Payment transactions have been subject to new security measures since 14 September 2019, with the entry into force of Commission Delegated Regulation (EU) 2018/389 (known as the RTS on SCA & CSC), which sets out strong authentication obligations under the European Payment Services Directive (PSD2).
From that date, electronic payment transactions should be carried out using strong authentication, a two-step procedure to verify the customer’s identity, unless an exemption can be applied.
In the months prior to the entry into force of the Commission’s Delegated Regulation (RTS on SCA & CSC), a lack of preparedness was identified across the market involved in e-commerce—characterised by the high interdependence of its participants—so measures were adopted to prevent a potential and undesirable disruption to card payment transactions in e-commerce.
After noting the complexity of the payments market in the European Union, the European Banking Authority recognised the need to implement changes that would enable strong customer authentication (SCA) to be applied by all parties involved (issuers, merchants, etc.) in this type of transaction, and accepted a period of limited supervisory flexibility in the application of SCA in these transactions to allow for the full adoption of authentication factors.
In Spain, this supervisory flexibility falls under the remit of the Banco de España and is subject to the existence of a migration plan setting out the actions to be carried out by the stakeholders during 2019 and 2020.
The plan developed by the Spanish community to ensure that all parties involved have the information and time needed to make the necessary adaptations before the deadline is available at this link.
