Why rethinking SCA renewals will benefit Open Banking

New Regulatory Technical Standards on strong customer authentication and common and secure communication (SCA-RTS) required by PSD2 are about to come into force. Why have they been changed?

SCA-RTS underpins and regulates the security requirements for account access under PSD2. It requires banks (ASPSPs) to implement Secure Customer Authentication (SCA) for access to individual accounts.  Although safeguarding users, there were some concerns that SCA leads to increased friction when using digital services and apps.  While an SCA exemption already existed for account information service providers (AISPs), there was no consistency in how banks applied this in their PSD2 APIs across the EU. 

The amended SCA-RTS will go some way to addressing this - removing barriers and helping to harmonise the standards on an individual bank level while also making certain markets more available (eg France and Italy).  At the same time, it will make it easier for those in the Open Banking, payments, and e-money sector to deliver smoother experiences and better products without compromising user security. 

So what are the biggest changes?

There are three key amendments that must now be implemented over the next 8-14 months: 

1. SCA renewal extension

Where account information is accessed through an AISP or directly by the customer, the period for when the payment service user (PSU) has to perform SCA again to reauthenticate has been extended from 'every 90 days' to 'every 180 days'.  

2. Mandated exemption

Account providers will not apply SCA every time a customer uses an AISP to access or manage their payment account information – if certain conditions are met.

3. Voluntary exemption scope (in Article 10 RTS) 

This is now limited to where customers access their account information directly. It means that the ASPSP is free to decide if they want to apply the SCA exemption when the customer is accessing their account information directly through the bank's own online banking portal or mobile banking app. Basically, ASPSPs are not obliged to let the PSU log in without SCA to the online banking portal.

What does this mean for banks and third-party providers (TPP)?

It should make things a lot smoother for customers and those delivering digital or mobile banking services.  For instance, doubling the time interval required between SCA renewals through ASPSPs will save consumers a lot of time and reduce friction when using TPP services. It will make open banking more appealing for convenience-orientated consumers and mobile app users. Hopefully, we will also see more businesses and TPPs look to create dedicated interfaces so they can offer better and more secure services to more customers.  

What positive consequences are there for open banking applications?

The changes guarantee a consistent application of the SCA exemption for AISPs across the whole EU. That means that we can now get 180 days of account access for all banks we're connected to, not just in Sweden or Germany - but also in France and Italy where we've seen the most problems.  In addition, the prolonged consent period will give TPPs more control from within their apps to access and manage multiple banks and accounts. We can also expect more B2B use cases as the SCA renewal extension makes OB more viable for daily and “out of business hours” tasks. It should also help improve PSU retention as they won’t have to go through the SCA flow on a daily basis or get frustrated by constantly having to give their consent.

You just launched a new OB brand Klarna Kosma, how does this help build on RTS changes?

We see Klarna Kosma as a gamechanger.  It packages up Klarna’s disruptive DNA, proven platforms, APIs, and tools and lets us share them with others so they can build their own innovative OB use cases.  We want to free potential innovators from the complexity of connecting secure multiple data points, so they can focus on turning exciting OB ideas into reality.  And, at the same time, supporting them with the expertise they need to ensure that their services are PSD2 and SCA-RTS compliant.  Kosma also connects them effortlessly with 15,000 banks and fintechs in 24 countries, so they can more easily monitor, report, forecast and predict customers’ financial actions.

Is it just banks that can benefit from Kosma?

Of course, we’ll work with banks and fintechs, but we also want to support big merchants and financial management software companies and AISPs who are also starting to use OB. Klarna Kosma does the heavy lifting so they can bring insight-based financial products and account-based services to market sooner and at a much lower cost. That also means allowing them to take full advantage of the new SCA-RTS changes to rethink and re-energise OB services.  

About Luc Bleijlevens

Luc Bleijlevens has years of experience in the payment industry holding various roles at different fintech companies. He worked for several years at Cleeng, a subscription billing platform. Before that he was responsible at Ingenico ePayments for the GTM of their alternative payment offering and omnichannel solutions. He is now jointly responsible for the commercial success of Klarna Kosma.

About Klarna Kosma

Klarna Kosma makes game-changing ideas powerfully real. Launched in 2022, Klarna Kosma is Klarna’s Financial Technology Platform for banks, fintechs, and innovative merchants, which are developing payment services or need access to financial data to create their own solutions benefitting the end-user. Our proven and mature platform provides essential connectivity to a growing network of more than 15,000 banks in 24 countries through a single Open Banking API. We process more than 200 million transactions a year and are the most extensive Open Banking platform in the world. For more information, visit www.kosma.com.