On 28 June 2019, the FCA published its response to the European Banking Authority’s (EBA) opinion on strong customer authentication (SCA) under the revised Payment Services Directive (PSD2) (our blog is here).

The FCA’s statement notes that the EBA’s opinion allows the FCA to give some firms extra time to implement SCA. Whilst the legal deadline for complying with the Regulatory Technical Standards on SCA is 14 September 2019, the FCA recognises the challenges in meeting this deadline and is working with industry to develop a plan to migrate the industry to implement SCA for card payments in e-commerce as soon as possible after this. The FCA aims to quickly agree a plan with stakeholders across the industry that encompasses a blueprint for compliance and readiness, a timetable for achieving this, and key milestones and targets to deliver improved security of customer authentication and fraud reduction along the way. Once the plan is finalised the FCA expects all participants to meet the agreed milestones, targets and final delivery date.

The FCA adds that it will not take enforcement action against firms if they do not meet the relevant requirements for SCA from 14 September 2019 in areas covered by the plan, where there is evidence that they have taken the necessary steps to comply with the plan.