Response to public hearing on the Consultation paper on the amendment of the RTS on SCA&CSC under PSD2
Go back
We feel that if the exemption is going to be mandatory and for such an extended period of time, then the PSUs must have an easily accessible way to revoke the consent if they wish. This will help reduce potential fraud or unauthorized accesses to the account.
We would also like to confirm our interpretation that if this proposal is implemented as it is, the existing tokens already issued at the time the new exemption applies will remain unchanged until they expire.
We would like to propose increasing the timeline to 12 months, but keeping the 3-month advance period to make the changes available for AISPs for testing. This way ASPSPs will have 9 months to implement, which we feel should be enough in most cases, and TPPs will have the usual 3 months to adapt to the changes instead of just 1. We think this is a more realistic approach that increases the chances of having a smooth transition to the new scenario.
Q1. Do you have any comments on the proposal to introduce a new mandatory exemption for the case when the information is accessed through an AISP and the proposed amendments to Article 10 exemption?
Making the exemption mandatory implies a loss of control on the part of the ASPSPs’, who would not be able to establish a shorter timeframe according to their policies and risk appetite. To compensate for this, we think there should be stricter requirements for the TPPs to offer a clear and easy to use process to manage and revoke consents. Several ASPSPs have reported that customers sometimes contact them to ask how they can revoke a consent, because the TPP in question does not inform clearly of this process. In that regard, we suggest that the ASPSPs should be allowed to manage consent revocation in cases when the TPP does not provide or communicate an easy process to do it.We feel that if the exemption is going to be mandatory and for such an extended period of time, then the PSUs must have an easily accessible way to revoke the consent if they wish. This will help reduce potential fraud or unauthorized accesses to the account.
We would also like to confirm our interpretation that if this proposal is implemented as it is, the existing tokens already issued at the time the new exemption applies will remain unchanged until they expire.
Q3. Do you have any comments on the proposed 6-month implementation timeline, and the requirement for ASPSPs to make available the relevant changes to the technical specifications of their interfaces not less than one month before such changes are required to be implemented?
In our opinion, the proposed timeline is too short. It would mean that ASPSPs would have only 5 months to implement the necessary changes in their APIs. Although the change proposed may seem relatively easy, in our experience the time involved in planning, developing and testing any change can amount to several months, as it needs to be fit into the ASPSP’s technical development schedule, along with other competing priorities. This could cause that some ASPSP’s may find it hard to meet this timeline and risk not having the change ready for the deadline.We would like to propose increasing the timeline to 12 months, but keeping the 3-month advance period to make the changes available for AISPs for testing. This way ASPSPs will have 9 months to implement, which we feel should be enough in most cases, and TPPs will have the usual 3 months to adapt to the changes instead of just 1. We think this is a more realistic approach that increases the chances of having a smooth transition to the new scenario.