When and where does SCA come into force?

When will SCA take effect and what countries does it apply to?

When does SCA come into force?

SCA (as part of PSD2) is a European-wide requirement and will be required for any applicable transaction where both the business’ payment service provider and the payer’s bank or card provider are located within the European Economic Area (EEA). If one of these is outside Europe, the requirement is for the payment service provider in Europe to use ‘best efforts’ to apply SCA.

This means that even if a business is headquartered outside the EEA, if they take online payments from payers in the EEA, those transactions may still be subject to SCA.

It is highly likely that SCA will continue to apply to the UK, regardless of the outcome or timing of Brexit; the FCA has made its plans clear - it wants SCA to continue to apply; there has been no suggestion to the contrary by other European regulators.

The European Banking Authority's role in SCA

The European Banking Authority (EBA) is an independent EU Authority which works to ensure effective and consistent prudential regulation and supervision across the European banking sector. Its overall objectives are to maintain financial stability in the EU and to safeguard the integrity, efficiency and orderly functioning of the banking sector.

The EBA has released Regulatory Technical Standards (RTS) that outline the full remit of SCA for the EEA.

However, competent authorities from individual EEA countries, such as the FCA in the UK or BaFin in Germany will be responsible for enforcing SCA when it comes into force.

When does SCA take effect?

SCA is currently planned to come into force across the European Economic Area from the 14 September 2019.

However, on 21 June 2019, following pressure from industry bodies across the EU, the EBA confirmed that EU Regulators (such as the FCA) may "work with PSPs and relevant stakeholders, including consumers and merchants, to provide limited additional time to allow issuers to migrate to authentication approaches that are compliant with SCA".

This means that some PSPs may be allowed a delayed roll out, otherwise known as an ‘operational readiness’ period, during which the FCA and other regulators may not take enforcement action.

The overall timeline for any delayed roll out is still being finalised, but it has been suggested it will last approximately 18 months from September 2019 - the initial planned date for the new requirements coming into force.

‹ View table of contents Next page ›

Latest features

Security vs. convenience in the payment experience: What matters most to online shoppers?

We surveyed 4,000 customers across the UK, France, Germany and Spain about their attitudes to security and convenience when shopping online. Get all the insights here.

The new CFO: How 4 CFOs have seen their roles evolve

Hear from the CFOs at GoCardless, SideTrade, The FD Centre and Wolffepack as they discuss how the role has evolved – with insight into the challenges and opportunities they face in a changing financial landscape.

How to scale a fintech: Strategic advice from industry leaders

Learn from the leaders of Monzo, TransferWise, Funding Circle and more, with over 30 pieces of wisdom for scaling your fintech. Get your free copy now.

View all

Reference guides

View all