Various commentators have noted that many businesses seem late in discovering that they need to get ready for what is called Strong Customer Authentication (SCA) – a requirement of the European Union’s PSD2 – the ongoing upgrade of the Payment Services Directive.
News site CTM File notes a new report from security software provider Iovation, built on research from a firm called Aite Group. It concludes that the stricter rules for fraud prevention could drive crime to other parts of the world, such as the United States.
Risk their payment provider license
Payment service providers (PSPs) in the European Economic Area (EEA) are obliged to comply with the directive’s requirements for strong customer authentication (SCA) by September, and to enable third-party access to bank accounts. Else, they leave their payment provider licence at risk.
Even so, the report refers to a study by Mastercard, recently finding that only a quarter of Europe’s online merchants are aware of SCA requirements under PSD2. 14 percent were found to already support SCA, while 28 percent said they will be ready by September. Yet a full 24 percent had no plans for supporting SCA.
Hits companies across the world
Since all companies who provide payment services in the EEA fall under this regulation, even businesses with headquarters outside Europe might need to adhere to it.
“The zeitgeist of regulations with extra territorial effect like the general data protection regulation (GDPR) continues with PSD2,” says Iovation’s compliance manager Mark Weston, according to the CTM File news piece.
“This will have long-standing operational implications to companies wherever they are based.
For a good introduction to PSD2 and its effects on companies, there are several out there. A web page by JP Morgan, although published as far back as 2017, is one rich but easily digested example.