Online Card Payments temporarily exempt from Strong Customer Authentication in Finland
Written By
Pursuant to PSD2, as implemented into Finnish law, payment service providers needs to perform SCA when the user accesses its payment account online, when the payer is initiating a payment, or when the user carries out an action remotely which may imply a risk of payment fraud or other abuses.
Pursuant to PSD2 and the relevant Regulatory Technical Standards (RTS), the SCA requirements become applicable on 14 September 2019.
Following the EBA opinion on the elements of strong customer authentication under PSD2 dated 21 June 2019, the FIN-FSA has on 5 September 2019 published a supervision release (here) stating that it will temporarily not impose administrative sanctions on issuers and acquirers for not authenticating cardholders in relation to online card payments.
The length of the "supervisory standstill" will be defined later this year based on consultation with the EBA and supervisory authorities of other Member States.
We understand that the aim is that the deadline for compliance would be the same in all Member States.
During the course of this year, the FIN-FSA will require a migration plan from issuers and acquirers in relation to online card payments.
The objective of the "supervisory standstill" is to ensure continuity of online card payments and to avoid unnecessary inconvenience to cardholders. The FIN-FSA points out that, despite of the "supervisory standstill", the SCA requirements do become applicable on 14 September 2019, which will impact in particular the liability shift between the cardholders and issuers, as well as between issuers and acquirers/merchants.
The FIN-FSA also reminds issuers of the requirement to provide correct information to cardholders on the liability of each party to a payment transaction in case of misuse or fraud.
Therefore all Finnish issuers and acquirers engaged in online card payments should prepare to present their plans for implementing the SCA to the FIN-FSA. As mentioned above, the length of the supervisory standstill remains open but will most likely follow EBA's recommendation that is expected to be published within the coming weeks.
FIN-FSA announcement comes after a number of EU countries have announced similar regulator holidays in other EU countries – for example (see previous Bird & Bird client alerts on Italy here, Poland here, Germany here, UK here, Denmark here - for France, see here).
Should you have any questions concerning the above, please do not hesitate to contact one of the members of the Bird & Bird global payments team.
If you would like to receive our payments alerts directly in your inbox, please click here.
