The second Payment Services Directive (PSD2)

1. ECB-UNRESTRICTED Ann Börestam Principal Market Infrastructure Expert European Central Bank The second Payment Services Directive (PSD2) Re-inventing payments in the digital age Frankfurt, 15 November 2017

2. ECB-UNRESTRICTED Payment integration and harmonisation is a continuous process - One step leading to another The second Payment Services Directive (PSD2)

3. ECB-UNRESTRICTED Overview 1 The second Payment Services Directive 2 Supporting rules and work 3 Conclusions The second Payment Services Directive (PSD2)

4. Second Payment Services Directive ECB-UNRESTRICTED The second Payment Services Directive (PSD2) Entered into force 12 January 2016 To be transposed in national legislation by 13 January 2018 • Main points of content: • Expanding the scope to one-leg transactions • Improved security requirements • Enhancing transparency and consumer rights • Introducing new payment services and new service providers • Regulating access to payment account The second Payment Services Directive (PSD2)

5. Second Payment Services Directive ECB-UNRESTRICTED Scope: • Extended to one-leg transactions and all currencies for the part of the transaction carried out in the Union (with some exemptions) Increased security: • Strong customer authentication for initiation and processing of electronic payments • For remote transactions - dynamic linking to the amount and account • Requirements and exemptions to be defined by EBA in RTS The second Payment Services Directive (PSD2)

6. Second Payment Services Directive ECB-UNRESTRICTED Enhanced consumer protection: • Reduced liability for non-authorised payments from €150 to € 50 • unconditional refund right for direct debits in euro • removal of surcharges for the use of a consumer credit or debit card The second Payment Services Directive (PSD2)

7. Second Payment Services Directive ECB-UNRESTRICTED Access to payment account by third parties New actors bringing innovative payment services on the market which are not covered by existing EU legislation Accessing the user’s account in the name of the user Compiling account information Initiating a payment order Potential to increase competition and efficiency in payments Consumer protection concern as regards access to account and information The second Payment Services Directive (PSD2)

8. Second Payment Services Directive ECB-UNRESTRICTED Access to payment account in the PSD2 • Expanding the exclusive list of payment services with: • Payment initiation services (PIS) • Account information services (AIS) • Provision of payment services requires authorisation (if not a central bank or public authority) • amended licensing criteria to cater for the provision of PIS and AIS • Account holding institutions cannot deny access unless: • the PSP is unauthorised • suspicion of fraud Introduction of specific rules for the provision of PIS and AIS The second Payment Services Directive (PSD2)

9. Second Payment Services Directive ECB-UNRESTRICTED Payment initiation services • PISPs shall: • Not hold payers funds • Not share the payers personalised security features • Identify itself towards the ASPSP • Not store sensitive data or request any data other than necessary for the transaction • Not use, access, or store data for other purposes than the transaction • ASPSPs shall: • Communicate securely • Provide or make available all information on the initiation of the payment transaction and all information accessible regarding the execution of the payment transaction to the PISP • No discrimination towards payment orders submitted directly by the payer Payers explicit consent is required for the transaction to be executed The second Payment Services Directive (PSD2)

10. Second Payment Services Directive ECB-UNRESTRICTED Account information services • AISPs shall: • Not share the payers personalised security features • Identify itself towards the ASPSP • Access only information from designated accounts • Not request sensitive payment data • Not use, access, or store data for other purposes than requested • ASPSPs shall: • Communicate securely • Not discriminate data requests for other than objective reasons Payers explicit consent is required for the provision of services The second Payment Services Directive (PSD2)

11. ECB-UNRESTRICTED Overview 1 Revised Payment Services Directive Supporting rules and work 2 3 Conclusions The second Payment Services Directive (PSD2)

12. Supporting rules and work ECB-UNRESTRICTED European Banking Authority (EBA) Further guidance to be provided by the EBA in Regulatory Technical Standards (RTS) and Guidelines • RTS on strong customer authentication and common and secure communication • EC adoption expected for end November 2017 • European Parliament and Council three months to object • Applicable 18 months after the date of entry into force The second Payment Services Directive (PSD2)

13. Supporting rules and work ECB-UNRESTRICTED Gap-period between PSD2 and the applicability of the RTS on strong customer authentication and common and secure communication • PSD2 security measures referred to in Art. 65, 66, 67 and 97 only from the application of the RTS • EBA’s guidelines on security of internet payments still apply insofar not contradicting with the PSD2 • Provision of PIS and AIS requires authorisation (providers active before January 2016 exempted until RTS applies) • Until the RTS applies, PISPs and AISPs can access via users on-line banking interface (unless forbidden under national law) The second Payment Services Directive (PSD2)

14. Supporting rules and work ECB-UNRESTRICTED ERPB WG on Payment Initiation Services Aiming to define a common set of technical, operational and business requirements for the development of an integrated market for Payment Initiation Services (PIS) Final report to be presented at ERPBs meeting 29 November 2017 • The outcome to be used by: • market participants in the development and implementation of common dedicated interfaces for standardised communication between ASPSPs and PISPs • providers of certificates for identification, providers of directory services, as well as by market participants for the development of dispute-handling procedures The second Payment Services Directive (PSD2)

15. ECB-UNRESTRICTED Overview 1 Revised Payment Services Directive 2 Supporting rules and work 3 Conclusions The second Payment Services Directive (PSD2)

16. Conclusions ECB-UNRESTRICTED PSD2 setting the legal framework Regulatory Technical Standards and Guidelines defined by the EBA providing additional guidance ERPB providing a forum for stakeholder representatives to discuss and agree on way forward Payment integration and harmonisation is a continuous process Progressing step by step The second Payment Services Directive (PSD2)

17. ECB-UNRESTRICTED Many thanks for your attention! The second Payment Services Directive (PSD2)