EBA欧洲银行-Andrea-Enria-speech-on-PSD2-at-Westminster-Forum-210217_6页_224kb

Andrea Enria Speech on PSD2 at Westminster Forum (21/02/2017)

Core Content

Andrea Enria, Chairperson of the European Banking Authority (EBA), delivered a speech at the Westminster Forum on 21 February 2017, focusing on the implications of the revised Payment Services Directive (PSD2) for the UK payments market, despite the UK's impending exit from the EU. He outlined four key reasons why PSD2 remains relevant for the UK:

1. Legal Binding: The UK and its financial institutions remain legally bound by PSD2 and related technical standards until Brexit is completed.
2. Shared Policy Objectives: The UK's Open Banking Initiative and public consultations on PSD2 transposition align with the Directive's goals of increasing competition and innovation.
3. Collaborative Development: The EBA, in partnership with the UK's Financial Conduct Authority (FCA), has been involved in shaping the technical standards under PSD2.
4. Business Continuity: The UK hosts a significant portion of EU payment institutions, and many will continue to operate with the EU post-Brexit, making the Directive relevant for business continuity.

Main Objectives of PSD2

PSD2, which came into force on 13 January 2016 and will apply on 13 January 2018, aims to:

• Enhance competition by introducing new payment services such as payment initiation and account information services.
• Strengthen security through the introduction of strong customer authentication (SCA) and common and secure communication (CSC).
• Promote customer convenience and technology neutrality.
• Ensure integration of European payment markets.
• Protect consumers and facilitate innovation in payment services and security measures.

EBA Mandates in Support of PSD2

The EBA was tasked with developing 11 mandates to support the implementation of PSD2, which include:

• 6 Technical Standards: Directly applicable EU law without national transposition.
• 5 Guidelines: Legally binding once implemented by national authorities.

As of the time of the speech, the EBA had published consultation papers on more than half of these mandates, including:

• Technical Standards on passporting notifications
• Guidelines on professional indemnity insurance for third-party providers
• Guidelines on authorisations of payment institutions
• Guidelines on incident reporting
• Guidelines on complaints procedures
• Technical Standards on SCA & CSC

The remaining mandates to be published in 2017 include:

• Guidelines on operational and security risks
• Technical Standards on Central Contact Points
• Technical and Implementing Standards on the EBA Register
• Technical Standards on coordination between home and host authorities

Technical Standards on SCA & CSC

The Technical Standards on strong customer authentication and common and secure communication (SCA & CSC) were developed under a tight 12-month timeline. The EBA faced challenges due to the lack of clarity in the Directive regarding the scope and precision of the mandate.

Key Changes and Responses

• The EBA published an early Discussion Paper in December 2015, followed by a Consultation Paper in August 2016.
• 224 responses were received, the highest number ever for an EBA consultation, reflecting a wide range of stakeholder concerns.
• The EBA addressed over 300 distinct concerns and made several changes based on feedback:
  • Removed references to ISO 27001 and other specific technologies to ensure technology neutrality.
  • Introduced two new exemptions:
    • One based on transaction risk analysis.
    • One for unattended terminals used in transport or parking.
  • Increased the threshold for remote payments from EUR 10 to EUR 30.
  • Added a review clause 18 months after the application date to ensure the exemption remains conservative.
  • Maintained the requirement for account servicing payment service providers (ASPSPs) to offer at least one interface for third-party access.
  • Banned 'screen scraping' and clarified that direct access is not allowed post-transition period.
  • Required banks to provide the same level of availability and performance for third-party interfaces as they do for their own customers, including contingency measures.

Conclusion

Enria emphasized that the development of these technical standards required a delicate balance between security, competition, customer convenience, and innovation. He expressed confidence that the extensive public consultation had improved the quality of the EBA's work and hoped for continued stakeholder engagement as more consultation papers are published in 2017.