On 20 May 2021, the Financial Conduct Authority (FCA) further delayed the deadline for Payment Service Providers (PSPs) to implement Strong Customer Authentication (SCA) for e-commerce platforms by six months. The new deadline is 14 March 2022.
In providing this additional time, the FCA acknowledged the need for an extension to ensure minimal disruption to merchants and consumers as well as the ongoing challenges faced by industry to be ready for the previous 14 September 2021 deadline.
This additional extension follows the last 6 month extension provided by the FCA in light of the exceptional circumstances of the COVID-19 pandemic.
Strong Customer Authentication
SCA requires PSPs authenticate e-commerce transactions by the use of two or more independent elements based on knowledge (such as a PIN), possession (such as a mobile phone number) or inherence (such as a thumbprint scan).
The requirement to put in place SCA was first introduced in the second Payment Services Directive (EU) 2015/2366 (PSD 2). PSD 2 has been implemented in the UK by the Payment Services Regulations 2017 (PSRs).
Whilst PSD 2 and the PSRs came into force in January 2018, the requirement to apply SCA was delayed to give PSPs and merchants more time to overcome the technical challenges of building in SCA and the underlying rules and exclusions from SCA for certain transactions into the payments ecosystem.
Even though the rules on SCA officially commenced on 14 September 2019, PSPs have been granted additional time during which the FCA will not take enforcement action whilst PSPs and merchants update their systems to be SCA-compliant. Importantly, PSPs and merchants need to be able to evidence that they are meeting the requirements of the industry roadmap towards SCA compliance.
This roadmap is produced by UK Finance and will be updated to reflect the additional time provided by the FCA.
EU Position
Across the European Union, the requirements of SCA have already gone live. The European Banking Authority (EBA) declined to provide further extensions to industry notwithstanding the lack of industry readiness and the potential impact on merchants and their customers.
In various EU Member States, the introduction of SCA has led to a drop of conversion rates as customers drop out of initiating online transactions due to the SCA-related latency in the check-out process.
and then 