan.”

The scope of the decision is limited to card not-present e-commerce transactions and only applies to firms that can show they are complying with the UK Finance co-ordinated plan to deliver SCA by 14 March 2021[2].

Then on October 16 2019, the EBA announced that the period for the implementation of (SCA) will be 15 months, from the 14 September 2019 and that SCA must be applied to all electronic payments within the European Economic Area (EEA) by 31 December 2020[3].

Part of the announcement recognised that the large majority of stakeholders preferred a consistent and harmonised implementation of SCA with regard to e-commerce card-based payment transactions, with a single common deadline. This was thought to avoid otherwise negative impacts on cross-border payments, the decline of legitimate payment transactions, customer drop-out, level playing field issues across jurisdictions, regulatory arbitrage and further complexity.

What should I be doing?

Most companies using cards to process incoming or outgoing payments should have already been in discussions with your card processors.

Check:

• If you have 3D Secure V1 in place check your plans to upgrade to 3D Secure V2. This is a simple upgrade and your payment gateway provider will assist you with the details.
• If you have not used 3D Secure before, it might involve more work for you or your developer. Do not delay, it is important that you speak with your gateway provider or web developer to understand what is involved
• If you were not ready for September 14 2019, are your revised plans in line with the plan agreed by UK Finance with the FCA (see above)?

_____________________________________________________________

[1] https://www.fca.org.uk/publication/correspondence/dear-ceo-letter-strong...

[2] https://www.ukfinance.org.uk/area-of-expertise/payments/strong-customer-...

[3] https://eba.europa.eu/sites/default/documents/files/documents/10180/2622...