PSD2: how will the final RTS requirements impact you? All banks operating in the EU are subject to compliance by August 2019

On November 27, 2017, the European Commission published its final Regulatory Technical Standards (RTS) on Strong Customer Authentication (SCA) and Common and Secure Communication (CSC) under PSD2. With the release of the final PSD2 RTS requirements, banks of all sizes can now take action to develop a compliance strategy and implement effective security solutions for electronic remote payment transactions.

The Revised Payment Services Directive, known as PSD2, harmonizes security requirements for online banking and online payments, providing a common regulatory framework for the EU. The security requirements in the final RTS are driven by two core objectives of PSD2: protect consumers from fraud by increasing payments security, and enhance competition and innovation in the retail payments market.

Because the Directive mandates that banks give third party payment providers, or TPPs, consent-driven access to customer accounts, banks must open their APIs to TPPs and ensure strong access security. While the majority of changes to the final RTS relate to these API requirements, the Regulatory Technical Standards also set out customer authentication standards.

All banks operating in the EU, including retail and corporate entities, are subject to compliance by August 2019. The RTS is expected to become applicable around September 2019, preceded by the authentication requirements, which go into effect in August 2019.

More details: Vasco Data Security