EBA欧洲银行-2018-01-26-EBA-letter-to-Guersent-DG-FSMA-RTS-on-SCA-and-CSC_3页_237kb

EBA Regulatory Technical Standards on Strong Customer Authentication and Common and Secure Communication under PSD2 Summary

Core Content

The document outlines the European Banking Authority's (EBA) response to the European Commission's adoption of Regulatory Technical Standards (RTS) on Strong Customer Authentication (SCA) and Common and Secure Communication (CSC) under the second Payment Services Directive (PSD2), which was published on 27 November 2017. The EBA expressed concerns regarding the changes made by the Commission to the RTS and the implications for the industry.

Main Views and Concerns

1. Adoption of RTS

• The EBA welcomed the timely adoption of the RTS, as it provides necessary certainty to the market regarding the implementation of PSD2.
• The EBA emphasized the importance of ensuring that the objectives of PSD2 are met through clear and consistent regulatory standards.

2. Exemption from 'Screen Scraping'

• The EBA appreciated the Commission's decision to partially reflect its concerns by allowing Account Servicing Payment Service Providers (ASPSPs) to be exempted from the obligation to allow contingency access for Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPs) via 'screen scraping'.

3. Changes Not Consulted with EBA

• The EBA raised concerns that the Commission made significant changes to the RTS without prior consultation, violating the due process outlined in Article 10(3), sixth sub-paragraph, of Regulation (EU) No 1093/2010.
• The EBA believes that such changes should have been subject to its formal opinion, as it is the designated authority for drafting technical standards.

4. Increased Burden on PSPs and CAs

• The revised Articles 32 and 33 of the RTS introduce new obligations for Certification Authorities (CAs), including verifying the security of corporate payment processes, ensuring compliance with interface requirements, and monitoring and stress-testing dedicated interfaces.
• These changes may impose significant administrative and operational burdens on Payment Service Providers (PSPs) and CAs, requiring substantial additional resources.

5. Unclear Role of EBA in Consultation

• The document highlights the ambiguity of the EBA's role when consulted by CAs on the testing of dedicated interfaces.
• It is unclear whether the EBA is required to be involved in the testing process for each PSP, which could be resource-intensive given the large number of banks in the EU.

6. Risk of Unlevel Playing Field

• The EBA pointed out that some changes in the RTS leave significant room for interpretation, potentially leading to an unlevel playing field.
• For instance, the requirement for ASPSPs to be "satisfied" by AISPs and PISPs regarding the design and testing of dedicated interfaces is ambiguous and may create conflicts between different types of providers.

Key Information

• Date of Adoption: 27 November 2017
• Regulation: Regulation (EU) No 1093/2010 (PSD2)
• Entities Involved:
  • ASPSPs: Account Servicing Payment Service Providers (banks)
  • AISPs: Account Information Service Providers
  • PISPs: Payment Initiation Service Providers
  • CAs: Certification Authorities
• Key Provisions:
  • Article 17: Assigns new responsibilities to CAs in verifying the security of corporate payment processes.
  • Article 30(6): Requires CAs to ensure ASPSPs comply with interface requirements.
  • Article 32(2): Mandates CAs to monitor and stress-test dedicated interfaces.
  • Article 33(6) and 33(7): Introduces a new mechanism for exempting ASPSPs from implementing contingency access, subject to certain conditions.

Conclusion

While the EBA acknowledges the timely adoption of the RTS, it urges the Commission to ensure consistent interpretation and application of the provisions. The EBA is prepared to assist further in addressing technical issues related to PSD2 and its delegated acts, including through the extension of its Q&A process and supervisory convergence efforts with CAs. The document also calls for clarification regarding the relationship between the EBA, CAs, and the industry group set up by the Commission to evaluate APIs.