Several European sources say the European Commission will adopt regulatory technical standards (RTS) on strong client authentification and a common secured communication for the revised payment services directive (PSD2) on Monday 27 November. The final version of the RTS was not yet known on Friday 24 November and stakeholders are worried about its content.
As announced in a previous article (see EUROPE 11907), the Commission is considering keeping an emergency solution that allows 'screenscraping' when dedicated 'Application Programming Interfaces' (API) are not available for more than 30 seconds, after five attempts to connect or if it does not respect the requirements laid down for interfaces. Screenscraping is highly criticised because it allows third-party providers to access the bank details of a consumer buying products online and grants payment without first getting his or her consent.
In a press release published after a meeting of its bureau, the European Banking Federation reiterated its opposition to this practice: "Policymakers should not permit screen-scraping even as a fall-back, as a way for third-party service providers to access client data and instead should focus on fully secure solutions."
Speaking on behalf of the European Commission at a meeting of the European Parliament’s economic and monetary affairs committee on Tuesday 21 November, Ralf Jacob from the Financial Services Directorate said that following a number of complaints from the bank industry, the Commission has included an incentive for banks. Banks developing an API that works properly at least three months before application of RTS will be able, following an assessment by the competent national authorities, to be exempt from the requirement to set up this fall back solution.
The stakeholders are not happy with strong client authentification. In a press release issued on 21 November, the organisation Ecommerce Europe expressed disappointment with the current measures. The European Consumer Union Bureau (BEUC) says RTS contain too many exemptions that weaken security for consumers. (Original version in French by Marion Fontana)