Payment service providers to migrate to SCA by 31/12/2020 for card based payment transactions
PSD II - Payment services – Strong customer authentication (SCA) - Migration
SCA (strong customer authentication) is imposed by PSD II, the revised Payment Services Directive that was published in November 2015, entered into force on 13 January 2016 and applies since 13 January 2018. This directive brings fundamental changes to the payments market in the EU. It requires amongst others SCA to be applied, according to the implementing technical regulation standards, as of 14 September 2019 by payment services providers (PSPs), when carrying out remote electronic transactions.
According to PSD II, SCA is an authentication based on the use of two or more of the following elements : 1) knowledge (something only the user knows, e.g. password), 2) possession (something only the user possesses, e.g. a device such as a card reader, hardware or software token) and 3) something inherent to the user (, e.g. his/her fingerprint, voice, iris scan, hart beat). These elements should be independent, in that the breach of one does not compromise the reliability of the others, and should be designed in such a way as to protect the confidentiality of the authentication data. According to PSD II, SCA is to be applied to all electronic payments, unless one of the exemptions applies.
In an earlier opinion EBA already indicated, following concerns of some market players regarding compliance by the set date that, on an exceptional basis and in order to avoid unintended negative consequences for some payment service users after 14 September 2019, NCAs may decide to provide limited additional time to PSPs of card based payment transactions. This is to allow issuers to migrate to authentication approaches that are compliant with SCA and acquirers to migrate their merchants to solutions that support SCA. This supervisory flexibility was made available under the condition that PSPs have set up a migration plan, have agreed the plan with their NCA, and will execute the plan in an expedited manner.
In the opinion of 16 October 2016 EBA now sets the deadline for the migration to SCA to 31 December 2020. The EBA opinion also prescribes the expected actions to be taken during the migration period.