The German Federal Financial Supervisory Authority (BaFin) will allow payment service providers with seat in Germany to execute card-based payments online without strong customer authentication (SCA) until 31 December 2020. Based on a communication dated 17 October 2019 (link; only available in German), BaFin thus takes into account the relating opinion of the European Banking Authority (EBA) of 16 October 2019 on the deadline for the migration to SCA (link; cf. also the relating publication in our blog).
Pursuant to the revised European Payments Services Directive (PSD2) and the relating regulatory technical standards on SCA and common and secure communication (RTS), payment service providers are required to apply SCA when the user (1) accesses its payment account online, (2) initiates an electronic payment, or (3) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses. SCA means an authentication based on the use of at least two independent elements (derived from the three categories knowledge, possession and inherence).
BaFin had already communicated to temporarily refrain from applying the SCA requirements for online credit card payments without specifying the expiry date of this relief measure (cf. the relating publication in our blog). In its opinion of 16 October 2019, the EBA is of the view that such supervisory flexibility of national competent authorities (NCAs) should end on 31 December 2020. Further, the EBA sets out certain milestones and actions to be taken by NCAs towards payment service providers during the migration period.
In its communication, BaFin announces that its administrative practice will comply with these supervisory expectations of the EBA. BaFin further clarifies that its relief measure covers online payments with debit cards and prepaid cards as well. However, the German regulator also makes clear that payment service providers issuing cards should not use the migration period to stop offering PSD2-compliant authentication methods already implemented.