The Financial Conduct Authority (FCA) will not begin to enforce the implementation of 'strong customer authentication' (SCA) standards for e-commerce transactions until 14 September 2021, the regulator has confirmed.
The FCA said the "exceptional circumstances" of the coronavirus pandemic shifting the previous deadline of 14 March 2021 back by six months to give businesses more time to comply. The FCA had previously hinted at the possibility of an extension in light of the public health emergency.
Financial services and technology law expert Luke Scanlon of Pinsent Masons, the law firm behind Out-Law, said: "The pandemic has highlighted that the resiliency of a business in the future in many ways depends on how well it adopts technologies that are frictionless to use, while also being highly robust. With the additional time provided by the FCA, it is hoped that SCA solutions can evolve to a state that is closer to just that – a means of making payments and accessing transaction data for numerous purposes that is seamless but that also gives the customer peace of mind that their payments will be made as requested and that they have fully control over their data."
The SCA standards, developed under the second Payment Services Directive (PSD2), aim to make sure that banks and other payment services providers (PSPs) know that the person requesting access to an account or trying to make a payment is either the customer or someone who has their consent. They are therefore intended to enhance the security of payments and limit fraud.
The SCA standards took effect in EU law in September last year, however, the European Banking Authority (EBA) granted national authorities permission to relax their approach to enforcement in limited circumstances amidst technical challenges faced by industry and associated delays in the implementation of the standards.
The FCA subsequently endorsed an industry-led plan to deliver full compliance by 14 March 2021. The plan includes six-monthly milestones of 14 March 2020 and 14 September 2020 by which firms are expected to have completed a range of actions on their journey to full compliance.
A revised implementation plan will now take effect in light of the FCA's decision to apply a six-month extension to the backstop date of 14 March 2021.
The FCA said: "Firms are required to take all necessary steps to comply with the revised detailed phased implementation plan and critical path to avoid the risk of enforcement action. We expect UK Finance, as coordinator for the industry, to discuss the detailed phased implementation plan and critical path with all stakeholders and agree it with the FCA as soon as possible. In the meantime, firms should continue with the necessary preparatory activities such as robust end-to-end testing. After 14 September 2021, any firm that fails to comply with the requirements for SCA will be subject to full FCA supervisory and enforcement action."
Contact an adviser
