PSD2 – A revolution in the payments space

The following article is reproduced from the February 2018 edition of Exchange – International magazine. For more about financial services regulatory issues across the world, the full magazine is available for download here.

The second Payments Services Directive (2015/2366) (PSD2) came into force throughout the EU on 13 January 2018. PSD2 strengthens and extends the legal foundation for an EU single market for payment services, covering payment institutions, credit institutions and e-money institutions. It is designed to address the significant technological developments which have occurred in retail payment services since the First Payment Services Directive (2007/64) (PSD1) was adopted in 2007.

This article considers the recent developments around PSD2, both at a European and UK level, before providing an overview of its implementation status in key European jurisdictions.

PSD2 – Implementation at European level

Delegated Regulation supplementing the Interchange Fee Regulation with regulatory technical standards on the separation of payment card schemes and processing entities

On 18 January 2018, the Delegated Regulation on interchange fees for card-based payment transactions (2018/72) (Delegated Regulation) was published in the Official Journal of the EU (OJ).

This legislative instrument contains the regulatory technical standards (RTS) on establishing the requirements to be complied with by payment card schemes and processing entities. It supplements the existing Interchange Fee Regulation (2015/751) (IFR), which introduced caps on the fees of consumer debit and credit card payments, allowed retailers to choose which card payment options to use and required card schemes to ensure the independence of their own processing activities from the rest of their operations. To ensure such independence, the new RTS rules introduce detailed requirements around the separation of certain functions, including limits on information exchange and separate profit and loss accounts, corporate authorisations and decision making.

The Delegated Regulation will enter into force on 7 February 2018.

Payments Accounts Directive technical standards published

On 11 January 2018, a number of technical standards required under the Payment Accounts Directive (2014/92) (PAD) were published in the OJ.

PAD came into force on 17 September 2014, with member states having to transpose most of its provisions into national law by 18 September 2016. Its aim was to improve the transparency and comparability of fee information about payment accounts (including current accounts), help people switch payment accounts, and ensure every EU resident has access to a basic bank account.

The technical standards, which were all adopted by the Commission on 28 September 2017, are summarised below:

• Commission Delegated Regulation (2018/32) – contains RTS outlining standardised terminology for most representative services linked to a payment account (article 3(4) of the PAD);
• Commission Implementing Regulation (2018/33) – contains implementing technical standards (ITS) with respect to the standardised presentation format of the statement of fees and its common symbol. This concerns the requirement that payment service providers (PSPs) provide the customer with a statement on fees and applicable information regarding interest rates at least annually and free of charge; and
• Commission Implementing Regulation (2018/34) – contains ITS on the standardised presentation format of the fee information document and its common symbol. This relates to the requirement that PSPs provide the customer with a fee information document in a durable medium.

Final EBA guidelines on security measures for operational and security risk under PSD2

On 12 December 2017, the EBA published its final report on guidelines on the security measures for operational and security risks under PSD2.

This provides that PSPs shall establish a framework with appropriate risk mitigation measures and control mechanisms to manage operational and security risks relating to the payment services they provide.

In developing these guidelines, the EBA has considered existing EBA guidelines on the security of internet payments under PSD1 and carried out a risk analysis to determine the main threats and vulnerabilities to which PSPs are exposed.

In total, the EBA sets out 9 guidelines around the security measures for operational and security risk. These include a general requirement for proportionality, as well as guidelines covering governance, risk management and control models, outsourcing, risk assessment, processes and assets, the protection and integrity of data and systems, physical security and access control.

The guidelines also cover the monitoring, detection and reporting of operational or security incidents, business continuity management, scenario-based continuity plans, the testing of security measures, situational awareness and the management of the relationship with payment service users.

The official EU language versions of the guidelines were published on the EBA website on 12 January 2018, meaning they will apply once the NCAs have implemented them into their national and supervisory frameworks.

UK implementation of PSD2

PSD2 is being transposed into UK law via the Payment Services Regulations 2017 (PSRs 2017), most provisions of which came into force on 13 January 2018 in accordance with the timescales under PSD2. The PSRs 2017 repeal and replace the Payment Services Regulations 2009 (SI 2009/209). A number of workstreams with respect to the implementation of PSD2 are still ongoing in the UK, the most recent of which are outlined below.

PSR open letter to NPSO

On 18 January 2018, the Payment Systems Regulator (PSR), published an open letter from its Managing Director Hannah Nixon to the CEO of the New Payment System Operator (NPSO), Paul Horlock, setting out the PSR’s expectations of the NPSO’s initial priorities.

The formation of the NPSO had been announced in September 2017. This organisation will take over the operation of the three key interbank retail payment systems (Bacs, Faster Payments and the new Image Clearing System for cheques).

Ms Nixon notes that the following targets “would need to be met for the NPA to be successful”:

• increased innovation in the payments industry;
• effective competition across all layers of the New Payments Architecture (NPA);
• delivery of the NPA in a timely manner, with support and engagement from all stakeholders; and
• a NPA which is technically robust and resilient.

The PSR also sets out the following 6 priorities for the NPSO:

(i) stakeholder engagement; (ii) strategy setting and decision making; (iii) competitive procurement of the NPA’s central infrastructure; (iv) development and management of NPA rules and standards; (v) clarification of the NPSO’s “market catalyst” role; and (vi) risk management.

The PSR has asked the NPSO to respond to the priorities set out in the Annex of its letter by no later than 30 March 2018.

FCA statement on EBA guidelines on operational and security risks under PSD2

On 19 December 2017, the FCA published a statement relating to the EBA guidelines on operational and security risks under PSD2 (Guidelines). This followed the publication of the EBA’s final guidelines on 12 December 2017. Please refer to the text above for further information on the EBA guidelines.

The FCA stipulated that all PSPs are expected to comply with the Guidelines from 13 January 2018 in addition to the requirements set out in regulation 98 (Management of operational and security risks) of the PSRs 2017, the UK’s implementing legislation. The FCA noted that this would include firms undertaking account information and payment initiation services.

The FCA committed to consulting on its approach to applying these Guidelines and its expectations on PSPs’ future reporting requirements during 2018. The FCA also reminded firms applying or re-applying for authorisation that applications must contain a statement of the applicant’s security policy, including a description of the applicant’s measures to comply with

Regulation 98(1), taking the Guidelines into consideration.

Guidance on new payment surcharge rules for consumer and business transactions

In December 2017, the Department for Business, Energy and Industrial Strategy published its updated guidance on the Consumer Rights (Payment Surcharges) Regulations 2012 (Regulations), which supersedes guidance previously published in March 2013 and August 2015.

For most retail payments, the Regulations ban merchants from charging a fee in addition to the advertised price of a transaction on the basis of a consumer’s choice of payment instrument.

For other retail payments and most payments between businesses made with commercial payment instruments, the Regulations ban merchants from charging customers more than the direct cost borne by them for use of the relevant means of payment.

The Regulations apply to contracts, however concluded, and entitle customers to a refund for any unlawful surcharge which they have paid. In addition, customers may take legal action to recover such surcharges, and consumer enforcement authorities have the power to take civil enforcement action against any traders who breach the Regulations.

PSD2 – Implementation status of member states

For reference, we have included a table setting out the implementation position for PSD2 in our key European jurisdictions. If you require any additional information on those countries listed below please refer to your local DLA Piper contact below.