Payment Services Directive II: Unravelling the Mystery 7 March 2017

Transcription

1 Payment Services Directive II: Unravelling the Mystery 7 March 2017 John Casanova, Partner Sidley Austin LLP

2 PSD II What is it? New directive which will repeal and replace current EU payment services legislation. Many provisions in the new directive will be carried over from existing regulations. However, PSD II strengthens and modernises the current law in certain key areas. Deadline for implementation by EU Member States is 13 January 2018 (so will be implemented by UK prior to Brexit). SIDLEY AUSTIN LLP 2

3 Timeline Key Dates: PSD I to PSD II 1 November 2009 Deadline for implementation of PSD I. 24 July 2013 EU Commission issues proposal for PSD II. 25 November 2015 Final text of PSD II published in Official Journal. 13 January 2016 PSD II comes into force. 13 January 2018 Deadline for implementation of PSD II. SIDLEY AUSTIN LLP 3

4 PSD II - Background PSD II modernises the regulation of payments as a result of: significant technological developments since PSD I was adopted in 2007; new types of payment services providers (PSPs) entering into the market which are outside the scope of PSD I; inconsistent implementation of current regime by member states; the need to increase competition and lower prices in the market; and an increased focus upon consumer protection and payment security. SIDLEY AUSTIN LLP 4

5 PSD II Consultation Papers To date, the EBA has issued consultation papers on the following topics: professional indemnity insurance; registration of account information service providers; strong customer authentication and secure communication; major incident reporting; cooperation of competent authorities; and procedures for complaints of infringements of PSD2. 2 February 2016 HM Treasury issues a consultation paper on the implementation of PSD2 in the UK, along with a new set of implementing regulations intended to repeal and replace current law. Q the FCA will consult on the necessary changes to its handbook rules and guidance. SIDLEY AUSTIN LLP 5

6 PSD II Summary of key changes The key changes in PSD II are to: extend the scope to all currencies and one-leg payment transactions; extend regulation to payment initiation services and account information services; limit the scope of the exclusions; amend certain conduct of business requirements; and introduce new payment security requirements. SIDLEY AUSTIN LLP 6

7 PSD II What is a regulated payment transaction? Placing on and withdrawing cash from, a payment account (along with the operations required to operate the payment account). The following payment transactions: execution of direct debits, including one-offs; execution of payment transactions through a payment card or a similar device; and execution of credit transfers, including standing orders. Issuing of payment instruments and/or acquiring of payment transactions. Money remittance. Payment initiation services. Account information services. SIDLEY AUSTIN LLP 7

8 PSD II Who can provide regulated payment services? Payment institutions (authorisation required under PSD II); Credit institutions (authorised under the EU Banking Directive); E-money institutions (authorised under the EU E-money Directive); and Others. SIDLEY AUSTIN LLP 8

9 PSD II Who is excluded? The key exclusions are for: commercial agents authorised to negotiate or conclude transactions for either the payer or the payee; low value payments for digital content provided as ancillary to electronic communications services (e.g. ringtones, games, videos); limited networks (e.g. store card schemes); and cash and cheques. SIDLEY AUSTIN LLP 9

10 PSD II Key Changes Extension of territorial scope to certain non-eea PSPs. PSD I position: PSD I applied only to payment services provided in the EEA. This meant that both the payer s PSP and the payee s PSP must have been within the EEA. In addition, PSD I applied only to Euro and certain other Member State currencies. PSD II position: PSD II s provisions on the transparency of terms and conditions and information requirements apply to transactions where only one PSP is within the EEA. PSD II s provisions relating to transparency and information requirements also apply to all currencies. SIDLEY AUSTIN LLP 10

11 PSD II Key Changes PSD II contains two new regulated activities: Payment initiation services: service to initiate a payment order at the request of the payment service user with respect to a payment account held at another payment service provider. Must be authorised by the FCA prior to providing payment initiation services. Account information services: online services to provide consolidated information on one or more payment accounts held by the payment service user with either another PSP or with more than once PSP. Exempt from authorisation, but must be registered with the FCA instead. Registration requirements less onerous than for full authorisation. HM Treasury has adopted a broad definition of these services, and as such a wide range of services may be included. SIDLEY AUSTIN LLP 11

12 PSD II Key Changes Account access for payment initiation service providers and account information service providers ( Third Party Providers ): Account holding PSPs (i.e. banks) must provide Third Party Providers with nondiscriminatory access to customer accounts: Account holding PSPs must grant access via a secure communication interface which is freely available through the PSP s website. Functionality should be identical to what the customer would receive when accessing their account. Account holding PSPs obliged by PSD II to securely communicate with Third Party Providers, provided customer consents. Form of consent not specified by PSD II. HM Treasury intends to implement access primarily via the Open Banking Standard. SIDLEY AUSTIN LLP 12

13 PSD II Key Changes Three key exemptions appeared in PSD I, but which are now much more limited in scope: The commercial agent exemption is no longer available to e-commerce companies which handle payments for both payer and payee; The telecom operator exemption is now limited to low value payments for digital content only (e.g. ringtones, games, videos), with a maximum transaction value limit of EUR 50 per transaction and EUR 300 per billing month; and The limited networks exemption (e.g. store card schemes) must now meet one of the following certain specific criteria to qualify: payment instruments must allow holder to acquire goods only on premises of issuer or within a limited network of providers who have contractually agreed with issuer; users may acquire a very limited range of goods or services using payment instrument; or payment instruments valid in single member state issued for specific social or tax purpose to acquire specific goods or services, regulated by a public authority. SIDLEY AUSTIN LLP 13

14 PSD II Key Changes Conduct of business requirements: Safeguarding: PSD II removes the derogation which excludes customers with funds of EUR 600 or less; Third Party Providers: PSD II aims to increase competition by facilitating the use of TPPs; Charges: PSD II introduces a default ban on surcharging for instruments where interchange fees are capped, and allows member states to ban or limit the ability of a payee to surcharge in respect of other payment instruments; Liability: PSD II reduces the liability of a payment user for unauthorised payment transactions from EUR 150 to EUR 60, unless there is fraud or gross negligence; and Refunds: PSD II improves direct debit refund rights for payers. SIDLEY AUSTIN LLP 14

15 PSD II Key Changes New payment security requirements. Strong customer authentification requirement. Authentication using two or more independent pieces of information relating to the user: knowledge (something only the user knows); possession (something only the user possesses) and inherence (something the user is). Used when customer accesses account, initiates an electronic transaction or any circumstance where remote access creates risk of payment fraud, subject to certain exemptions (i.e. for low value contactless payments). ECB is to issue final regulatory technical standards on customer authentication and secure communication and has consulted extensively on implementation. ECB has confirmed that it will introduce a risk-based approach to authentication Obligation to promptly notify customers in event of account data breach. SIDLEY AUSTIN LLP 15

16 Questions? JOHN CASANOVA Sidley Austin LLP Woolgate Exchange 25 Basinghall Street London EC2V 5HA SIDLEY AUSTIN LLP 16

17 1,900 LAWYERS and 20 OFFICES located in commercial, financial and regulatory centers around the world Beijing Chicago Houston New York Singapore Boston Dallas London Palo Alto Sydney Brussels Geneva Los Angeles San Francisco Tokyo Century City Hong Kong Munich Shanghai Washington, D.C.