Interview with Payments Europe on industry readiness towards implementation of Strong Customer Authentication

Following the release of a position paper on industry readiness towards implementation of Strong Customer Authentication (SCA), The Paypers has sat with Payments Europe to find out what triggered the paper

Some context: Strong customer authentication (SCA) is a requirement of the EU Revised Directive on Payment Services (PSD2) on payment service providers within the European Economic Area. The requirement ensures that electronic payments are performed with multi-factor authentication, to increase the security of electronic payments. Physical card transactions already commonly have what could be termed strong customer authentication in the EU (Chip and PIN), but this has not generally been true for internet transactions across the EU prior to the implementation of the requirement, and many contactless card payments do not use a second authentication factor.

The SCA requirement came into force on 14 September 2019. However, with the approval of the European Banking Authority, several EEA countries have announced that their implementation will be temporarily delayed or phased, with a final deadline set for 31 December 2020.

However, considering the current pandemics the deadline has suffered some modifications. In a letter dated 24 April 2020 to the European Banking Authority, the industry has called for a delay to the implementation of Strong Customer Authentication of at least six months. While EMV 3DS implementation is progressing across Europe, it is now clear that the COVID-19 crisis has significantly reduced the capacity available to progress Strong Customer Authentication development and implementation. As a result, the UK Financial Conduct Authority has currently set a deadline for 14 September 2021.

How does the current public health crisis impact the payments landscape in Europe?

The COVID-19 crisis is impacting the European payment landscape in several ways. Overall, it has accelerated an already known trend, that is, the digitalisation of payments. Governments have been advising against the use of cash and consumers and merchants have become more reluctant to use and accept cash in order to limit the spread of the pandemic. Instead, health authorities and retailers have been advising to pay with contactless cards. As a result, consumers and merchants are becoming more familiar with contactless transactions, in particular in those countries where the uptake was still limited. This is even more so, since many banks – encouraged by governments - have decided to raise the limit of contactless transactions. It is worth pointing out that Payments Europe encourages a diverse and competitive market and that we believe cash is a necessary option for consumer to choose for.

The crisis’ measures resulted in people buying more online and, in turn, using online payment methods – some of which they never used before. As such, we have seen a diversification of the use of online payment options. 

However, as commerce in general has decreased as a result of COVID-19, digital payments are also impacted negatively and less transactions are made.

Which business sector/group of payments ecosystem participants is most impacted/hit and how can European authorities help?

The COVID-19 pandemic is an unprecedented crisis that impacts all parties in the payment’s ecosystem. Merchants in particular have been significantly impacted by the current crisis. Huge numbers of merchants are struggling to stay in business, with small merchants especially being affected. Many will be putting all their efforts into making necessary changes to deal with the effects of the crisis on their business models, supply chains, and fulfilment of orders.

Necessary public health measures to control the spread of COVID-19 mean that consumer shopping is required to adapt, and consumers are relying more than ever on ecommerce for essential purchases.

The payments industry is also reprioritising its efforts and resources to maintain the stability of the system and support customers through the crisis. At the same time, the industry is working hard to respond effectively and efficiently to society’s new needs with offering new solutions.

The necessary redirection of focus in each area of the ecosystem has a direct impact on the many co-dependencies between parties that must work together to implement Strong Customer Authentication (SCA). This results in an overall reduction in the industry’s capacity to deliver SCA as a whole. As such, several actors in the payments value chain have called to extend the current implication deadline in order to focus its efforts on where it is need to most. Payments Europe is fully supportive of timely SCA implementation. However, given the circumstances, Payments Europe joins other industry groups in inviting the EBA and national regulators to give the ecosystem more time to the adopt the SCA requirements, beyond the current 31 December 2020 for implementation.

Focusing strictly on SCA, while working hard towards the deadline, the payments value chain has expressed challenges about the difficulty to implement safe, tested, and functional two-factor authentication by year-end. What are the levels of readiness of issuers/acquirers/merchants when it comes to implementing 3DS2.0? Can you name some banks already supporting 3DS2.0?

According to data from one of our members, we can see that usage of EMV 3DS (version 2.1 or higher) across Europe is low, at just under 5% of total 3DS transactions. The growth of EMV 3DS usage largely stalled in mid-March 2020 when the COVID-19 crisis escalated, impacting merchant’ capacity for risk and change. This data supports the need for a review of the timeline of implementation.

What is the impact of this delay for consumers and merchants? (Will the levels of fraud be on the rise?)

If SCA is implemented on 1 January 2021, it can be expected that the technology implementation will be incomplete. This will result in significant disruption for a variety of reasons and likely to lead to high abandonment rates. This unnecessary friction will have a severely negative impact on consumers and merchants. Consumers are more dependent than ever on ecommerce, especially vulnerable customers who need to isolate at home. Merchants, and small merchants in particular, therefore cannot risk further reduction in sales due to any potential disruption to remote payments. In the current climate, it is absolutely necessary to avoid potential confusion and a negative consumer experience, which could lead to a lasting loss of confidence in online payments.

In relation to fraud, we are not expecting a surge due to a limited delay in the application of the rules. It is important to note that card payments are one of the most secure payments methods and that consumers in most cases have zero liability in the unlikely event that fraud occurs.

Payments Europe calls upon a harmonised approach by regulators. Could you please share more details on how do you envisage it?

Indeed, Payments Europe highlights the importance to have a harmonised approach across Europe. A non-harmonised approach, where the dates are not aligned between European countries, may result in transactions being declined. In order to achieve this, Payments Europe calls upon further discussion with the EBA and National Competent Authorities to reach a joint approach for implementation.

About Payments Europe

Payments Europe, a trade association established in Brussels, represents the card-based payments industry and is made of 15 members. Our mission is to promote a better understanding of the complexity and inherent value the four-party card scheme business model brings to all parties in the payment ecosystem. More information: www.paymentseurope.eu

About Robrecht Vandormael

Robrecht is Secretary General at Payments Europe, the association that represents the European card-based payments industry. Together with its founding members, Robrecht set up and launched the association in 2019. He is now responsible for setting the strategic direction and the day-to-day management.