FCA to delay enforcement of payment security standards

New strong customer authentication (SCA) standards, which will apply to many payment transactions in Europe, must be implemented by PSPs by 14 September. However, while that legal deadline for compliance is hard-wired into EU law, the European Banking Authority (EBA) recently gave scope to national regulators to apply an enforcement holiday in certain circumstances to give businesses more time to update their systems and processes.

Today, the FCA outlined its plans to take advantage of the flexibility the EBA has provided.

"The FCA recognises the challenges in meeting this deadline and has been working with the industry to develop a plan to migrate the industry to implement SCA for card payments in e-commerce as soon as possible after this," the regulator said in a statement.

"We aim to quickly agree a plan with stakeholders across the industry that encompasses a blueprint for compliance and readiness, a timetable for achieving this, and key milestones and targets to deliver improved security of customer authentication and fraud reduction along the way. We will work in close cooperation with all the industry stakeholders and other authorities, including the Payment Systems Regulator, to ensure delivery of the blueprint at pace," it said.

"Once the group has finalised the plan and we have agreed it, we expect all participants to meet the agreed milestones, targets and final delivery date. We believe this approach is proportionate. We will not take enforcement action against firms if they do not meet the relevant requirements for SCA from 14 September 2019 in areas covered by the agreed migration plan, where there is evidence that they have taken the necessary steps to comply with the plan," the FCA said.

Payments and technology law expert Angus McFadyen of Pinsent Masons, the law firm behind Out-Law, said the announcement continues the regulatory recognition of the adverse impact these rules could have.

"Consumers will see a real impact on their day to day spending experience and no one is communicating with them to explain this," McFadyen said. "Equally, the regulators have not been able to address some of the other unintended consequences such as the possible adverse impact on the innovative overlay services, like money management apps, that law makers have been supporting."