FCA publishes changes to 90-day reauthentication rule for Open Banking

Currently, consumers opting in to open banking services that give external parties such as apps or peer-to-peer lending platforms access to their main bank account must reconfirm permission every 90 days.

The 90-day reauthentication rule has proved controversial as it had to be done through the user’s bank, which critics said could cause friction.

It has instead shifted the requirement to reauthenticate every 90 days to the third-party provider (TPP) which is accessing the service.

That means a user of a fintech app won’t be sent back to their bank every 90 days to reauthenticate and give permission for their data to be accessed. It will instead be done by the open banking technology provider.

The FCA argued this would be “less burdensome” for customers as it claimed that requiring authentication through a customer’s bank “increases the likelihood of customers dropping off.”

The financial firms providing payment services such as banks and credit card providers now have 18 months to put a dedicated interface in place that can be accessed more easily by TPPs for open banking services.

“The proposed SCA-RTS amendments will help remove barriers to continued growth, innovation, and competition in the payments and e-money sector, in particular for open banking,” the FCA said.