FCA holds firm on strong customer authentication plan

The UK regulator said it continues to endorse an industry plan drawn up to achieve full compliance with the standards by 14 March 2021 – almost three months later than recommended by the European Banking Authority (EBA).

An FCA spokesperson said: "We note the EBA’s recent opinion stating that the implementation of SCA should be completed by the end of 2020 and their intention to report on implementation in Q1 2021. We encourage the industry to continue to work together to implement SCA on a timely basis and avoid significant disruption to consumers and merchants, and remain supportive of the UK industry plan. We are closely monitoring the progress of implementation and will be liaising with the EBA throughout the process to keep them fully informed."

The SCA standards aim to make sure that banks or payment services providers (PSPs) know that the person requesting access to an account or trying to make a payment is either the customer or someone who has their consent. They are intended to enhance the security of payments and limit fraud.

The SCA standards are hard-wired into EU legislation and took effect on 14 September, but businesses were granted more time to update their systems and processes to comply with the standards in respect of online payments.

Scope to apply an extended deadline was provided in June by the EBA, which said national regulators were free to apply an enforcement holiday in respect of ‘card-not-present’ transactions "on an exceptional basis and in order to avoid unintended negative consequences for some payment service users". That concession came after concerns were raised about the lack of preparedness for the forthcoming standards within the market.

The EBA's move prompted national regulators, including the FCA, the Irish Central Bank and Germany’s Federal Financial Supervisory Authority, to outline how they would defer enforcement. However, the EBA intervened again last month to recommend national regulators take a consistent approach to the SCA migration period and to set a final deadline of 31 December 2020 for compliance.

Financial services and technology law expert Luke Scanlon of Pinsent Masons, the law firm behind Out-Law, said: "The fact the FCA remains supportive of the SCA migration plan drawn up by UK Finance will be welcomed by UK banks, but the regulator should provide clarity on the outcome of its future discussions with the EBA as soon possible to allay any fears that the deadline will be pushed forward. It also remains to be seen how the disparity in deadlines interplays with Brexit and what action, if any, the EBA takes if the FCA maintains its outlier position the longer the UK remains an EU member state."