• Remi Puissant, Banking & Payment Digital Strategy Manager at Gemalto


• 01.12.2017 07:30 am
undisclosed

After months of discussions and debates, Regulatory Technical Standards for PSD2 have been finally approved by the European Commission. The next steps are now the adoption – or rejection – of the RTS by the European Parliament & Council within the next three months. Assuming they’re not rejected, they’ll come into force 18 months later, so banks have until September 2019 to be ready.

The revised RTS standards are a major step towards the market transformation that PSD2 promises to deliver. This final version is a good compromise between the European Banking Authority’s initial position and the first feedback from the fintech community, which had been very concerned about the impact on their business models. The core principles of the RTS – i.e. Strong Customer Authentication (SCA), Secured Communication, Risk Management and Transaction Risk Analysis (TRA) – have been maintained, confirming the directive’s security objectives.

Now the rules are clear, it will be very interesting to watch banks and fintechs’ reaction, and how they plan to combine the directive’s twin objectives of consumer protection and enhanced competition to create new and compelling user experiences. Of particular interest is the fact that the redirection model for SCA is may no longer be sufficient, as it’s now defined as a potential obstacle to the provision of Third Party Payment Service Provider (TPP) services if imposed. This alone should pave the way to new innovative SCA scenarios which offer better integration between TPPs and banks. Open APIs will become the new standard for communication between TPPs and banks, but the clock is ticking – banks will have to make sure they are ready by March 2019, six months before the RTS come into force.

“In essence, the rules of entry for innovation in financial services have been set. Banks have just over a year to ready themselves for a newly defined environment, alongside their fintech partners and competitors. In a context of Open Banking, increasingly strict data protection legislation and now a new set of rules for financial services innovation centred around consumer protection, the triple challenges of disruption, innovation and compliance will hang in a delicate balance. To achieve this, guidance from experts is essential.