Strong customer authentication deadline extended again by FCA

The Financial Conduct Authority (FCA) announced the extension of the previous 14 September 2021 deadline on Thursday.

The SCA standards, which were developed under the second EU Payment Services Directive (PSD2) and have been implemented into UK law following Brexit, aim to make sure that banks and other payment services providers (PSPs) know that the person requesting access to an account or trying to make a payment is either the customer or someone who has their consent. They are therefore intended to enhance the security of payments and limit fraud.

The SCA standards took effect in EU law in September 2019 prior to Brexit taking effect, meaning they have notionally been in force in the UK since then. However, the European Banking Authority (EBA) previously granted national authorities permission to relax their approach to enforcement in limited circumstances amidst technical challenges faced by industry and associated delays in the implementation of the standards.

The FCA subsequently endorsed an industry-led plan to deliver full compliance by 14 March 2021. That plan included six-monthly milestones of 14 March 2020 and 14 September 2020 by which firms were expected to have completed a range of actions on their journey to full compliance. However, last year, citing the "exceptional circumstances" of the coronavirus pandemic, the FCA shifted the previous deadline of 14 March 2021 back by six months to give businesses more time to comply. In a new statement, the FCA has now confirmed a further extension has been applied in respect of the application of the SCA standards to e-commerce transactions.

The FCA said: “This further six-month extension is to ensure minimal disruption to merchants and consumers, and recognises ongoing challenges facing the industry to be ready by the previous 14 September 2021 deadline. The new 14 March 2022 deadline is the latest we expect full SCA compliance for e-commerce transactions.”

Andrew Barber, a payments expert at Pinsent Masons, the law firm behind Out-Law, said: “Notwithstanding last year’s extension as a result of the ‘exceptional circumstances’ of the coronavirus pandemic this further six month period for implementation shows just how monumental a task it is for merchants to implement SCA for e-commerce transactions”.

“Given the sheer scale of e-commerce activities and the complexity of the systems involved, the initial implementation period the EU set for SCA was clearly ambitious and the FCA is now rightly making adjustments to meet the realities of what industry is able to achieve. The further extension also demonstrates the need for industry and regulators to engage early and fully and the importance of setting achievable timelines must surely be the “lesson learned” from SCA implementation,” he said.