The FCA obtained an extended deadline for the implementation of SCA in the UK. From what you have seen so far, did this additional time have any benefits over the payment ecosystem in the country in terms of disruption to consumers, merchants, and PSPs?
The extended deadline for the implementation of SCA allowed breathing space for the UK retailers and PSPs to properly tackle spikes in online volume due to the pandemic, followed by prioritising the SCA implementation in accordance with the new timeframe, which we know is June 2021 for soft-declines and September 2021 when hard declines will start kicking in. Without this extension, there would have been a harsher impact to businesses due to hard declines in an already difficult time, adapting to the pandemic circumstances.
Thus far, we have seen large UK merchants and PSPs take the lead and deploy 3Dsv2 on production. This early adaptor role we believe is due to the level of online volume processed. The more online volume, the higher the impact to the business. We also see these large merchants being the first to either adopt or explore exemptions. Since the deadline hasn’t hit yet, there are still merchants waiting to monitor the performance of 3DSv2 compared to v1 to incorporate an exemption strategy. The PSPs tend to go at the pace of merchant demands. Therefore, we believe they are also currently incorporating their exemption strategy to prepare for higher demand from merchants in Q4 2021. We look forward to seeing the results more in Q4 to properly evaluate the outcome of acceptance rates due to 3DSv2 and the adoption of exemptions.
It will also be interesting to see the impact of heavier cross-border sectors, such as travel, hospitality, and ticketing, once transactions start to increase again, hopefully in 2022.
Moreover, do you have any insights into the technical readiness of issuers and acquirers? Are there any milestones to achieve to support merchants and consumers in a timely manner?
In general, where the UK already had a leg up to begin with was the sophisticated implementations of Risk Based Authentication within the ecosystem. This has allowed for a solid fundament to exist whilst large players test for results, while also having a fallback in the form of keeping challenge rates low. This also poses a slight risk as there is a sophisticated safety net which can decrease the sense of urgency in this rollout and testing phase.
One key challenge still being widely discussed in the UK landscape is issuer readiness. We were hoping the SCA extension would also benefit issuers by being compliant in parallel with merchants rolling out 3DSv2. Hopefully by September 2021, issuer readiness improves. From what we can see, the majority of large UK issuers are either ready or will be by the deadline.
However, the ACS latency challenge is impacting the UK ecommerce landscape and is causing uncertainty. Leaving merchants to either process the transaction in a non-secure manner (which they would be liable for) or declining these transactions, which would have direct impact on not only their revenue, but the issuer’s revenue as well, causing frustration. The ecosystem only profits out of successfully authenticated transactions.
The current challenges we see around the implementation of 3DSv2 makes clear how critical a proper authentication is for the successful checkout process.
Besides the fact that the mandate of 3DSv2 has to be fulfilled, we highly encourage the issuing market to also think of fallback and alternative solutions:
Besides the implementation of 3DSv2, issuers should also incorporate a proper exemption strategy, which Netcetera could support with.
Scheme step-in programme: authenticate the customer, take liability in the merchant’s stead, removing friction for the customer. The downfall is the extra cost for the issuers and the lack of sustainability.
Incorporate the right monitoring in place to identify any areas of improvement and track overall performance.
In January 2021, the FCA published a consultation paper on the changes to the SCA-RTS. In Chapter 4, the regulator drafted specific changes related to SCA elements and Transaction Risk Analysis. What is your take on the suggested changes? Are there any chances to be implemented?
The changes introduced to SCA have been under consultation until end of April 2021. The changes under discussion are six main points that address the need for AISPSPs and e-money issuers to adopt/modernise the SCA protocol. This is mainly to support competition and innovation.
A change in SCA that we have seen as part of the SCA-RTS requested optimisation in SCA is the increase of the contactless transaction limit from GBP 45 to GBP 100 (some retailers even set to GBP 120). The UK payments landscape has seen a quick adaption across retailers and PSPs in respect to the change request.
The fact that the FCA is actively proposing tweaks based on opportunities in the market is a positive development. Building upon a fundament of SCA-RTS and suggesting modifications to increase payment and fintech friendliness is important and the FCA is doing a great job here.
Will Brexit have any impact on PSD2? Maybe leave some wiggle room for more amendments?
Brexit has already impacted financial firms in the UK with looming issues over servicing EU consumers, as the previous passporting possibilities are now under pressure. For the most part, large players have already set up operations in other jurisdictions despite the EU and UK trying to figure out if there is still any deal possible. Smaller players will be at the mercy of any kind of pending agreement reached somewhere in 2021.
We have also seen the schemes increase the interchange fees for acquirers and merchants. These fees are likely to be passed onto the cardholder, creating more momentum for merchants to seek other forms of online payments than traditional cards. So, where there is heavy cross-border business there are major challenges.
UK merchants and PSPs that conduct most of their business locally have more of an advantage to adapt what works best for their business without being fully tied to EU regulations. However, the FCA has made SCA a UK mandate, therefore 3DSv2 is still being seen and treated as a mandate regardless of Brexit.
The UK is still a powerhouse in the fintech and payments market and shows little signs of slowing down, as the government recently announced more focus on stimulating this sector. I believe there is an opportunity here to implement smart modifications in terms of regulation with an easier road to receiving approval. In this case, the roles would be reversed and the EU could potentially look at the UK in forward thinking regulation changes that adapt as the market keeps evolving.
How Netcetera further supports the merchants and PSPs in the SCA implementation journey?
As an EMVCo board member, we are the technical bridge between the scheme, the issuer, and the payment provider, enabling secure and convenient issuing and acquiring. An increasing number of providers are transforming from issuing to acquiring or vice versa (see for instance Stripe becoming an issuer) and in turn they become their customers’ direct competitor. Netcetera allows the ecosystem to benefit from specialised technology and full flexibility in serving the whole ecosystem with state-of-the-art payment technology.
As a payment technology provider, we are gaining insights daily from different stakeholders. We are able to compare data and translate that into recommendations. We are also a global player, allowing us to compare markets such as the Middle East, Europe, and the Americas.
Another example is the 3DS testing platform that we have launched together with Mastercard. This allows merchants to test 19 scenarios pertaining to frictionless flows, challenge flows, and exemptions.
Last but not least, I think our position of having 15+ years of experience in the 3DS space but with systems that have been designed and built in recent years could be best compared to an old soul in a young body.
We are ready to help the market upgrade their PSD2 strategy with forward thinking game changers like SCA, 3DS2, exemptions, Secure Remote Commerce, and beyond.
About Jeffrey Reinders
Jeffrey Reinders has been working in the payments industry for the last 6 years and is currently responsible for the UK and Ireland division of Netcetera’s Digital Payments Division. He previously worked in the acquiring space at FiServ-EMS and was involved in consulting merchants on growing their business by simplifying their payments stream.
Jeffrey is responsible for helping financial institutions, payment players, issuers, processors, banks, and fraud providers with their 3DS challenges. As an independent and agnostic provider offering solutions for all major schemes, Netcetera is of the belief that everybody deserves digital payment excellence in an ever challenging PSD2 landscape.
About Netcetera
Netcetera is a global software company with cutting-edge IT products and individual digital solutions in the areas of secure digital payment, financial technologies, healthcare, and insurance. Netcetera is headquartered in Zurich, Switzerland, with locations across Europe, Asia, and the Middle East.
Every day we send out a free e-mail with the most important headlines of the last 24 hours.
Subscribe now