What does the Payment Services Directive (PSD2) mean for you?

To protect consumers from dealing with un­re­li­able companies, the European Com­mis­sion adopted a revised version of the Payment Services Directive in 2015. What is PSD2, exactly? While it primarily applies within the EU, U.S. companies offering payment services to European customers must also comply with its re­quire­ments.

What is the PSD2 reg­u­la­tion?

PSD2 is a revised version of the Payment Services Directive (PSD) initially in­tro­duced in 2007. It was adopted by the Council of the European Union on November 16, 2015, and im­ple­ment­ed into national laws at the beginning of 2018. PSD2 regulates payment trans­ac­tions across Europe conducted by companies that are not clas­si­fied as tra­di­tion­al banks. Its purpose is to enable these non-bank companies to offer payment services over the internet, thereby stim­u­lat­ing and reg­u­lat­ing com­pe­ti­tion within this sector of the financial industry

Payment Services Directive 1 & 2 therefore serve different purposes:

• Open com­pe­ti­tion in payment services
• Reduce costs for consumers
• Regulate and support startups in the financial tech­nol­o­gy sector (Fintech)
• Increase security for online payments

Payment Services Directive 2 in detail

The second version of the Payment Services Directive was im­ple­ment­ed in multiple stages across the EU. One of its most important in­no­va­tions is that banks must provide other companies with access to their customers’ in­for­ma­tion—but only if the customer has given consent.

Banks are required to offer an interface to au­tho­rized providers, allowing them to initiate transfers directly and access in­for­ma­tion about account balances and other financial details. Par­tic­u­lar­ly in the fintech sector, many companies offer in­no­v­a­tive software to help users manage their finances. Apps for saving, insurance, or stock trading rely on bank data. Since PSD2 came into effect, banks have been obligated to provide certified companies with an interface through which these service providers can retrieve necessary in­for­ma­tion and carry out payments or transfers.

How does PSD2 work?

Service providers have accessed bank account in­for­ma­tion before, but there was no stan­dard­ized method. In­ter­na­tion­al­ly, companies often relied on a technique called web scraping, where the service provider extracts in­for­ma­tion directly from the online banking website. This method is in­ef­fi­cient and prone to errors. PSD2 requires banks to establish an Access to Account (XS2A) interface that allows au­tho­rized service providers to securely access customer account data.

PSD2 also offers measures to ensure the secure trans­mis­sion of sensitive data via in­ter­faces, pro­tect­ing consumers from potential risks. The data security is ensured through two main mech­a­nisms:

• QWAC: This cer­tifi­cate allows providers and banks to mutually au­then­ti­cate each other. It also encrypts the data trans­mis­sion.
• QSeal: This seal is attached to the data and links it to a specific company. It allows tracking of which companies have accessed the bank account and trans­mit­ted data through the interface. Ad­di­tion­al­ly, the seal ensures that the data remains unaltered and any changes are de­tectable.

To obtain these licenses or seals, providers must receive approval from a national su­per­vi­so­ry authority. PSD2 dis­tin­guish­es between two types of au­tho­riza­tions:

• Account In­for­ma­tion Service Provider (AISP): Providers in this category access in­for­ma­tion from the customer’s bank account for pro­cess­ing purposes. Only reg­is­tra­tion is required, not a full license.
• Payment Ini­ti­a­tion Service Provider (PISP): Companies with this license can initiate payments or transfers on behalf of the customer.

What does the directive mean for customers and online store owners?

The Payment Services Directive largely concerns banks and other financial service providers. Users won’t notice a lot of the changes going on in the back­ground. And even for online retailers, there haven’t been many changes so far.

PSD2 from the user’s point of view

The revised PSD has enhanced payment security. The issuance of licenses for technical solutions, as well as oversight by reg­u­la­to­ry au­thor­i­ties, has ensured more reliable pro­tec­tion of sensitive data since its im­ple­men­ta­tion. In par­tic­u­lar, mandatory two-factor au­then­ti­ca­tion — for example, via an SMS with a one-time password (OTP) — plays a crucial role in this.

What online retailers need to pay attention to regarding PSD2

If you are a US online store owner selling products or services to customers in the European Union, and you process payments through EU banks or payment providers, PSD2 applies to your business. This means you must comply with the reg­u­la­tion’s security re­quire­ments when handling payments from EU customers.

Strong Customer Au­then­ti­ca­tion requires that customers verify payments using at least two of the following: something they know (like a password or PIN), something they have (such as a card or smart­phone), or something they are (biometric data like fin­ger­prints or facial recog­ni­tion). SCA is mandatory for payments over €30 (ap­prox­i­mate­ly $34), or if multiple trans­ac­tions within one day total more than €100 (about $113).

To comply with PSD2, you should work with payment providers that support PSD2 protocols, such as Stripe, PayPal, or Adyen, which have im­ple­ment­ed security features like 3D Secure 2.0. It’s important to properly integrate these payment solutions into your checkout process to ensure EU customers can complete trans­ac­tions smoothly. Testing your checkout flow to confirm that the au­then­ti­ca­tion steps work correctly for European payment methods is also highly rec­om­mend­ed.

Certain payment types, such as direct debit (pull payments), are exempt from SCA under PSD2. Ad­di­tion­al­ly, payments below the specified thresh­olds may not require the ad­di­tion­al au­then­ti­ca­tion steps.

The surcharge is no longer permitted thanks to PSD2. Before the directive was enforced, it was common for merchants to charge an ad­di­tion­al fee for payments made by credit card to avoid bearing the extra costs them­selves.

History of payment service di­rec­tives from PSD1 to PSD2

With the first version of the Payment Services Directive, the European Com­mis­sion made a sig­nif­i­cant move to regulate in­ter­na­tion­al payment trans­ac­tions. In the interest of har­mo­niz­ing European payments (keyword SEPA), PSD es­tab­lished the legal framework for service providers in this area. This ex­plic­it­ly applied then, as it does now, to providers outside the tra­di­tion­al banking sector. Thus, PSD ef­fec­tive­ly broke the monopoly that credit in­sti­tu­tions held over payment services.

However, not every company can operate as a so-called payment in­sti­tu­tion. The Payment Services Directive set binding criteria that such providers must meet. Yet despite many clear rules, some un­cer­tain­ties and leeway remained — some of these issues were even created by the directive itself. PSD2 closed these gaps and ad­di­tion­al­ly provided increased security for consumers.

This is achieved, for example, through the issuance of binding cer­tifi­cates and seals that can only be obtained from rec­og­nized or­ga­ni­za­tions. Ad­di­tion­al­ly, companies require approval from the national financial su­per­vi­so­ry authority.

Please refer to the legal notice regarding this article.