What does the Payment Services Directive (PSD2) mean for you?

To protect consumers from dealing with un­re­li­able companies, the European Com­mis­sion adopted a revised version of the Payment Services Directive in 2015. What is PSD2, exactly? Until January 1, 2021, PSD2 applied fully in the UK as part of EU le­gis­la­tion. However, following Brexit, it no longer applies do­mest­ic­ally. Instead, it only affects UK companies that offer payment services to customers within the EU.

What is the PSD2 reg­u­la­tion?

PSD2 is a revised version of the Payment Services Directive (PSD) initially in­tro­duced in 2007. It was adopted by the Council of the European Union on November 16, 2015, and im­ple­men­ted into national laws at the beginning of 2018. PSD2 regulates payment trans­ac­tions across Europe conducted by companies that are not clas­si­fied as tra­di­tion­al banks. Its purpose is to enable these non-bank companies to offer payment services over the internet, thereby stim­u­lat­ing and reg­u­lat­ing com­pet­i­tion within this sector of the financial industry

Payment Services Directive 1 & 2 therefore serve different purposes:

• Open com­pet­i­tion in payment services
• Reduce costs for consumers
• Regulate and support startups in the financial tech­no­logy sector (Fintech)
• Increase security for online payments

Payment Services Directive 2 in detail

The second version of the Payment Services Directive was im­ple­men­ted in multiple stages across the EU. One of its most important in­nov­a­tions is that banks must provide other companies with access to their customers’ in­form­a­tion—but only if the customer has given consent.

Banks are required to offer an interface to au­thor­ised providers, allowing them to initiate transfers directly and access in­form­a­tion about account balances and other financial details. Par­tic­u­larly in the fintech sector, many companies offer in­nov­at­ive software to help users manage their finances. Apps for saving, insurance, or stock trading rely on bank data. Since PSD2 came into effect, banks have been obligated to provide certified companies with an interface through which these service providers can retrieve necessary in­form­a­tion and carry out payments or transfers.

How does PSD2 work?

Service providers have accessed bank account in­form­a­tion before, but there was no stand­ard­ised method. In­ter­na­tion­ally, companies often relied on a technique called web scraping, where the service provider extracts in­form­a­tion directly from the online banking website. This method is in­ef­fi­cient and prone to errors. PSD2 requires banks to establish an Access to Account (XS2A) interface that allows au­thor­ised service providers to securely access customer account data.

PSD2 also offers measures to ensure the secure trans­mis­sion of sensitive data via in­ter­faces, pro­tect­ing consumers from potential risks. The data security is ensured through two main mech­an­isms:

• QWAC: This cer­ti­fic­ate allows providers and banks to mutually au­then­tic­ate each other. It also encrypts the data trans­mis­sion.
• QSeal: This seal is attached to the data and links it to a specific company. It allows tracking of which companies have accessed the bank account and trans­mit­ted data through the interface. Ad­di­tion­ally, the seal ensures that the data remains unaltered and any changes are de­tect­able.

To obtain these licences or seals, providers must receive approval from a national su­per­vis­ory authority. PSD2 dis­tin­guishes between two types of au­thor­isa­tions:

• Account In­form­a­tion Service Provider (AISP): Providers in this category access in­form­a­tion from the customer’s bank account for pro­cessing purposes. Only re­gis­tra­tion is required, not a full licence.
• Payment Ini­ti­ation Service Provider (PISP): Companies with this licence can initiate payments or transfers on behalf of the customer.

What does the directive mean for customers and online shop owners?

The Payment Services Directive largely concerns banks and other financial service providers. Users won’t notice a lot of the changes going on in the back­ground. And even for online retailers, there haven’t been many changes so far.

PSD2 from the user’s point of view

The revised PSD has enhanced payment security. The issuance of licences for technical solutions, as well as oversight by reg­u­lat­ory au­thor­it­ies, has ensured more reliable pro­tec­tion of sensitive data since its im­ple­ment­a­tion. In par­tic­u­lar, mandatory two-factor au­then­tic­a­tion — for example, via an SMS with a one-time password (OTP) — plays a crucial role in this.

What online retailers need to pay attention to regarding PSD2

If you are a UK online store owner selling products or services to customers in the European Union, and you process payments through EU banks or payment providers, PSD2 applies to your business. This means you must comply with the reg­u­la­tion’s security re­quire­ments when handling payments from EU customers.

Strong Customer Au­then­tic­a­tion (SCA) requires customers to verify payments using at least two of the following:

• something they know (such as a password or PIN),
• something they have (like a card or smart­phone),
• or something they are (biometric data such as fin­ger­prints or facial re­cog­ni­tion).

SCA is mandatory for payments over €30 (ap­prox­im­ately £26), or if multiple trans­ac­tions within one day total more than €100 (about £86). To comply with PSD2, you should work with payment providers that support PSD2 protocols, such as Stripe, PayPal, or Adyen, which have im­ple­men­ted security features like 3D Secure 2.0. It’s important to integrate these solutions properly into your checkout process to ensure EU customers can complete trans­ac­tions without issues. Testing your checkout flow to confirm that au­then­tic­a­tion works with European payment methods is also highly re­com­men­ded.

Certain payment types, such as direct debits (pull payments), are exempt from SCA under PSD2. In addition, payments below the specified thresholds may not require ad­di­tion­al au­then­tic­a­tion steps.

History of payment service dir­ect­ives from PSD1 to PSD2

With the first version of the Payment Services Directive, the European Com­mis­sion made a sig­ni­fic­ant move to regulate in­ter­na­tion­al payment trans­ac­tions. In the interest of har­mon­ising European payments (keyword SEPA), PSD es­tab­lished the legal framework for service providers in this area. This ex­pli­citly applied then, as it does now, to providers outside the tra­di­tion­al banking sector. Thus, PSD ef­fect­ively broke the monopoly that credit in­sti­tu­tions held over payment services.

However, not every company can operate as a so-called payment in­sti­tu­tion. The Payment Services Directive set binding criteria that such providers must meet. Yet despite many clear rules, some un­cer­tain­ties and leeway remained — some of these issues were even created by the directive itself. PSD2 closed these gaps and ad­di­tion­ally provided increased security for consumers.

This is achieved, for example, through the issuance of binding cer­ti­fic­ates and seals that can only be obtained from re­cog­nised or­gan­isa­tions. Ad­di­tion­ally, companies require approval from the national financial su­per­vis­ory authority.

Please refer to the legal notice regarding this article.