The EBA blinks first …

EDIT: since posting this blog the UK’s FCA has confirmed our expectation that it won’t be enforcing SCA on the 14^th September as long as the participants are aiming to comply with a soon to be announced migration plan. In the meantime it’s “working with the industry to develop a plan to migrate the industry to implement SCA for card payments in e-commerce as soon as possible”.  See: https://www.fca.org.uk/news/statements/fca-response-european-banking-authority%E2%80%99s-opinion-strong-customer-authentication

The doom-laden headlines appearing in the press have, it seems, worked and the EBA has decided to replace the 14^th September deadline for the introduction of SCA with … another deadline. Only they won’t tell us what it is, presumably we have to figure it out for ourselves.  

So, let’s see what the EBA has done now …

Firstly, they haven’t actually changed the date as they can’t, it’s written into EU law. But given dire warnings of a collapse in online payments they’ve come up with a fudge:

The EBA therefore accepts that, on an exceptional basis and in order to avoid unintended negative consequences for some payment service users after 14 September 2019, CAs may decide to work with PSPs and relevant stakeholders, including consumers and merchants, to provide limited additional time to allow issuers to migrate to authentication approaches that are compliant with SCA, such as those described in this Opinion, and acquirers to migrate their merchants to solutions that support SCA.

https://eba.europa.eu/documents/

Let’s summarise that. National regulators – competent authorities (CAs) – may work with PSPs (Issuing and Acquiring banks) and unregulated actors (merchants, consumers) to agree to delay the introduction of SCA. Which presumably means unprepared merchants and confused consumers are breathing a sigh of relief. Unfortunately, as this is now in the hands of local regulators there’s no guarantee at all that this will be applied evenly, opening up the possibility that some countries will enforce and others (notably the UK and France) will not.

On top of that, there’s no guarantee that Issuers won’t apply SCA anyway, even if their local regulator permits them to not do so. So merchants who are unprepared may still find themselves suffering random declines. And, furthermore, if Acquirers haven’t implemented the necessary changes then even if the merchants are compliant they may still have transactions irrevocably declined.

Note also the “limited additional time” clause. Frankly, introducing SCA prior to the critical holiday shopping period was foolish anyway (but was an unintended consequence of the 18 month implementation period following the adoption of the RTS), so we can assume that the date will be pushed out at least into early or mid 2020. The EBA adds (but not in the actual Opinion):

In order to fulfil the objectives of PSD2 and the EBA of achieving consistency across the EU, the EBA will later this year communicate deadlines by which the aforementioned actors will have to have completed their migration plans.

And that’s the catch:

This supervisory flexibility is available under the condition that PSPs have set up a migration plan, have agreed the plan with their CA, and execute the plan in an expedited manner. CAs should monitor the execution of these plans to ensure swift compliance with the PSD2 and the EBA’s technical standards and to achieve consistency of authentication approaches across the EU.

Basically, Issuers and Acquirers need to publish what they’re going to do including how they’re going to communicate the requirements to consumers and merchants respectively. Quite how this is all going to be co-ordinated is unclear – no sensible merchant is going to disadvantage themselves by unilaterally turning on SCA when its competitors aren’t. Issuers may take the same approach, as they probably don’t want their cardholders switching to other banks: but there’s no requirement on them to do so.

The rest of the opinion focuses on the validity of various authentication factors. That’s interesting too, but we’ll look at the implications of it another day.

The one thing this does allow is for 3DS-2.2 to be made ready. That’s an advantage to smart merchants who can at least develop a proper, low friction SCA strategy. In the meantime, we’re looking forward to getting involved in lots of migration planning.