When does SCA come into force?
SCA (as part of PSD2) is a European-wide requirement and will be required for any applicable transaction where both the business’ payment service provider and the payer’s bank or card provider are located within the European Economic Area (EEA). If one of these is outside Europe, the requirement is for the payment service provider in Europe to use ‘best efforts’ to apply SCA.
This means that even if a business is headquartered outside the EEA, if they take online payments from payers in the EEA, those transactions may still be subject to SCA.
It is highly likely that SCA will continue to apply to the UK, regardless of the outcome or timing of Brexit; the FCA has made its plans clear - it wants SCA to continue to apply; there has been no suggestion to the contrary by other European regulators.
The European Banking Authority's role in SCA
The European Banking Authority (EBA) is an independent EU Authority which works to ensure effective and consistent prudential regulation and supervision across the European banking sector. Its overall objectives are to maintain financial stability in the EU and to safeguard the integrity, efficiency and orderly functioning of the banking sector.
The EBA has released Regulatory Technical Standards (RTS) that outline the full remit of SCA for the EEA.
When does SCA take effect?
SCA is currently planned to come into force across the European Economic Area from the 14 September 2019.
However, on 21 June 2019, following pressure from industry bodies across the EU, the EBA confirmed that EU Regulators (such as the FCA) may "work with PSPs and relevant stakeholders, including consumers and merchants, to provide limited additional time to allow issuers to migrate to authentication approaches that are compliant with SCA".
This means that some PSPs may be allowed a delayed roll out, otherwise known as an ‘operational readiness’ period, during which the FCA and other regulators may not take enforcement action.
The overall timeline for any delayed roll out is still being finalised, but it has been suggested it will last approximately 18 months from September 2019 - the initial planned date for the new requirements coming into force.‹ View table of contents Next page ›