Before the end of November, the European Commission will adopt the final regulatory technical standards (RTS) on strong customer identification and a common and secure communication concerning payment services, a European source told EUROPE on Thursday 16 November.
Readers may recall that the RTS, which were drafted in the framework of the revised 'payment services' directive (PSD2), have been the subject of many differences of opinion between banks and FinTech companies, the e-commerce industry and consumer associations, but also between the Commission and the European Banking Authority (EBA). All of these skirmishes have had the consequence of delaying the Commission's adoption of the RTS.
This summer, the 'common and secure communication' plank of the RTS continued to split the crowd (see EUROPE 11939). The Commission hopes to authorise the backup option of 'screen-scraping' if the application programming interface (API) is not available for more than 30 seconds, after five attempts to connect or if it is not meeting the obligations applicable to interfaces.
Banks are required to set this interface in place to allow external payment service providers to have access to the bank data of a client, having received that client's explicit consent.
This option has come under heavy fire from the banks, as it will allow external service providers to access the bank account data of consumers purchasing a product online and making a payment to them, without first having obtained their prior consent.
This has also been challenged by the EBA, which proposed the alternative of tightening up the requirements to make interfaces more efficient, for instance through an obligation upon banks to define performance indicators and carry out functioning examinations on the interfaces and a number of emergency measures if the API is inaccessible.
According to our information, the definitive RTS do indeed retain an emergency solution of this kind, but not the EBA's alternative proposals. The Commission is reported to consider that not authorising 'screen-scraping' if the API is unavailable could end up slowing the rise of FinTech companies proposing new payment solutions.
Once the RTS are adopted by the Commission - most likely on 24 November - the European Parliament and the Council will have three months to issue objections. According to our information, no objection or deadline extensions are anticipated.
The technical standards will not, however, apply until 18 months after their publication in the Official Journal of the EU, in order to give banks the time they will need to develop APIs, thereby creating a considerable time lag with the deadline for the member states to transpose the PSD2 directive, which is 13 January 2018. (Original version in French by Marion Fontana)