On 16 October, the European Banking Authority published its highly awaited Opinion on the deadline for the SCA migration plans in the EU.
After months of discussion and following a first opinion on 21 June, which allowed National Competent Authorities (NCAs) supervisory flexibility in deciding on limited additional time to migrate to SCA, the EBA has set a final deadline for such migration plans.
According to this Opinion, the EBA states that migration plans of PSPs, including the implementation and testing by merchants, should be completed by 31 December 2020 – granting a 15-month extension. The Opinion also recommends to NCAs to take a consistent approach toward the SCA migration period by abiding by the deadline specified and requiring their respective PSPs to carry out the actions set out by the EBA.
Ecommerce Europe overall welcomes the EBA and NCAs’ efforts to provide the building blocks for a consistent approach to SCA implementation. The EBA Opinion includes milestones and expected actions from NCAs towards issuers and acquirers, such as requiring all PSPs to prepare migration plans which include payment service users (PSUs) enrollment and communication as well as reporting back on progress made and overall readiness.
Industries have consistently engaged with regulators and policymakers to share the concerns and challenges that various sectors face in preparing for Strong Customer Authentication and have argued for a consistent implementation of SCA in Europe, as well as enough time to ensure a smooth transition to compliant solutions. Representatives of the payment and retail sector advocated for an 18-month deadline to ensure access to crucial solutions, implementation of necessary exemptions and enough time for testing, implementation and communicating to end-users.
The EBA highlights that the request for an 18-month extension from the industry was largely based on the need to finalize the development and testing of 3DS 2.2 and ensure that all exemptions are viable and accessible to merchants. However, the EBA considers that the “development of user-friendly means of payment, cannot justify a significant delay in the application of the security requirements”, and suggests prioritizing “the development of the actual SCA requirements and incorporating the exemptions at a later date”.
Ecommerce Europe remains concerned over the deadline set by the EBA as it would bring the implementing and testing phase close to December holidays, a critical trading period for online merchants, and would also represent a real challenge for business models that rely on exemption – not solely to make authentication user-friendly – but simply to operate.
Ecommerce Europe does however believe that industries and regulators can build on the existing and strong cooperation and communication efforts to ensure a transition to SCA as smoothly as possible throughout the next 15 months.