|
|
The legislative framework for retail payments in the European Union (EU) has seen important developments in recent months, such as the advancements in the negotiations for the revised Payments Services Directive (PSD2) and the finalisation of the EU Regulation on Interchange Fees (IFR). The European Commission, Council and Parliament are currently in the final negotiation stages of the PSD2 and once the Directive is agreed upon, the EBA will approach the industry and other interested parties to gather their input at an early stage of the regulatory development process.
The PSD2 mandates for the EBA are expected to include requirements to improve operational and security requirements for payment services. The EBA will develop this work in close cooperation with the European Central Bank (ECB), through the Forum for the Security of Retail Payments (SecuRe Pay) that the ECB and the EBA are chairing jointly.
As the security requirements under the PSD2 are not expected to come into force until 2018/9, the EBA had issued, on 18 December 2014, its final Guidelines on the security of internet payments. The requirements are a response to increases in fraud that regulators have observed with this particular payment method. The Guidelines represent the first output of the cooperation between the EBA and ECB on retail payments; have taken two years to develop; are applicable as of 1 August 2015; and will apply until the PSD2 requirements come into force in 2018/9.
The Guidelines will set minimum security requirements for payment services providers across the EU, and will provide enhanced protection of EU consumers against payment fraud on the Internet. Dirk Haubrich, Head of the EBA's Consumer Protection, Financial Innovation and Payments Unit at the EBA explained that: "This work will ensure increased confidence in internet payments for consumers and firms in the EU, and is aimed at allowing this sector of the payments market to continue to grow".
The Guidelines are based on the "comply or explain" principle, which means that national authorities have to notify the EBA within two months of the publication of the translations whether they will comply with the Guidelines or otherwise explain their reason for non-compliance. The EBA published the translations on 5 March 2015 and has made today available a summary table of the compliance notifications received. As the table shows, 24 national authorities in the EU stated that they will comply with the Guidelines, while two indicated partial compliance and three reported that they will not comply. In addition, two of the three EEA/EFTA authorities reported compliance.
While the Guidelines are a conversion of the requirements that had previously been developed by the SecuRe Pay Forum, the EBA also clarified that other initiatives that had been started by SecuRe Pay – such as SecuRe Pay's consultation on draft security requirements for mobile payments, or its early views on third party access to payment accounts – will not be converted into EBA Guidelines. Instead, SecuRe Pay will from now on provide input to the EBA and the ECB for the development of the security mandates under the PSD2, and will do so to the timelines foreseen by the PSD2.
Finally, the EBA expects to start its work on Regulatory Technical Standards (RTS) foreseen by the EU Interchange Fee Regulation (IFR). The EBA will develop requirements to ensure that payment card schemes and processing entities are independent from one another in terms of accounting, organisation and decision making processes. The industry's views on this mandate will also be sought at an early stage, as the EBA is planning to approach relevant market participants during summer 2015. The EBA will develop this mandate in close cooperation with the ECB and pointed out that its finalisation may be later than the six months foreseen in the IFR.