The European Banking Authority (EBA) is facing apparent widespread rebellion by member states on the deadline for enforcement of strong customer authentication (SCA) measures.
Eight EU member states intend to use a phased, or ramp-up, approach to strong customer authentication (SCA) enforcement, according to a document released by the European Association of Payment Service Providers for Merchants (EPSM).
These member states are: Austria; Belgium; Denmark; France; Germany; Ireland; Italy; and Lithuania.
The document was put together on an informal basis from information provided by the EPSM’s members. Apart from Denmark, which has previously announced that enforcement would be delayed to January 11, no member states have made official statements on the issue.
But the German financial regulator (BaFin) confirmed Germany’s approach today (December 18).
“Within the scope of its supervisory discretion, BaFin will enable all parties involved to safely start up their newly implemented systems for strong customer authentication,” a spokesperson told VIXIO.
“Thus, BaFin will be enforcing strong customer authentication through a phased approach.”
German market participants can expect transactions of more than €250 to be subject to SCA from January 15, then €150 from February 15, before becoming fully enforced from March 15.
The other seven regulators had not responded to requests for comment at the time of writing.
A spokesperson for the EBA told VIXIO that “while we appreciate the potential need felt by these countries, among the largest card markets in the EU, to somewhat ‘soften’ the sudden switchover to SCA, it would have been advisable for payment service providers in these countries to organise this phasing-in prior to the applicable legal deadline, which was September 2019”.
Although the the regulator’s position appears unchanged, it is milder in substance than past comments made by EBA payments head Dirk Haubrich. He told a panel in November that the EBA has made it known to national authorities that delays to enforcement will not be the policy of the supervisor, and that member states which institute such delays will be breaking the law.
The European Commission has recently struck a more sympathetic tone, with Mairead McGuinness, the commissioner for financial services, financial stability and the capital markets union, having acknowledged the issues caused by the pandemic and vowing to gather member states’ views on progress towards enforcement.
Although the official December 31, 2020 deadline is itself the result of a previous 15-month delay put in place by the EBA, trade associations and businesses, including Mastercard and Visa, have long warned that COVID-19 has set back industry plans.
It is almost unanimously accepted by industry players that SCA will be turbulent, with countries such as Spain and France predicted to struggle. Earlier industry research suggested that transaction abandonment caused by poor SCA implementation could cost businesses €57bn.
Sources familiar with the matter have expressed concern that the differently phased ramp-ups could cause issues with cross-border payments. Worries over the issue have already been raised with regard to the UK’s own enforcement deadline of September 14, 2021.