EBA consults on the amendment to its technical standards on SCA and secure communication in relation to the 90-day exemption for account access

The European Banking Authority (EBA) launched today a public consultation on the amendment of its Regulatory Technical Standards (RTS) on strong customer authentication and secure communication (SCA&CSC) under the Payment Services Directive (PSD2) with regard to 90-day exemption from SCA for account access. The consultation runs until 25 November 2021.

The proposed amendment aims at addressing a number of issues that the EBA has identified in the application of the exemption by some account servicing payment service providers (ASPSPs) across the EU Member States and which have resulted in a negative impact on the services offered by account information service providers (AISPs) under the PSD2; Particularly in cases where ASPSPs have not made use of the exemption and request SCA for each account access, or where they request SCA more frequently than every 90-days, as allowed by the RTS.

To address the impact of these issues on AISPs’ services, the EBA is proposing to introduce a new mandatory exemption from SCA for the specific use case when the access is done through an AISP that is subject to certain safeguards and conditions aimed at ensuring the safety of the customers’ data.

For the other separate case where customers access the data directly, the EBA is proposing to retain the exemption in Article 10 to be voluntary as is currently the case, as no specific issues have been identified in such cases. 

However, in order to ensure a level playing field amongst all payment service providers, the EBA is also proposing to extend the 90-days timeline in Article 10 of the RTS on SCA&CSC for the renewal of SCA to the same 180-day period for the renewal of SCA when the account data is accessed through an AISP.

The amendments proposed in this consultation paper are those that the EBA is legally in a position to make to address the issues identified. Other mitigations to address other issues are conceivable but would require changes to the Directive itself, which is beyond the EBA’s powers.

Consultation process

Responses to this consultation can be sent to the EBA by clicking on the „send your comments” button on the consultation page. Please note that the deadline for the submission of comments is 25 November 2021.

A public hearing will take place online on 11 November 2021 from 10 to 12 CET.

All contributions received will be published after the consultation closes, unless requested otherwise.

Legal basis and background

Article 98(1) of the PSD2 mandated the EBA to develop regulatory technical standards specifying, among others, the requirements of SCA and the exemptions from the application of SCA. In fulfilment of this mandate, the EBA has developed the RTS on SCA&CSC that were published in the Official Journal of the EU on 13 March 2018 as an EU Delegated Regulation and apply as of 14 September 2019.

The EBA has developed these draft amending RTS in accordance with Article 98(5) of the PSD2, which provides that the EBA shall review and, if appropriate, update the regulatory technical standards referred to in Article 98(1) PSD2 on a regular basis in order, inter alia, to take account of innovation and technological developments, and also in accordance with Article 8(1)(ka) of the EBA Founding Regulation, which provides that the EBA shall publish on its website, and update regularly, all its regulatory technical standards.

___________

Consultation paper on amending RTS on SCA and CSC under PSD2

Regulatory Technical Standards on strong customer authentication and secure communication under PSD2

Payment services and electronic money