The Revised Payment Services Directive (PSD2, Directive (EU) 2015/2366, [1] which replaced the Payment Services Directive (PSD), Directive 2007/64/EC [2] ) is an EU Directive, administered by the European Commission (Directorate General Internal Market) to regulate payment services and payment service providers throughout the European Union (EU) and European Economic Area (EEA). The PSD's purpose was to increase pan-European competition and participation in the payments industry also from non-banks, and to provide for a level playing field by harmonizing consumer protection and the rights and obligations of payment providers and users. [3] The key objectives of the PSD2 directive are creating a more integrated European payments market, making payments more secure and protecting consumers. [4]
The SEPA (Single Euro Payments Area) is a self-regulatory initiative by the European banking sector represented in the European Payments Council, which defines the harmonization of payment products, infrastructures and technical standards (Rulebooks for credit transfer/direct debit, BIC, IBAN, ISO 20022 XML message format, EMV chip cards/terminals). The PSD provides the legal framework within which all payment service providers must operate.
The PSD's purpose in regard to the payments industry was to increase pan-European competition with participation also from non-banks, and to provide for a level playing field by harmonizing consumer protection and the rights and obligations for payment providers and users. [3] The PSD's purpose in regard to consumers was to increase customer rights, guarantee faster payments (no later than next day since 1 January 2012), describe refund rights, and give clearer information on payments. [5] Although the PSD was a maximum harmonisation directive, certain elements allowed for different options by individual countries. [6]
The final adopted text of PSD went into force 25 December 2007 and was transposed into national legislation by all EU and EEA member states by 1 November 2009. [2] [7]
The PSD contained two main sections:
Each country had to designate a "competent authority" for prudential supervision of the PIs and to monitor compliance with business conduct rules, as transposed into national legislation. [8]
The PSD was updated in 2009 (EC Regulation 924/2009) and 2012 (EU Regulation 260/2012). An implementation report from 2013 found the PSD facilitated "provision of uniform payment services across the EU" and reduced legal and production costs for many payment service providers and that "the expected benefits have not yet been fully realised". The same report found the 2009 update "to be functioning well. For example, charges for €100 transfers followed a further downward trend to €0.50 euro-area average for transfers initiated online and remained low, at €3.10 for transfers initiated at the bank counter". [9]
In October 2021 the EBA launched a public consultation on the amendment of its Regulatory Technical Standards (RTS) on strong customer authentication and secure communication (SCA&CSC) under the Payment Services Directive (PSD2) with regard to 90-day exemption from SCA for account access. [10] In the UK, the FCA published PS 21/19 [11] (“policy statement”) for “Changes to the SCA-RTS and to the guidance in ‘Payment Services and Electronic Money – Our Approach’ and the Perimeter Guidance Manual” . This document proposed a number of modifications including to Article 10 of the UK- RTS, by replacing the requirement for the PSU to re-authenticate with their ASPSP every 90 days to allow AISP access with the requirement for the PSU to reconfirm their consent with their AISP directly.
On 8 October 2015, the European Parliament adopted the European Commission proposal to create safer and more innovative European payments (PSD2, Directive (EU) 2015/2366). The current rules aim to better protect consumers when they pay online, promote the development and use of innovative online and mobile payments such as through open banking, and make cross-border European payment services safer. [12]
Then-Commissioner Jonathan Hill, responsible for Financial Stability, Financial Services and Capital Markets Union, said, "This legislation is a step towards a digital single market; it will benefit consumers and businesses, and help the economy grow." [12]
On 16 November 2015, the Council of the European Union passed PSD2. Member states then had two years to incorporate the directive into their national laws and regulations. [13] On 27 November 2017, Commission delegated Regulation (EU) 2018/389 supplemented PSD2 with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication. [14]
The EU and many banks pushed this development with the new Payments Service Directive 2 (PSD2), which came into force on 13 January 2018. Banks then adapted to these changes which opened many technical challenges, but also many strategic opportunities, such as collaborating with fintech providers, for the future. [15]
An important element of PSD2 is the requirement for strong customer authentication on the majority of electronic payments.
Another important element of the directive is the demand for common and secure communication (CSC). eIDAS-defined qualified certificates for are demanded for website authentication and electronic seals used for communication between financial services players. The technical specification ETSI TS 119 495 defines a standard for implementing these requirements.
PSD2 went into full effect on 14 September 2019, but due to delays in the implementation, the European Banking Authority allowed for a time extension of the strong customer authentication (SCA) until 31 December 2020. [16] [17]
 | This section may contain information not important or relevant to the article's subject.(May 2020) |
Privacy First, a privacy organisation, criticised the open banking elements of the new legislation, claiming it focuses too much on improving competition and innovation while the privacy interests of account holders are overlooked. [19]
Markets in Financial Instruments Directive 2014, commonly known as MiFID 2, is a legal act of the European Union (EU). Together with Regulation No 600/2014 it provides a legal framework for securities markets, investment intermediaries, in addition to trading venues. The directive provides harmonised regulation for investment services of the member states of the European Economic Area — the EU member states plus Iceland, Norway and Liechtenstein. Its main objectives are to increase competition and investor protection, as well as level the playing field for market participants in investment services. It repeals Directive 2004/39/EC.
Friendly fraud, also known as chargeback fraud, cyber shoplifting occurs when a consumer makes an online shopping purchase with their own credit card, and then requests a chargeback from the issuing bank after receiving the purchased goods or services. Once approved, the chargeback cancels the financial transaction, and the consumer receives a refund of the money they spent. Dependent on the payment method used, the merchant can be accountable when a chargeback occurs.
The International Safe Harbor Privacy Principles or Safe Harbour Privacy Principles were principles developed between 1998 and 2000 in order to prevent private organizations within the European Union or United States which store customer data from accidentally disclosing or losing personal information. They were overturned on October 6, 2015, by the European Court of Justice (ECJ), which enabled some US companies to comply with privacy laws protecting European Union and Swiss citizens. US companies storing customer data could self-certify that they adhered to 7 principles, to comply with the EU Data Protection Directive and with Swiss requirements. The US Department of Commerce developed privacy frameworks in conjunction with both the European Union and the Federal Data Protection and Information Commissioner of Switzerland.
The Single Euro Payments Area (SEPA) is a payment integration initiative of the European Union for simplification of bank transfers denominated in euros. As of 2020, there were 36 members in SEPA, consisting of the 27 member states of the European Union, the four member states of the European Free Trade Association, and the United Kingdom. Some microstates participate in the technical schemes: Andorra, Monaco, San Marino, and Vatican City.
The Freedom to Provide Services or sometimes referred to as free movement of services along with the Freedom of Establishment form the core of the European Union's functioning. With the free movement of workers, citizens, goods and capital, they constitute fundamental rights that give companies and citizens the right to provide services without restrictions in any member country of the EU regardless of nationality and jurisdiction.
The Capital Requirements Directives (CRD) for the financial services industry have introduced a supervisory framework in the European Union which reflects the Basel II and Basel III rules on capital measurement and capital standards.
The Telecoms Package was the review of the European Union Telecommunications Framework from 2007 – 2009. The objective of the review was to update the EU Telecoms Framework of 2002 and to create a common set of regulations for the telecoms industry across all 27 EU member states. The review consisted of a package of directives addressing the regulation of service provision, access, interconnection, users' contractual rights and users' privacy, as well as a regulation creating a new European regulatory body (BEREC).
The Financial Conduct Authority (FCA) is a financial regulatory body in the United Kingdom. It operates independently of the UK Government and is financed by charging fees to members of the financial services industry. The FCA regulates financial firms providing services to consumers and maintains the integrity of the financial markets in the United Kingdom.
Strong customer authentication (SCA) is a requirement of the EU Revised Directive on Payment Services (PSD2) on payment service providers within the European Economic Area. The requirement ensures that electronic payments are performed with multi-factor authentication, to increase the security of electronic payments. Physical card transactions already commonly have what could be termed strong customer authentication in the EU, but this has not generally been true for Internet transactions across the EU prior to the implementation of the requirement, and many contactless card payments do not use a second authentication factor.
In financial services, open banking allows for financial data to be shared between banks and third-party service providers through the use of application programming interfaces (APIs). Traditionally, banks have kept customer financial data within their own closed systems. Open banking allows customers to share their financial information securely and electronically with other banks or other authorized financial organizations such as payment providers, lenders and insurance companies.
The Mortgage Credit Directive (MCD) is a body of European legislation for the regulation of first- and second charge mortgages and consumer buy-to-let (CBTL) lending. It was originally adopted by the European Commission on 4 February 2014 and Member states had to transpose the regulations in their national law by March 2016. The European Commission is currently planning to propose amendments to the directive in Q1 2024.
A trust service provider (TSP) is a person or legal entity providing and preserving digital certificates to create and validate electronic signatures and to authenticate their signatories as well as websites in general. Trust service providers are qualified certificate authorities required in the European Union and in Switzerland in the context of regulated electronic signing procedures.
Banking as a service (BaaS) is the provision of banking products to non-bank third parties through APIs.
Auka is a Norwegian, VC-backed financial technology company. Its PSD2 compliant technology platform enables banks to issue white label mobile payments products to their private and merchant customers.
A qualified website authentication certificate is a qualified digital certificate under the trust services defined in the European Union eIDAS Regulation.
The Net Neutrality Regulation 2015 is a Regulation in EU law where article 3(3) lays down measures concerning open internet access.
The development of neobanks in Europe is a trend in the European financial landscape beginning in the 2010s. Neobanks are a type of digital-only bank that offer financial services primarily through mobile and web applications, with little or no reliance on physical branches. The trend was driven by advancements in technology, changing consumer preferences, and supportive regulatory frameworks. Neobanks provide a range of services, including personal accounts, loans, and payment services, with a focus on user-friendly interfaces, low fees, and innovative features. In 2022, European neobank market have generated over 570B transactions.
The Central Electronic System of Payments (CESOP) regime is an automatic exchange of information regime being introduced in the European Union from 1 January 2024. The rules were introduced by Council Directive 2020/284, amending the EU's Value-added tax Directive.
Open Finance refers to the concept and practice of sharing financial data securely with third-party service providers through Application Programming Interfaces (APIs). It builds upon open banking principles, aiming to broaden access to financial data beyond traditional banking products and services. This initiative emphasises consumer control over financial data, allowing secure sharing to obtain personalized services, better deals, and innovative financial solutions.
| International | |
|---|---|
| National | |
