European Banking Authority Publishes Opinion on Strong Customer Authentication Deadline for E-Commerce Card Payments

The European Banking Authority has published an opinion stating its expectation that national regulators should enforce strong customer authentication requirements on e-commerce card-based payment transactions by December 31, 2020. The Opinion also describes the actions that regulators should take in the lead up to this deadline to ensure compliance. The EBA’s Regulatory Technical Standards on strong customer authentication and common and secure communication, published in accordance with the revised Payment Services Directive, came into force on March 14, 2018 and have applied directly in all Member States since September 14, 2019. In response to questions on the SCA requirements, the EBA also published an Opinion in June 2019, setting out market approaches to payment authentication that would be deemed compliant with the new SCA rules. The EBA acknowledged that some market participants may struggle to comply with the SCA requirements and allowed national regulators to grant e-commerce card-based payment transaction providers additional time to migrate to SCA approaches.

The EBA’s latest opinion makes clear that, as of December 31, 2020, payment services providers should have completed their implementation of migration to SCA approaches. National regulators should enforce SCA standards from this date. Ahead of that deadline, the EBA expects national regulators:
 

• By December 31, 2019, to require PSPs to identify their compliant and non-compliant approaches to authentication and to inform national regulators about how they intend to ensure compliance; 
• To require PSPs to communicate with payment services users and e-merchants about technological changes that will be required to support SCA on a continuous basis and to notify their national regulators of any such communications every three months (commencing on December 14, 2019);
• By March 31, 2020, to complete a review of PSPs’ overall readiness to meet SCA requirements by gathering data on their activities for the period between September 14, 2019 - March 13, 2020;
• To require PSPs to report on the progress they have made toward SCA compliance between March 14 - June 13, 2020 and June 14 - September 13, 2020, delivering reports by June 30, 2020 and September 30, 2020 respectively; and
• To have completed their migration plans by December 31, 2020.

View the EBA's Opinion.
 
View details of the EBA's June 2019 SCA Opinion.
 
View details of the EBA's RTS on SCA.
 
Return to main website.