View source for Finance:Payment Services Directive

{{Short description|EU Directive}}
The '''Revised Payment Services Directive''' ('''PSD2''', '''Directive (EU) 2015/2366''',<ref>{{Citation|title=Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (Text with EEA relevance)|date=2015-12-23|url=https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02015L2366-20151223|volume=OJ L|issue=32015L2366|language=en|access-date=2020-07-12}}</ref> which replaced the '''Payment Services Directive (PSD)''', '''Directive 2007/64/EC'''<ref name="32007L0064"/>) is an EU Directive, administered by the European Commission (Directorate General Internal Market) to regulate payment services and [[Finance:Payment service provider|payment service provider]]s throughout the [[Social:European Union|European Union]] (EU) and European Economic Area (EEA). The PSD's purpose was to increase pan-European competition and participation in the payments industry also from non-banks, and to provide for a level playing field by harmonizing consumer protection and the rights and obligations for payment providers and users.<ref name="PSD">{{cite web|url=https://ec.europa.eu/info/law/payment-services-psd-1-directive-2007-64-ec_en|title=Payment services (PSD 1) - Directive 2007/64/EC|publisher=European Commission|access-date=2017-02-13}}</ref>
The key objectives of the PSD2 directive are creating a more integrated European payments market, making payments more secure and protecting consumers.<ref>{{Cite web|title=Authorised Payment Institution {{!}} Payments {{!}} Licensing & Compliance|url=https://www.buckinghamcapitalconsulting.com/authorised-payment-institution|website=BCC UK|language=en|access-date=2020-05-26}}</ref>

==Overview==
The [[Organization:Single Euro Payments Area|SEPA (Single Euro Payments Area)]] is a self-regulatory initiative by the European banking sector represented in the European Payments Council, which defines the harmonization of payment products, infrastructures and technical standards (Rulebooks for [[Finance:Wire transfer|credit transfer]]/[[Finance:Direct debit|direct debit]], [[ISO 9362|BIC]], [[International Bank Account Number|IBAN]], [[ISO 20022]] XML message format, EMV chip cards/terminals). The PSD provides the legal framework within which all payment service providers must operate.

The PSD's purpose in regard to the payments industry was to increase pan-European competition with participation also from non-banks, and to provide for a level playing field by harmonizing consumer protection and the rights and obligations for payment providers and users.<ref name=PSD />
The PSD's purpose in regard to consumers was to increase customer rights, guarantee faster payments (no later than next day since 1 January 2012), describe refund rights, and give clearer information on payments.<ref>{{cite web|title=The Payment Services Directive – What it means for Consumers|url=http://ec.europa.eu/internal_market/payments/docs/framework/psd_consumers/psd_en.pdf|publisher=European Commission|access-date=20 March 2014|archive-url=https://web.archive.org/web/20130530163006/http://ec.europa.eu/internal_market/payments/docs/framework/psd_consumers/psd_en.pdf|archive-date=2013-05-30}}</ref> Although the PSD was a maximum harmonisation directive, certain elements allowed for different options by individual countries.<ref>{{cite web|url=http://ec.europa.eu/internal_market/payments/framework/options_en.htm |title=Directive on Payment Services (PSD) – Member States' options|publisher=European Commission |work=EC.Europa.eu |date= |access-date=2015-02-27 |archive-url=https://web.archive.org/web/20150227172900/http://ec.europa.eu/finance/payments/framework/options_en.htm |archive-date=2015-02-27}}</ref>

The final adopted text of PSD went into force 25 December 2007 and was transposed into national legislation by all EU and EEA member states by 1 November 2009.<ref name="32007L0064">{{cite web|url=http://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32007L0064|title=Directive 2007/64/EC of the European Parliament and of the Council of 13 November 2007 on payment services in the internal market amending Directives 97/7/EC, 2002/65/EC, 2005/60/EC and 2006/48/EC and repealing Directive 97/5/EC|work=Official Journal of the European Union|date=5 December 2007|access-date= 2 August 2014}}</ref><ref>{{cite web|url=https://ec.europa.eu/info/business-economy-euro/banking-and-finance/consumer-finance-and-payments/payment-services/payment-services_en|title=Payment Services|website=EC.Europa.eu|publisher=European Commission|access-date=2017-02-13}}</ref>

===Technical overview===
The PSD contained two main sections:

# The "market rules" described which type of organizations could provide payment services. Next to credit institutions (i.e. banks) and certain authorities (e.g. central banks, government bodies), the PSD mentioned electronic money institutions (EMI), created by the [[Finance:E-Money Directive|E-Money Directive]] in 2000, and created the new category of "payment institutions" (PI) with its own prudential regime rules. Organizations that are neither credit institutions nor EMIs could apply for an authorization as a payment institution if they met certain capital and risk management requirements. The application could be made in any EU country where they are established and they could then "passport" their payment services into all other EU member states without additional PI requirements.
# The "business conduct rules" specified what transparency of information payment service institutions needed to provide, including any charges, exchange rates, transaction references and maximum execution time. It stipulated the rights and obligations for both payment service providers and users, how to authorize and execute transactions, liability in case of unauthorized use of payment instruments, refunds on payments, payment orders, and value dating of payments.

Each country had to designate a "competent authority" for prudential supervision of the PIs and to monitor compliance with business conduct rules, as transposed into national legislation.<ref>{{cite web|url=http://ec.europa.eu/internal_market/payments/docs/framework/transposition/authorisation_supervision_en.pdf |title=Competent authorities for the authorisation and supervision of payment institutions (Article 20)|website=EC.Europa.eu|access-date=2015-02-27|archive-url=https://web.archive.org/web/20150227135553/http://ec.europa.eu/internal_market/payments/docs/framework/transposition/authorisation_supervision_en.pdf|archive-date=2015-02-27}}</ref>

===Updates===
The PSD was updated in 2009 (EC Regulation 924/2009) and 2012 (EU Regulation 260/2012). An implementation report from 2013 found the PSD facilitated "provision of uniform payment services across the EU" and reduced legal and production costs for many payment service providers and that "the expected benefits have not yet been fully realised". The same report found the 2009 update "to be functioning well. For example, charges for €100 transfers followed a further downward trend to €0.50 euro-area average for transfers initiated online and remained low, at €3.10 for transfers initiated at the bank counter".<ref name=EU2013 />

In October 2021 the EBA launched a public consultation on the amendment of its Regulatory Technical Standards (RTS) on strong customer authentication and secure communication (SCA&CSC) under the Payment Services Directive (PSD2) with regard to 90-day exemption from SCA for account access.<ref>{{cite press release |url=https://www.eba.europa.eu/eba-consults-amendment-its-technical-standards-strong-customer-authentication-and-secure|title=EBA consults on the amendment to its technical standards on strong customer authentication and secure communication in relation to the 90-day exemption for account access|publisher=European Commission|date=28 October 2021|access-date=2021-02-01}}</ref> In the UK, the FCA published PS 21/19<ref name="UK-RTS 90 Day">{{cite press release |url=https://www.fca.org.uk/publications/policy-statements/ps21-19-changes-sca-rts-and-guidance-approach-document-and-perimeter-guidance-manual|title=PS21/19: Changes to the SCA-RTS and to guidance in the Approach Document and the Perimeter Guidance Manual|publisher=The Financial Conduct Authority|date=29 November 2021|access-date=2021-02-01}}</ref> (“policy statement”) for “Changes to the SCA-RTS and to the guidance in ‘Payment Services and Electronic Money – Our Approach’ and the Perimeter Guidance Manual” . This document proposed a number of modifications including to Article 10 of the UK- RTS, by replacing the requirement for the PSU to re-authenticate with their ASPSP every 90 days to allow AISP access  with the requirement for the PSU to reconfirm their consent with their AISP directly.

===Remaining issues===
# The PSD only applied to payments within the European Economic Area, but not to transactions to or from third countries.
# PSD exemptions related to payment activities left users unprotected.
# The PSD option for merchants to charge a fee or give a rebate, combined with the option for countries to limit this, led to "extreme heterogeneity in the market".
# So-called "third party payment service providers" emerged, which facilitated online shopping by offering low cost payments on the Internet by using the customers' home online banking application with their agreement, and informing merchants that the money is on its way. Other "account information services" offer consolidated information on different accounts of a payments service user. Harmonisation of refund rules regarding direct debits, a reduction of the scope of the "simplified regime" for so-called "small payment institutions" and addressing security, access to information on payment accounts or data privacy with possible licensing and supervision were proposed.<ref name=EU2013 />

===Revised Directive on Payment Services (PSD2)===
On 8 October 2015, the European Parliament adopted the European Commission proposal to create safer and more innovative European payments (PSD2, Directive (EU) 2015/2366). The current rules aim to better protect consumers when they pay online, promote the development and use of innovative online and mobile payments such as through [[Finance:Open banking|open banking]], and make cross-border European payment services safer.<ref name ="PSD2 press release">{{cite press release |url=http://europa.eu/rapid/press-release_IP-15-5792_en.htm?locale=en|title=European Parliament adopts European Commission proposal to create safer and more innovative European payments|publisher=European Commission|date=8 October 2015|access-date=2016-05-04}}</ref>

Then-Commissioner Jonathan Hill, responsible for Financial Stability, Financial Services and Capital Markets Union, said, "This legislation is a step towards a digital single market; it will benefit consumers and businesses, and help the economy grow."<ref name ="PSD2 press release" />

On 16 November 2015, the [[Organization:Council of the European Union|Council of the European Union]] passed PSD2. Member states then had two years to incorporate the directive into their national laws and regulations.<ref name="PSD2 passed">{{cite press release |url=http://www.consilium.europa.eu/en/press/press-releases/2015/11/16-electronic-payment-services/|title=Electronic payment services: Council adopts updated rules|publisher=Council of the EU|date=2015-11-16|access-date=2015-11-16}}</ref> On 27 November 2017, Commission delegated Regulation (EU) 2018/389 supplemented PSD2 with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication.<ref>{{cite web |url=https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32018R0389&from=IT |title=COMMISSION DELEGATED REGULATION (EU) 2018/389| date=27 November 2017}}</ref>

The EU and many banks pushed this development with the new Payments Service Directive 2 (PSD2), which came into force on 13 January 2018. Banks then adapted to these changes which opened many technical challenges, but also many strategic opportunities, such as collaborating with fintech providers, for the future.<ref>{{Cite web| title = Capitalizing on the potential benefits of open banking |publisher=McKinsey | access-date = 2019-09-21| url = https://www.mckinsey.com/industries/financial-services/our-insights/data-sharing-and-open-banking}}</ref>

An important element of PSD2 is the requirement for [[Strong customer authentication|strong customer authentication]] on the majority of electronic payments.

Another important element of the directive is the demand for common and secure communication (CSC). eIDAS-defined qualified certificates for are demanded for website authentication and electronic seals used for communication between financial services players. The technical specification ETSI TS 119 495 defines a standard for implementing these requirements.

PSD2 went into full effect on 14 September 2019, but due to delays in the implementation, the European Banking Authority allowed for a time extension of the [[Strong customer authentication|strong customer authentication]] (SCA) until 31 December 2020.<ref>{{Cite web| title = strong customer authentication (SCA) Enforcement Date : Stripe: Help & Support| access-date = 2019-09-21| url = https://support.stripe.com/questions/strong-customer-authentication-sca-enforcement-date}}</ref><ref>{{Cite press release| title = EBA publishes an Opinion on the elements of strong customer authentication under PSD2 |agency= European Banking Authority| access-date = 2019-09-21| url = https://eba.europa.eu/-/eba-publishes-an-opinion-on-the-elements-of-strong-customer-authentication-under-psd2}}</ref>

==Key dates==
*March 2000: Lisbon Agenda to make Europe "the world's most competitive and dynamic knowledge-driven economy" by 2010
*December 2001: regulation EC 2560/2001 on cross-border payments in Euro
*2002: European Payments Council created by the banking industry, driving the [[Organization:Single Euro Payments Area|Single Euro Payments Area]] initiative to harmonize the main non-cash payment instruments across the Euro area (by end 2010)
*2001–2004: consultation period and preparation of PSD
*December 2005: proposal for PSD by DG Internal Market Commissioner McCreevy
*25 December 2007: PSD entered into force
*1 November 2009: deadline for transposition in national legislation
*2009 update: eliminated differences in charges for cross-border and national payments in euro (EC Regulation 924/2009)
*2012 update: Regulation on cross-border payments, "multilateral interchange fees" (EU Regulation 260/2012)
*July 2013: report on implementation of PSD and its two updates<ref name=EU2013>{{cite web|title=Report from the Commission to the European Parliament and the Council on the application of Directive 2007/64/EC on payment services in the internal market and on Regulation (EC) No 924/2009 on cross-border payments in the Community|url=http://eur-lex.europa.eu/legal-content/EN/ALL/;ELX_SESSIONID=vGvqTdYfSqymyHCpLh98J8rJKpx2DR1sy6tBTWhVRSGrhdCwwnRn!760646899?uri=CELEX:52013DC0549|publisher=Eur-lex.europa.eu|access-date=2015-02-27|date=2013-07-24}}</ref>
*16 November 2015: The Council of the European Union passes PSD2, giving member states two years to incorporate the directive into their national laws and regulations.<ref name="PSD2 passed" />
*13 January 2018: Directive 2007/64/EC is repealed and replaced by Directive (EU) 2015/2366
*14 March 2019: All Financial Institutions offering an API solution must have it available for external testing by PISPs and AISPs.<ref>{{cite web|url=https://www.finextra.com/blogposting/16183/the-implications-and-requirements-of-psd2-open-banking-for-programme-managers|title=The Implications and Requirements of PSD2 open banking for Programme Managers|date=23 October 2018|work=Finextra|first=Brendan|last=Jones}}</ref>
*14 September 2019: The final deadline for all companies within the EU to comply with PSD2's Regulatory Technical Standard (RTS) pertaining to directive (EU) 2015/2366 (PSD2)
*31 December 2020: Extended deadline for all companies within the EU to implement PSD2's Strong Customer Authentication (SCA)
*29 November 2021: FCA publishes changes to 90-day reauthentication rules in the UK<ref name="UK-RTS 90 Day" />

==Privacy concerns==
{{Importance section|date=May 2020}}
Privacy First, a privacy organization, criticized the [[Finance:Open banking|open banking]] elements of the new legislation, claiming it focuses too much on improving competition and innovation while the privacy interests of account holders are overlooked.<ref>{{Cite web |title=European PSD2 legislation puts privacy under pressure. Privacy First demands PSD2 opt-out register |url=https://www.privacyfirst.eu/focus-areas/financial-privacy/672-privacy-first-demands-psd2-opt-out-register.html |website=www.privacyfirst.eu |language=en-gb |access-date=2020-05-26}}</ref>

==See also==
* Late Payments Directive
* [[Finance:Open banking|Open banking]]

==References==
{{Reflist}}

==Further reading==
* Dimitrios Linardatos: "Das Haftungssystem im bargeldlosen Zahlungsverkehr nach Umsetzung der Zahlungsdiensterichtlinie", Nomos-Verlag, 2013, {{ISBN|978-3-8487-0709-6}}. (German)

==External links==
*[http://data.europa.eu/eli/dir/2015/2366/oj Text of the Payment Services Directive]
*[https://ec.europa.eu/info/business-economy-euro/banking-and-finance/consumer-finance-and-payments/payment-services_en European Union PSD official website]
*[http://www.europeanpaymentscouncil.eu/ European Payments Council]
*[https://ec.europa.eu/info/law/payment-services-psd-2-directive-eu-2015-2366_en/ Payment services (PSD 2) - Directive (EU) 2015/2366]
*[https://eba.europa.eu/-/eba-publishes-an-opinion-on-the-elements-of-strong-customer-authentication-under-psd2 Opinion on the elements of strong customer authentication under PSD2] European Banking Authority, June 2019


[[Category:Digital currencies]]
[[Category:Payment systems]]

{{Sourceattribution|Payment Services Directive}}