The present communication is addressed to all payment service providers (“PSPs”) and electronic money institutions (“EMIs”) as defined in Article 1(37) of the Luxembourg Law of 20 July 2018, amending the Law of 10 November 2009 on payment services (the “Law”), which transposes Directive (EU) 2015/23665 (“PSD2”), for which the CSSF is the designated competent authority for supervisory purposes.
As such, the CSSF ensures that PSPs and EMIs, which offer a payment account accessible online, comply with the obligation specified by Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication (the “RTS on SCA and CSC”).
Article 32(3) of the RTS on SCA and CSC provides that “account servicing payment service providers that have put in place a dedicated interface shall ensure that this interface does not create obstacles to the provision of payment initiation and account information services.”
On 4 June 2020, the European Banking Authority (“EBA”) published an “Opinion on obstacles under Article 32(3) of the RTS on SCA and CSC” in order to respond to requests for clarification as to whether certain market practices constitute such obstacles.
This Opinion clarifies among other things:
- When mandatory redirection is an obstacle to the provision of TPPs’ services;
- That requiring re-authentication every 90 days for account information services following the RTS on SCA and CSC is not an obstacle;
- The authentication procedures that ASPSPs’ interfaces must support and
- Some obstacles identified in the market, including requiring multiple SCAs, the manual entry of the IBAN in the ASPSPs’ domain or imposing additional checks of the consent given by the customer to the TPP.
With this communication, the CSSF would like to inform PSPs that it shares the EBA’s opinion regarding the interpretation of Article 32(3) of the RTS on SCA and CSC and that it will monitor compliance with this Article 32(3) of the RTS on SCA and CSC taking into account the views expressed in the EBA Opinion on obstacles.
The CSSF asks all ASPSPs concerned to take into account this Opinion in the design of a dedicated interface, to check the conformance of their existing dedicated interfaces and to remove any obstacles identified.
The CSSF acknowledges that the technical adaptations that may be required as a result of this EBA Opinion on obstacles will take some time. Therefore, the CSSF expects any remaining issues to be solved by 31 December 2020 at the latest.
After this date, an ASPSP with a dedicated interface which is not compliant with the PSD2, the RTS on SCA and CSC or the EBA Opinion on obstacles will be subject to supervisory actions, including when relevant the right under Article 33(7) of the RTS on SCA and CSC to revoke a contingency mechanism exemption previously granted.