CBI welcomes deadline extension to Strong Customer Authentication in payments

The CBI recognised the need for extra time to roll out the new regulatory technical standards for Strong Customer Authentication (SCA) across the card payments systems in the EU. This is the final phase of implementation of the Payment Services Directive 2 (PDS2) and was due to be fully implemented by 14 September 2019.

SCA is applicable when a customer (individual or corporate) accesses their payment account online, when making an electronic payment, or carrying out any action through a remote channel which may imply a risk of payment fraud or other abuses.

The new measures under PSD2 require additional authentication (based on knowledge, possession or inherence) during the payment process for electronic payments. This is both online and face-to-face, including contactless card transactions.

Avoiding potential fallout

CBI members raised concerns about the lateness of the final regulatory technical standards in December 2018, their complexity, and how little time had been granted for the development of solutions. Their testing and final implementation across the payments eco-system were also primary concerns. In addition to this, awareness of the potential disruption to businesses across the different sectors of UK the economy was very low.

The focus of the CBI’s works has been on highlighting to the Financial Conduct Authority (FCA) the potential economic impact of SCA on the UK economy. Had the deadline remained unchanged, its implementation could have resulted in significant economic disruption caused by card issuers being forced to decline non-compliant transactions after September.

The CBI has consistently emphasised the need to consider these measures from a whole economy perspective and has called the regulators to consider the negative impact this may have on payment transactions, UK consumer spending and trust in the payment systems.

What happens now

Following discussions with the regulators, industry players, sector associations and European partners, the European Banking Authority recently (21 June) issued an opinion  recognising how the challenges of SCA implementation could lead to some actors in the payments chain not being ready by September. The authority then granted the national competent authorities the ability to set their own implementation periods.

This paved the way for the FCA to provide some flexibility in implementation in the UK and on 28 June, the regulator published its statement informing they were delaying the enforcement of SCA to give firms some more time to prepare.

Moving forward

The CBI is now working with UK Finance, British Retail Consortium, Vendorcom and the card schemes to support the industry roadmap for the implementation of SCA in the UK. This roadmap, led by UK Finance, will provide a phased approach to implementation to achieve full compliance, along with a communications campaign for consumers and merchants.

This flexible implementation to SCA has prevented millions of potential losses to UK firms across many economic sectors  - particularly retail, hospitality, travel and leisure.

The CBI continues to lobby at EU level with Business Europe for a unified final implementation date across the EU. This will prevent potential disruption in cross-border digital transactions and ensure that consumers will not face different SCA rules and therefore potential payment declinations.