The UK’s Financial Conduct Authority (FCA) is to give industry an extra six months to implement new rules aimed at boosting the security of payments and reducing fraud, due to coronavirus.
The FCA said the aim of delaying the implementation of Strong Customer Authentication (SCA) rules for e-commerce is to “minimise potential disruption to consumers and merchants” during the pandemic, in a statement announcing the delay.
The new SCA rules will introduce what is known as ‘two-factor authentication’ for e-commerce, meaning that payments will require people to provide two of three means of verifying their identity: something they have (for example, a card or mobile phone); something they know (such as a pin number or mobile phone access code); or something they ‘are’ (a fingerprint or their face, verified using recognition software).
The new rules were due to come into force on 14 March 2021 in the UK, but have now been postponed six months to 14 September 2021.
This is the second postponement of the implementation of SCA, which has its origins in the European Union’s Second Payment Services Directive (PSD2). The rules were originally intended to come into force last September, but the FCA was among the authorities across Europe falling in line with a view from the European Banking Authority (EBA) that national regulators could give providers more time for implementation.
UK diverges from Europe
The UK’s SCA implementation timeline is different to that of the 27 states of the EU, with the European Banking Authority (EBA) continuing to hold to a 31 December 2020 implementation date, despite industry lobbying for a pushback.
The European Payment Institutions Federation (EPIF) – an association founded in 2011 in response to the adoption of the original PSD – wrote to the EBA on 24 April calling for the EBA and European Commission to pause SCA implementation for at least six months because of “the exceptional circumstances” of coronavirus. Ten other trade associations and relevant stakeholders co-signed the letter, which said: “The COVID-19 crisis has significantly reduced the capacity available to progress SCA development and implementation. This is particularly true in the travel and hospitality sectors, and others which have either closed down entirely or been hard hit by the lockdown. The exceptional circumstances of this disease [are] putting an additional strain on the limited resources for all parties involved in the payment chain.”
However, an EBA spokesperson told Global Government Forum this week that it was “not envisaging any measures in addition to those already communicated”. On 25 March, it issued a two-page statement on Consumer and payment issues in light of COVID-19 that included the removal of an obligation for National Competent Authorities (NCAs) to report by 31 March 2020 their readiness to meet SCA requirements.
On the call for a UK-style postponement, the EBA spokesperson said: “We are aware of the views of the industry actors. We continue to monitor the situation to assess what, if any additional measure is required. The EBA has not consented to the approach the UK FCA has taken.”
Elie Beyrouthy, chair of the executive board of EPIF, told Global Government Forum this week: “We will keep providing the EBA with relevant data and statistics to show the level of merchants’ readiness. Our aim is to protect e-commerce and avoid a negative impact for both consumers and merchants.”
The Central Bank of Ireland this week told the Irish Times that it was taking guidance from the EBA and was sticking with the European deadline.
FCA looks to UK Finance for implementation plan
In the UK, firms that fail to comply with SCA requirements after 14 September 2021 will be subject to “full supervisory and enforcement action”, the FCA said.
The FCA added in its announcement that it expects industry body UK Finance “to discuss the detailed phased implementation plan and critical path with all stakeholders and agree it with the FCA as soon as possible” and that “in the meantime, firms should continue with the necessary preparatory activities such as robust end-to-end testing”.
A UK Finance spokesperson told Global Government Forum: “The industry has acted quickly to support both consumers and retailers as much as possible through the COVID-19 crisis and this includes ensuring that any large-scale changes such as SCA do not impact retailers’ day-to-day business, allowing them to focus on what they need to at this difficult time.”
