As the coronavirus (COVID-19) pandemic continues to spread across the globe, governments and international organisations (e.g. World Health Organisation) are recommending to consumers that, rather than paying in cash in shops, they should pay electronically.
In particular, contactless payments with a card or with a mobile phone are encouraged as they require no physical interaction with the terminal, at least when the contactless payment can take place without having to enter a PIN on the terminal's PIN pad.
Over the last couple of weeks, we have seen a number of countries taking action in order to promote contactless payments without PIN.
In the EU, we are aware of the following examples:
A number of countries outside of the EU have taken similar measures to raise the limits for contactless payments without a PIN. For example:
In the above context, the EBA released a statement on 25 March 2020 (available here) calling on payment service providers (PSPs) to make maximum use of the exemptions to strong customer authentication (SCA) available for contactless payments.
Since 14 September 2019, PSD2 and the regulatory technical standards (RTS) on SCA have regulated the SCA limits for contactless payments. A contactless payment can only take place without the issuer performing an SCA of the cardholder, e.g. via a PIN, when:
As you can see from the above examples, not all EEA countries have yet implemented the maximum limits set out in the RTS. Presumably, they are introducing lower limits as a compromise between slowing down the spread of COVID-19, while at the same time limiting the potential exposure to fraudulent transactions.
We should not exclude further limit increases in the coming weeks in those countries that have not yet implemented the maximum limits set out in the RTS.
Further to the above, Mastercard published a press release on 25 March 2020 containing, in particular, a summary table of the old and new contactless without PIN limits for Mastercard-branded transactions across the EEA – available here.
In the above statement, the EBA also announced that, "in order to support PSPs' efforts to focus on their customers," it was removing the obligation imposed on national competent authorities (NCAs) to report information, by 31 March 2020 on PSPs' readiness to meet the SCA requirements for remote transactions.
The deadline for migration to SCA on remote card transactions is currently set to 31 December 2020, further to an EBA Opinion of 16 October 2019 (available here).However, one queries whether the COVID-19 pandemic, and its impact on the activities of PSPs', merchants, card schemes, etcetera, may require the EBA to extend the migration period by a few months, potentially into 2021. In its above statement, the EBA indicated that "While all other requirements … remain unchanged, the EBA will continue to monitor events and assess which, if any, additional measures need to be taken," therefore leaving the door open to such a possibility.
We will continue to monitor this issue and will keep you informed on any developments.
Should you have any questions concerning the above, please do not hesitate to contact one of the members of the Bird & Bird global Payments team.
If you would like to receive Bird & Bird's Payments alerts directly in your inbox, please click here.
If you would like to read Bird & Bird's previous alerts, please check out our Payments In Focus webpage here.