With PSD2’s Regulatory Technical Standards now published, the broader financial ecosystem is moving closer towards full-scale implementation of the EU’s revised payment services directive. Designed to add greater security to payments and stimulate commerce, PSD2 enables third party financial services to provide solutions without necessarily involving the current payment schemes.
The directive will enable payers to “push” payments directly through a bank transfer from their bank account to payees by enabling them to use third party Payment Service Providers (PSPs) to do so. Furthermore, customers will have the opportunity to consent to third party PSP products that access and utilise customers’ transactional data, such as budgeting services. To ensure security of payment transactions, PSD2 mandates multi-factor authentication for payment service providers (PSPs).
While these changes to the financial market are likely to stoke the demand for identity services, the broader PSD2 ecosystem will need to provide guidance on how the EU Directive can be interpreted and implemented. Organisations such as Convenient Access to PSD2 Services(CAPS) can play a role in helping to provide a common approach by acting as forum for the proposal of solutions to the technical, business and operational issues faced by potential PSD2 stakeholders across Europe. CAPS’ ‘Mobile Strong Customer Authentication Under PSD2: Comparisons and Considerations’, provides the framework for a common approach to strong customer authentication (SCA) in remote payment transactions, based on mobile devices.
In the wake of rising digital transactions and the high levels of fraud accompanying them, multi-factor authentication is increasingly regarded as the baseline for payment security, typically requiring payers to verify something they possess (such as a mobile phone) and something they know (such as a PIN) or something specific to who they are (such as a fingerprint).
PSPs and financial services without multi-factor authentication covering their entire customer base now face the task of developing or sourcing a multi-factor authentication service. With the new guidelines of the Regulatory Technical Standards leaving only an 18-month period from now until mandatory compliance, we can expect a spike in the demand for authentication products.
Mobile Connect, the identity solution developed by the mobile industry, is one such PSD2-compliant product. Designed for a range of sectors, Mobile Connect is supported by more than 60 mobile network operators in over 30 countries, thereby offering PSPs secure authentication on a global scale.
As well as serving existing PSPs and financial solutions making the transition to multi-factor authentication, Mobile Connect could also play a role in supporting new entrants to the market following PSD2’s broadening of the definition of ‘payment service provider’.