On 5 April 2022, the European Banking Authority (EBA) issued a final report on the amendment to the regulatory technical standards (RTS) on strong customer authentication (SCA) and secure communication under the revised Payment Services Directive (PSD2). The final report follows a consultation paper that the EBA published last March which set out proposed targeted amendments to the RTS on SCA and secure communication.
The EBA has developed these draft amending RTS in accordance with Article 98(5) of the PSD2, which provides that the EBA shall review and, if appropriate, update the RTS on SCA and secure communication on a regular basis in order, inter alia, to take account of innovation and technological developments, and also in accordance with Article 8(1)(ka) of the EBA Founding Regulation, which provides that the EBA shall publish on its website, and update regularly, all its regulatory technical standards.
The draft amending RTS introduce a new mandatory exemption to SCA that will require account providers not to apply SCA when customers use an account information service provider (AISP) to access their payment account information, provided certain conditions are met. The amendment aims to reduce frictions for customers using such services and to mitigate the impact that the frequent application of SCA and the inconsistent application of the current exemption have on AISPs’ services.
Following the responses to the earlier consultation the EBA has extended the timeline for account servicing payment service providers (ASPSPs) to make available to AISPs the changes to their interfaces from 1 month to 2 months before the implementation of these changes and extended the overall implementation period from 6 months to 7 months after the publication of the amending RTS in the Official Journal of the EU (OJ). The EBA has also introduced some additional clarifications on the application of the mandatory exemption.
The draft amending RTS will be submitted to the European Commission for endorsement following which it will be subject to scrutiny by the European Parliament and the Council before being published in the OJ. As mentioned above the draft amending RTS will apply 7 months after entry into force.