On 13 August 2019, the FCA announced an 18 month plan to implement the Single Customer Authentication (SCA) rules under the revised Payment Services Directive (PSD2) for the e-commerce industry of card issuers, payments firms and online retailers.
The announcement reflects the recent opinion of the European Banking Authority (our blog is here) which acknowledged that some firms not directly subject to the PSD2 (such as e-merchants) might not be ready for the SCA application date of 14 September 2019. The EBA accepted that, on an exceptional basis, Member States could provide such stakeholders with limited additional time.
The FCA announcement also states that the regulator will not take enforcement action against firms if they do not meet the relevant requirements for SCA from 14 September 2019 in areas covered by the plan, where there is evidence that they have taken the necessary steps to comply with the plan. At the end of the 18-month period, the FCA expects all firms to have made the necessary changes and undertaken the required testing to apply SCA.
For online banking, the FCA states that the SCA rules will be phased in from 14 September 2019 and completed by 14 March 2020.