In response to concerns raised by the industry, the European Banking Authority (EBA) agreed on Friday 21 June to show some flexibility in its supervision of the implementation of the regulatory technical standards (RTS) on strong customer authentication under the revised Payment Services Directive (PSD2), applicable from 14 September next.
In an opinion, the EBA begins by reiterating that it is legally not able to postpone an application date that is set out in EU law. It also underlines that industry had sufficient time to prepare for the introduction of strong customer authentication measures, as a definition was included in the proposal for the PSD2 Directive as early as 2015.
However, the opinion acknowledges the complexity of the payments markets across the EU and the challenges arising from the changes that are required, in particular by actors that are not payment service providers (PSPs) and, therefore, not directly subject to PSD2 and the EBA's technical standards, such as e-merchants, which may lead to some actors in the payments chain not being ready on time.
The EBA, therefore, accepts that, on an exceptional basis and in order to avoid unintended negative consequences for some payment service users after 14 September 2019, that the competent national authorities may decide to grant "limited additional time" to certain payment service providers.
"This supervisory flexibility is available under the condition that PSPs have set up a migration plan, have agreed the plan with their NCA, and will execute the plan in an expedited manner", it clarifies.
Later this year, the EBA will communicate the timelines within which these providers must complete their migration plans towards compliant strong customer authentication. (Original version in French by Marion Fontana)