Payments Briefing

New deadline for strong customer authentication – will it bring clarity or confusion?

In the latest chapter of the long running saga of strong customer authentication (SCA),  the European Banking Authority (EBA) has published its new deadline of 31 December 2020 for applying SCA for e-commerce card-based payments. This EBA Opinion of 16 October 2019 supersedes its previous deadline of 14 September 2019, with flexibility for national regulators as to migration timescales.

Since our September payments briefing, we have seen a flurry of announcements from national regulators clarifying their preferred approach to SCA. To date, national regulators' approach to transition timescales has been varied, with some choosing not to offer any flexibility at all and others announcing migration plans lasting as long as 3 years.

In light of industry concern (particularly in terms of how any inconsistencies might affect cross-border payments), the EBA has recommended that national regulators take a consistent approach to the SCA migration period to ensure a harmonised implementation of SCA for online payments.

The EBA's new Opinion brings a number of key points into focus for payment service providers (PSPs) and e-commerce merchants. In addition to the new recommended deadline of 31 December 2020 for PSPs' migration to SCA, the EBA has clarified that any flexibility exercised by national regulators represents a non-enforcement period. Hence, the SCA requirements apply from 14 September 2019 but the enforcement regime will not need to be applied for another 15 months.

While the Opinion provides some clarity by encouraging a consistent approach toward the SCA migration period, it still leaves a number of questions unanswered. For example:

• How will the new deadline affect jurisdictions (such as the UK and France) who have previously announced longer non-enforcement periods?
• Will jurisdictions with longer non-enforcement periods maintain them or bring the deadline forward to December 2020 in line with the EBA's recommendations?
• How will cross-border payments be affected if certain jurisdictions decide not to follow the EBA's recommendations (i.e. if that jurisdiction decides to implement a shorter non-enforcement period)?

Merchants will also need to engage with the revised timelines. Among other things, they may need to review whether their agreements with PSPs need to be updated for the transition period (and beyond) and assess how they perform fraud management to fit with the SCA regime.

The Opinion also flags that, while PSPs may not be penalised for failing to implement SCA during a national regulator's non-enforcement period, the liability regime under Article 74 of the PSD2 will still apply. So there is an incentive for PSPs to apply SCA in order to avoid liability for unauthorised payment transactions.

Looking ahead, we would anticipate that national regulators (such as the UK's Financial Conduct Authority) are likely to respond to the latest EBA Opinion in the coming weeks. Hopefully these announcements will provide greater clarity as to how the deadline will be worked out in practice.

The Fieldfisher Payments and Cards team has continued to support many clients in their SCA preparations and migration plans across Europe. For further detail, please contact John Worthy or your usual Fieldfisher contact.