“Open Banking” is becoming increasingly important, both in Switzerland and internationally. The PSD2 (Payment Services Directive 2) is the most important regulation in the European area, although in Switzerland, it is optional. For Switzerland, an initiative of this kind is not (yet) in view, but several initiatives that go in various directions have already begun to address the issue. In this blog article, we will not be looking at the legal aspects of the PSD2 standard, but at its content and the participants that it targets.
The term “Open Banking” refers to the use of standardised application interfaces (APIs) to provide data and trigger operations for recognised third-party providers. The systems are operated by banks. Third-Party Providers (TPPs) are usually non-banks which are granted access to the accounts and/or data of bank customers. The APIs allow the TPPs to use bank customer account data and bank functions that relate to the customers' accounts.
The result of this unbundling is services that are increasingly performed independently from the specific bank, credit institution or insurance company or the institution where an account or policy is held. Typical use cases include retrieving account information and triggering operations like payments. This approach offers immense possibilities and opportunities, because digitalization with contactless and mobile payment systems methods, along with online banking, has received a significant boost as a result of the COVID-19 pandemic. In part voluntarily and in part due to the current circumstances, the inhibition threshold has been significantly reduced.
“Open Banking” is formally regulated in the PSD2, i.e. in the second EU Payment Services Directive (PSD) and provides, among other things, for the market liberalisation of TPPs in payment transactions.
The PSD2 is the successor to the first Payment Services Directive (2007/64/EC) and as such, takes into account the previous IT technical developments in payment traffic, but also the entry of new market participants. What this means in greater detail is that PSD2 now:
Within “Open Banking”, typically three key players are interacting with each other:
1. Customers
Retail and business customers utilise an application from a service provider (third-party provider) and are able to use this application to access data and services that are stored with or provided by their financial service providers.
2. Third-Party Providers (TPP)
Third-party providers develop and operate applications, most of which are designed to meet specific needs. TPPs include both start-ups from the Fintech sector and established companies with a suitable application. Essentially, there are two types of TPPs identified in the Directive as being providers of new services in the Internet payment sector:
As has been mentioned above, banks have to provide interfaces for third-party providers (i.e. TPPs). In order to be able to access these interfaces, the law stipulates that TPPs must meet certain criteria and must provide proof of certification. This offsets the split between TPP and banks. All TPPs that want to take part in PSD2 must assume liability and meet equity targets as well as reporting and auditing requirements.
As part of strong customer authentication, consumers must be able to clearly identify or authenticate themselves. In order to minimise payment fraud, authentication must be made up of at least two of the following criteria:
The requirement in the PSD2 for strong customer authentication is fulfilled if the authentication procedure combines two of these three independent elements. This means that the combination of just a PIN and a password is inadequate because both security features come from the “knowledge” group, although there are also some exceptions. These can be found in articles 10 to 20 of Delegate Regulation (EU) 2018/389.
In autumn of 2019, the European Banking Authority (EBA) extended its deadline for implementing the rules on strong customer authentication in the field of e-commerce until 31 December 2020, in order to give the service providers concerned, in particular payment service providers and retailers, more time to carry out technical conversions. But the clock is ticking and the year-end is getting closer!
In accordance with the “DELEGATED COMMISSION REGULATION (EU) 2018/389”, regular tests must be carried out: “...security measures for the implementation of strong customer authentication and its exceptions, which documents measures for the protection of the confidentiality and integrity of the personalised security features and the measures in order to establish common and secure open standards for communication that are regularly tested...”.
All payment service providers must furnish proof that security measures have been implemented, tested and verified. The PSD2 applies to payments in EU/EEA currencies between payment service providers located in the EU/EEA area. In addition, it also applies in part to payments in non-EU/EEA currencies, and where a payment service provider is located outside of the EU/EEA area (e.g. in Switzerland or the US).
They are governed by PSD2 but do not have to provide evidence of the implementation, testing or verification of security measures along the lines of the Regulatory Technical Standards for Strong Customer Authentication (CSA) referred to in Article 3 or the Common and Secure Open Standards of Communication (CSCCAC) of the EBA focusing on Transaction Risk Analysis (TRA). Using our PSD2 Assessment, which is an external, independent review, you will be able to find out whether or not you comply with the requirements of the PSD2 RTS on SCA & CSC.
Do you need help to implement the PSD2 or with proof of implementation, testing or inspection of the security measures? InfoGuard can assist you with this. Our cyber security experts will be happy to help you.