New security requirements for banking payment services

The revisedEU Payment Services Directive (PSD2), which entered into force on September 14, aims to further modernize Europe’s payment services for the benefit of consumers and businesses. It brings several major consumer benefits such as tackling fraud in online payments, strong security requirements for electronic payments and for the protection of consumers' financial data to ensure their privacy is respected by all market operators.

PSD2 obliges payment service providers to apply so-called “strong customer authentication” (SCA) when a payer initiates an electronic payment transaction. The requirements of strong customer authentication across the EU will help reduce the risk of fraud for online payments and online banking, and protect the confidentiality of the user's financial data, including personal data. This means that European consumers will benefit from safer electronic payments.

Banks and other payment service providers will have to put in place the necessary infrastructure for SCA. They will also have to improve fraud management.

Whenever a payer initiates an online transaction above €30, the SCA will be applicable. Exemptions include low value payments for remote (online) transactions below €30, as well as contactless payments at point of sale - whereby the amount of a single transaction must not exceed €50 and the cumulative amount of previous contactless payments since the last time SCA was performed (e.g. by inputting the card PIN) does not exceed €150. Other categories of exemptions concern corporate payments.

Among other consumer benefits, there is the improvement of the complaint procedure. PSD2 obliges Member States to designate competent authorities to handle complaints from payment service users and other interested parties, such as consumer associations, if they consider their rights established by the Directive have not been respected. Payment service providers should put in place a complaints procedure for consumers which can be used before seeking out-of-court redress or before launching court proceedings. Payment service providers are obliged to respond in written form to any complaint within 15 business days.

Source:European Commission