Out of PSD2’s three main objectives – improving payments security, innovation, and competition – only the first one (security) has been achieved. Unfortunately, PSD2 governance has not fostered innovation and competition to the degree we were hoping for. Whilst it has opened the market to some extent where banking was closed before, like in the UK or Southern Europe, it had the opposite effect in other countries, where banking was more open before, like the Nordics, Germany, and Austria for example.
ASPSPs and TPPs have invested huge sums of money and time in trying to make a regulatory approach work under PSD2. Both were unnecessarily ‘forced’ into creating and using new (API) technology, which in most cases was badly implemented either on purpose or by ignorance. PSD2 has proven that ‘good APIs’ cannot be enforced and that regulation must remain technology-neutral. It should stipulate and incentivise good outcomes, but stay mute on how these can be best achieved. Contingency should not only be allowed but required and no single interface should be granted a monopoly status. This does not mean, however, that any additional interface is needed. On the contrary, fallback must be to the existing customer interfaces, and ASPSPs should be forbidden to modify them in any form for TPPs.
The ultimate beneficiaries of better and more reliable services will be the consumers and merchants of course, but there is some way to go. Despite several years of PSD2 API implementation we still aren't seeing a successful and coherent implementation of PSD2 that fintechs can succeed on. ETPPA has worked relentlessly on documenting and disclosing API obstacles in order to encourage their removal. Sadly, this has not been easy. Thankfully, the Commission’s proposal on PSR stipulates their removal, but that is many years away, and we will surely see new ones getting added in the meantime. I must repeat: ‘good APIs’ cannot be enforced, they must be incentivised.
ETPPA welcomes the proposals on PSD3/PSR, as an opportunity to make Open Banking work, based on lessons learned, and thereby bring more competition and lower fees to consumers and merchants across Europe. Moving to a regulation is also quite a positive step forward and this will hopefully iron out fragmentation issues. That said, there are still some improvements TPPs would like to see.
Under PSD3 we believe that pre-existing PISP licences and AISP registrations should be subject to an automatic authorisation by default, and exempted from the need to seek a new authorisation/ registration.
On PSR, the following is needed to ensure the right balance is struck to foster competition and innovation as well.
Mandate payment certainty functionality: similar to card payments, ASPSPs should be required to immediately confirm that PISP-initiated payments will be executed so that PISPs can compete on a level playing field.
Prevent new obstacles: any list of obstacles must be non-exhaustive and the authorities must be enabled to identify and make additions to the list at short notice.
No SCA for account access: once a TPP has been mandated with an initial SCA, any subsequent access is secured with its eIDAS certificate, not the customer’s credentials anymore.
Competition oversight: competition authorities should be given a more leading role in supervision (as is the case elsewhere). The mandates of the EBA and NCAs should be amended to include innovation and competition objectives.
Open up mobile instant payments: this requires IBAN proxies (mobile, email, etc.) to be added to the definition of unique account identifiers.
Replace the concept of ‘dedicated interfaces’ with ‘machine-to-machine interfaces’: API technology is currently the best technology for the provisioning of account access, but no single (dedicated) API should be given a monopoly status. AISPs and PISPs must be allowed to use any available machine-to-machine interface, including the APIs used by ASPSPs to serve their own customers (e.g. mobile bank app APIs), which often have much better performance.
The PSD2 review, together with the proposed EU instant payments regulation, provides the opportunity to regain our world-wide lead in Open Banking by fostering our EU champions and leveraging the capabilities they have developed over the past two decades. This requires outcome-focused regulations, which avoid any unnecessary technical limitations and instead allow more innovation from more fintech players. This will be extremely beneficial to consumers and merchants in the European Retail Payments arena.
At the same time, EU policymakers need to ensure that positive steps forward in payments are not undone by disproportionate legislation elsewhere, such as the proposed AML regulation. Here, ETPPA and other fintech associations have called on the co-legislators to ensure a level playing field amongst all fintech providers when it comes to their obligations to perform customer due diligence on their customers and not to place illogical or overly burdensome obligations on fintechs that do not apply to other payment service providers.
This editorial piece was first published in the Open Finance Report 2023. We encourage you to download the report and find out the latest trends and developments in the world of Open Banking and Open Finance, as the road to Open Data continues.
Ralf Ohlhausen is founder of PayPractice advising PSPs, notably PPRO and Tink, on PSD2/3 and Open Banking. He chairs ETPPA, co-chairs the Berlin Group’s Open Finance Advisory Board and is a member of the ECB Digital Euro Rulebook Development Group.
ETPPA is the European trade association of Third Party Providers (TPPs) under PSD2 and beyond. It represents TPP interests vis-à-vis EU authorities and across various European multi-stakeholder groups in support of creating an innovative and level playing field for TPPs.
Every day we send out a free e-mail with the most important headlines of the last 24 hours.
Subscribe now