A spike in regulatory activity addressing COVID-19-related issues was largely pragmatic and timely. With lockdowns imposed across Europe, deadlines for meeting regulatory obligations and public consultations have disappeared overnight, along with footfall.
Some early lobbying for flexibility yielded instant results, which triggered even more demands for forbearance. However, this flexibility is far from the new normal, and the excuse of COVID-19 is wearing thin for regulators.
Two key payment regulations in the UK have been affected — Strong Customer Authentication (SCA) and Confirmation of Payee — along with two consultations, those on open finance and new payments architecture.
Has anything changed?
Strong Customer Authentication is a requirement of the Payment Services Directive 2 (PSD2) on payment providers to develop additional security features to protect against fraud. The Financial Conduct Authority (FCA) is working in the UK with payment firms to introduce new authentication measures in a way that minimises disruption to customers and businesses, with a managed long rollout period.
The FCA has extended the overall implementation deadline for the e-commerce world to September 14, 2021. It did so without consulting its EU counterpart, the European Banking Authority (EBA).
The watchdog is also offering more leeway for the application of SCA by banks when customers attempt to access their accounts or initiate payments through a fintech app, but only on a case-by-case basis if a firm can prove it is making progress. The FCA also went further than European authorities by allowing card issuers to dismiss certain cumulative transaction thresholds whereby SCA should be applied under EU law — as long as firms have “the necessary fraud monitoring tools” in place.
The vagueness of the language gives the authority a wide margin of discretion for any enforcement action post-COVID. If you are not ready for SCA, hope for the best and expect the worst.
The EBA’s flexibility, on the other hand, extended to removing the requirement for national authorities to report on industry readiness by March 31 for the December 31, 2020 deadline.
In early June, the EBA told VIXIO PaymentsCompliance that not only is there no will to extend the deadline but also it would not be legally possible.
The authority’s position seems to be based on simple arithmetic: the requirements have been largely known since 2015. The EBA argues that if you had a good plan to implement SCA in the first place, three months of lockdown should not make a difference.
As things gradually return to normal, the COVID excuse will hold even less sway with authorities.
Confirmation of Payee (CoP) is a UK regulatory initiative that requires an additional check of bank account name alongside sort code and account number for all new payees, but as with all the other regulatory initiatives, not all payment providers are ready to roll out the technical changes it demands. The Payment Systems Regulator (PSR) acknowledged the need for extra time as early as March 20. The authority gave banks three more months to comply, until June 30 2020. At the same time, the PSR stressed that banks need to ensure that “customers who would have benefitted from the protections of CoP are not otherwise disadvantaged from any COVID-19 related delay, including refunding victims of fraud if CoP would have prevented it from happening.”
The PSR reserved flexibility to review the arrangements. The agency also indicated that it may initiate a formal action for non-compliance after June 30. As the deadline approaches, we shall hear an update from the regulator.
Regulators are aware of the strains and pressures currently faced by firms in the light of staff shortages and other more pressing priorities, because they are dealing with the same pressures.
Extending deadlines usually works for all and, in particular, for those consultations that would not have received enough input within the initial timeframe.
The FCA call for input on open finance opened on December 17, 2019. Its response deadline has now been extended to October 1, 2020, providing a ten-month consultation window.
The PSR is taking the same approach and announced its consultation on competition concerns arising from the proposed New Payments Architecture for retail payments will be delayed. Responses were originally invited by March 24, 2020; however, the PSR has extended the consultation by four weeks.
There was a noticeable spike of regulatory activity in EMEA at the outset of the pandemic, with VIXIO PaymentsCompliance reporting more than 140 payments-related regulatory actions in response to COVID-19. Most of these were temporary measures, with a short lifespan.
For many of us, a return to normality may seem a long way away; but in the regulatory world, we’re already there.