The EU takes stock of whether PSD2 is a success

It is more than four years since pay­ments in Europe under­went a rev­o­lu­tion. In 2018, the reg­u­la­tions of Europe’s Pay­ment Ser­vices Direc­tive 2 (PSD2) came into force across the EU, then includ­ing the UK.

PSD2 ush­ered in a new era of open bank­ing, giv­ing con­sumers more con­trol over how they man­aged their pay­ments and bank accounts, and open­ing com­pe­ti­tion to new play­ers in the bank­ing and finance sec­tor. It forced banks to allow com­peti­tors access to their cus­tomer data, mak­ing it eas­i­er for con­sumers to switch to a bank offer­ing them a bet­ter deal.

The reg­u­la­tions also intro­duced new secu­ri­ty mea­sures intend­ed to make online pay­ments safer. These includ­ed two-fac­tor strong cus­tomer authen­ti­ca­tion (SCA) for cer­tain elec­tron­ic pay­ment trans­ac­tions and for access­ing accounts online. It required con­sumers to iden­ti­fy them­selves in two dif­fer­ent ways when mak­ing a pay­ment, such as typ­ing a pass­word, enter­ing a code on a smart­phone or con­firm­ing a pay­ment using a fin­ger­print.

PSD2 also intro­duced a ban on shops and online retail­ers from adding addi­tion­al sur­charges for pay­ments made with cred­it and deb­it cards.

Assessing the effectiveness of PSD2

So has the new regime worked? To find out, the Euro­pean Com­mis­sion start­ed a series of con­sul­ta­tions this sum­mer to review the effec­tive­ness of the PSD2 reg­u­la­tions and deter­mine the extent to which its objec­tives had been achieved. If fur­ther changes or clar­i­fi­ca­tions are required, this might lead to a third direc­tive at some point.

Mairead McGuin­ness, the finan­cial ser­vices com­mis­sion­er, declared the 12-week review open in mid-May. She said that, since the enact­ment of PSD2, “a wide array of new play­ers – in par­tic­u­lar, tech­ni­cal ser­vice providers – have become key actors in the pay­ments ecosys­tem. And they are not all effec­tive­ly super­vised. With the increase of dig­i­tal­i­sa­tion and ecom­merce, social engi­neer­ing and scams pose a grow­ing threat to pay­ment secu­ri­ty and con­sumer con­fi­dence. As new types of fraud emerge, we must be ready to improve both detec­tion and pre­ven­tion mea­sures.”

Hun­dreds of stake­hold­ers – includ­ing trade asso­ci­a­tions, busi­ness­es (not only in the pay­ments sec­tor) and indi­vid­u­als – have respond­ed to the con­sul­ta­tions.

One of them, the Euro­pean Bank­ing Author­i­ty (EBA), believes that the ben­e­fits of PSD2 are start­ing to mate­ri­alise. 

“The secu­ri­ty require­ments – in par­tic­u­lar, SCA – are hav­ing the desired effect of reduc­ing fraud,” it wrote in its sub­mis­sion. The EBA has found that the share of fraud by val­ue is three times high­er for pay­ments authen­ti­cat­ed with­out SCA com­pared with pay­ments authen­ti­cat­ed with SCA.

Is new regulation a barrier to financial inclusion?

But not every­one is con­vinced that SCA is the right way to do this. Denmark’s finan­cial affairs min­is­ter, Simon Kollerup, says that, while SCA has led to a sig­nif­i­cant decrease in fraud cas­es, it can cause incon­ve­nience for users and may cre­ate “a lack of finan­cial inclu­sion for vul­ner­a­ble and non-tech savvy cit­i­zens”.

The Euro­pean Secu­ri­ty Trans­port Asso­ci­a­tion (Esta) rep­re­sents com­pa­nies in the Euro­pean cash man­age­ment indus­try. It also expressed con­cerns over finan­cial inclu­sion in its response to the con­sul­ta­tion, call­ing on the com­mis­sion to ensure that cash pay­ments are includ­ed in any new direc­tive (they are exclud­ed from PSD2). 

“Con­sumers must have a right to pay in cash”, while “retail­ers must have an oblig­a­tion to accept pay­ments in cash,” Esta said. It added that the “war on cash” had advanced by sev­en years dur­ing the pan­dem­ic, large­ly because author­i­ties had been mak­ing unsub­stan­ti­at­ed claims about the risk of con­t­a­m­i­na­tion through cash trans­ac­tions.

PSD2 bans mer­chants from impos­ing sur­charges for the use of cred­it cards. There are con­cerns in some quar­ters about the impact of this move. 

For instance, Germany’s Fed­er­al Car­tel Office argues that, while the inter­change fees that banks charge mer­chants for using cards have fall­en, the pay­ment scheme fees charged by the likes of Visa and Mas­ter­card have increased and have been passed through to con­sumers through high­er prices. It says that con­sumers using rel­a­tive­ly inex­pen­sive pay­ment meth­ods have end­ed up “cross-financ­ing the more expen­sive meth­ods”.

How travel sector is struggling to adapt

The trav­el sec­tor in par­tic­u­lar has faced prob­lems oper­at­ing under PSD2. For exam­ple, it’s been hard for oper­a­tors to han­dle book­ings for ser­vices such as hotel accom­mo­da­tion where the trav­eller doesn’t show up and has no incen­tive to pro­vide fur­ther authen­ti­ca­tion to cov­er the cost of the book­ing. 

There has also been con­fu­sion regard­ing book­ings made on com­pa­ny cred­it cards and so-called lodged cards, where com­pa­nies require their employ­ees to use a sin­gle com­pa­ny card num­ber that has been ‘lodged’ with their trav­el agent when book­ing busi­ness trips. Such trans­ac­tions are exempt from SCA but there is no ban on card sur­charges unlike for con­sumer trans­ac­tions.

How­ev­er for com­pa­nies requir­ing employ­ees to use their own cards rather than cor­po­rate ones, these exemp­tions do not apply. In these cas­es, there are dif­fi­cul­ties han­dling book­ings for ser­vices such as hotels and car rental where pay­ment is only made when the trav­el hap­pens rather than at book­ing. 

Some air­lines have also been using incor­rect assump­tions – for instance, that pay­ments made using Amer­i­can Express cards are exempt from the require­ments of PSD2 because Amex is based out­side the EU.

Trav­el tech­nol­o­gy organ­i­sa­tion EU Trav­el Tech has called on the com­mis­sion to pro­vide fur­ther clar­i­fi­ca­tion of sur­charge require­ments so that they are applied more con­sis­tent­ly and fair­ly across mem­ber states.

Dig­i­tal Europe, a trade asso­ci­a­tion for dig­i­tal indus­tries, has called for cer­tain exemp­tions from PSD2 – most notably, charg­ing ter­mi­nals for elec­tric vehi­cles, in order to has­ten the move away from petrol and diesel.

What’s next for open banking?

The open bank­ing rev­o­lu­tion promised by PSD2 has come to fruition, at least in part. Com­pe­ti­tion has increased in the pay­ments sec­tor, with more than 2,700 new pay­ment insti­tu­tions and elec­tron­ic mon­ey insti­tu­tions reg­is­tered since the direc­tive took effect.W

The Euro­pean Bank­ing Fed­er­a­tion (EBF) believes that over­all, PSD2 has con­tributed to increas­ing lev­els of inno­va­tion, com­pe­ti­tion and secu­ri­ty and that con­cepts such as SCA have been “pos­i­tive devel­op­ments”.

How­ev­er, in its response the EBF said it might be too ear­ly to com­pre­hen­sive­ly gauge the impact PSD2 has had on the mar­ket. Fur­ther change should keep “reg­u­la­to­ry con­sis­ten­cy as a core prin­ci­ple”, it said. The EBF also believes that a review of PSD should look beyond open bank­ing into open finance, which would extend reg­u­la­tion to cov­er pen­sions, insur­ance and invest­ments.

McGuin­ness sees this as a poten­tial route for new reg­u­la­tion. When she announced the review, she said: “Open finance has the poten­tial to spark new, inno­v­a­tive prod­ucts per­son­alised to indi­vid­ual con­sumers – while those con­sumers keep con­trol over their data.”

The pay­ments sec­tor has also moved fast. One of the big ques­tions is whether Europe will bring in new reg­u­la­tions for inno­v­a­tive pay­ment types, such as cryp­to trans­ac­tions, dig­i­tal wal­let ser­vices and buy-now-pay-lat­er (BNPL) schemes. The com­bined val­ue of BNPL trans­ac­tions world­wide jumped from £29bn in 2019 to £103bn in 2021. But the num­ber of con­sumer com­plaints about BNPL in the UK has risen sharply.

Fur­ther inno­va­tion in the pay­ments space seems inevitable. Europe’s reg­u­la­tors will have to move sharply to ensure that there’s a lev­el play­ing field for new­com­ers and lega­cy busi­ness­es, while pro­tect­ing the con­sumers who use them.