Final and translated into the EU official languages
These Guidelines clarify a number of issues identified by market participants and competent authorities in relation to the four conditions to be met to benefit from an exemption from the fallback option envisaged under Article 33(6) of Regulation (EU) 2018/389 (RTS) on strong customer authentication and common and secure communication (SCA and CSC).
The European Banking Authority (EBA) published today an Opinion on obstacles to the provision of third party provider services (TPPs) under the Regulatory Technical Standards (RTS) on strong customer authentication (SCA) and common and secure communication (CSC). The Opinion aims to support the objectives of the revised Payment Services Directive (PSD2) of enabling customers to use new and innovative payment services offered by TPPs by addressing a number of issues regarding the interfaces provided by account servicing payment service providers (ASPSPs) to TPPs.
Today’s Opinion clarifies when mandatory redirection is an obstacle to the provision of TPPs’ services and the authentication procedures that ASPSPs’ interfaces are required to support. The Opinion also provides clarifications on a number of obstacles identified in the market, including requiring multiple SCAs, the manual entry of the IBAN in the ASPSPs’ domain, or imposing additional checks of the consent given by the customer to the TPP. The Opinion also explains that requiring re-authentication every 90 days for account information services in accordance with the RTS on SCA&CSC is not an obstacle.
With this Opinion, EBA expects that Competent Authorities (CAs) take the necessary actions to ensure compliance of the interfaces offered by ASPSPs with the PSD2 and the RTS and, where obstacles are identified, to ensure that ASPSPs remove them within the shortest possible time. The EBA will monitor the way in which the clarifications provided in this Opinion are taken into account. Where the EBA identifies inconsistencies, despite the clarifications provided in this Opinion, it will take the actions needed to remedy them.
PSD2 entered into force on 13 January 2016 and applies since 13 January 2018. The Directive enables payment service users to use account information services and payment initiation services offered by TPPs, and requires ASPSPs to establish the access interfaces through which TPPs can access the customers’ payment accounts in a secure manner.
Article 32(3) of RTS on SCA &CSC requires ASPSPs that have implemented a dedicated interface to ensure that the interface does not create obstacles to the provision of payment initiation and account information services. With today’s Opinion, the EBA responds to requests for clarification as to whether certain market practices constitute such obstacles.
The EBA issued the Opinion in accordance with Article 29(1)(a) of its Founding Regulation, which mandates the Authority to play an active role in building a common Union supervisory culture and consistent supervisory practices, as well as in ensuring uniform procedures and consistent approaches throughout the Union.
The European Banking Authority (EBA) published today its final Guidelines on the conditions that account servicing payment service providers (ASPSPs) must meet in order to be exempted from the obligation to implement the fallback mechanism under the Regulation (EU) 2018/389 on strong customer authentication and common and secure communication (RTS on SCA&CSC). The Guidelines aim at providing clarity to ASPSPs and national competent authorities (CAs) regarding the elements that should be considered for the purpose of an exemption and at ensuring a consistent application of the conditions for an exemption across the 28 EU Member States.
These final Guidelines aim at specifying the conditions set out in Article 33(6) of the RTS, which must be met in order to be exempted from the obligation to implement the fallback mechanism. These conditions, which were included by the European Commission in the draft RTS submitted by the EBA, raised a number of practical questions and requests for clarifications by market participants. The Guidelines also clarify how CAs should consult the EBA, particularly in the crucial period leading up to the date of application of the RTS, on 14 September 2019.
Based on the feedback received during the consultation phase, the EBA has amended the draft Guidelines in a number of areas. In particular, as regards the involvement of TPPs in the exemption process, the EBA clarified that, for the purpose of the exemption, ASPSPs will need to show TPPs' involvement in the design and testing of their dedicated interfaces and provide the CA with the feedback they received from TPPs that have participated in the testing, together with an explanation of how the ASPSP has addressed any issues identified during the testing.
Furthermore, the final Guidelines clarify that in assessing whether an ASPSP fulfils the ‘wide usage' condition, CAs should take into account not only the number of TPPs that have used the ASPSP's production interface but also additional factors, including how much the interface has been used by TPPs, the steps that the ASPSP has taken to achieve ‘wide usage', the feedback received by the ASPSP from the TPPs that have participated in the testing and how any issues identified have been resolved.
With regard to the obligation for ASPSPs to publish data on the availability and performance of their interfaces, the final Guidelines clarify that ASPSPs should publish such data in a way that enables TPPs and payment service users (PSUs) to compare the daily availability and performance of the dedicated interface with those of the interfaces made available by the ASPSP to its own PSUs.
The EBA acknowledges that the timelines for meeting the conditions for an exemption are tight and, therefore, strongly encourages ASPSPs to start testing, to launch their production interfaces and to engage with their CA as soon as possible before the September 2019 deadline. While acknowledging that these Guidelines cannot address all issues that may possibly arise during the assessment process, both the EBA and CAs remain committed to continue supporting the industry to meet the timelines set by RTS and achieve the objectives of PSD2.
These Guidelines are issued in accordance with Article 16 of the EBA founding regulation and Article 33(6) of the RTS. The Guidelines specify the conditions that are set out in Article 33(6) of the RTS and that are to be met by ASPSPs that have opted for a dedicated interface in order to be exempted from the obligation to set up the contingency mechanism described in Article 33(4) of the RTS. The Guidelines further provide guidance on how CAs should consult the EBA for the purposes of the exemption in accordance with Article 33(6) of the RTS.