Tag: eu

European Union’s Payment Service Directive 2 (PSD2) has gone into full implementation in this year and European Banking Authority (EBA) has asked National Competent Authorities (NCAs) to take necessary steps for its compliance and implementation. PSD2 norms are aimed towards making Europe into a single payment market and from there on improve customer experience and protection, boost innovation and competition and development of new payment methods and e-commerce.

Further it will bring out new models of business across the financial ecosystem in the form of open banking and leveraging of Application Programming Interface (APIs).

Sam Theodore, Senior Consultant at Scope Group in the ‘The Wide Angle’ report says, “PSD2 is arguably Europe’s most important piece of non-prudential financial regulation for decades.”

These norms are directly challenging the traditional bank-customer value chain (which asymmetrically benefits the bank) as it allows the transfer of customer financial data ownership from banks to their businesses and individual clients through Open APIs. The report adds, “Customers can then freely choose between their existing bank or third-party providers (TPPs) – other banks or authorised non-banks – to carry out their payment instructions. TPPs’ access to accounts (XS2A) occurs solely with customers’ prior agreement, which in effect puts them, not their banks, in the driver’s seat.”

This essentially leads to the implementation of PSD2 norms in play with European Bank’s revenues related to payments and account services. The report cites a McKinsey report which estimates that these revenues are no less than 35% of total bank revenues as compared to 51% from lending and 14% from other products.

Sam says that market participants shall start looking at how European banks adjust to the post PSD2 environment. Further, not only awareness of the top management with respect to PSD2 but also how compliant the bank is with these norms and focus on specific strategy and planning to implement with cloud-based platforms, big data management, use of artificial intelligence and robotics.

Sam adds, “There is often a degree of inertia in how the market investigates new aspects of relevance, which is why those banks with a clear vision of where they want to position themselves in the open-finance world and how to get there should bring up the topic themselves on analyst calls and meetings to try to educate their analysts and investors. For everyone’s benefit.”

Clouds & Platforms

The EU has seen a 79% growth of third party service providers and players including big techs from 237 in 2019 and 410 licensed players in 2020. This growth is fueled by a desire to tap an open market enabled by PSD2 and the rush for digital services due to the Covid-19 pandemic disruptions.

European banks are exploring “build, buy or partner” avenues for the new world at a different pace but for the same goals. One common central element in all of these is migrating activities and operations to cloud native platforms. Top cloud providers have actively partnered with top names amongst European banks and fintechs partnering with incumbent banks to build open APIs.

There are also concerns around viability of smaller players. The report cites the example of the recently launched European Cloud User Coalition (ECUC) with the aim of broadening and facilitating cloud usage by a larger number of peers in various European countries.

The report cites it as a systemic weakness by saying, “the absence of viable European cloud providers to compete against the US and Chinese giants. Both EU governments and banks have all the interest in the world to address this weakness in the not-too-distant future.”

Implementation Challenges

PSD2 Implementation was scheduled back in September 2019 but concerns with data security led to EBA putting out a paper through Regulatory Technical Standards (RTS) on strong consumer authentication (SCA) protocols.

The SCA protocol mandates at least two of three categories from “What you know” (your password or PIN), “what you own” (your device like smartphone or tokens) and “what you are” (biometrics like face recognition or fingerprint).

The idea is now towards moving to biometrics over static passwords or SMSs which are more prone to cyberattacks. The report says, “Cyber-security firm Kaspersky recorded a tripling of distributed denial-of-service (DDoS) attacks over the 12-month period ending in mid-last year.”

As the ecosystem wasn’t prepared for the September 2019 deadline, the compliance was further pushed to January 2021 and a few supplementary months have been added till September 2021 to ease the SCA implementation pressure on pandemic affected smaller merchants.

The report said, “Another initial problem with implementation was the fact that PSD2 did not specify a specific standard format across the EU for setting up open APIs. There were several competing standards, although now those adopted by the so-called Berlin Group (a coalition of EU banks) seem to be prevailing, suggesting smoother sailing ahead.”

Banks have also planned for a review and focus on lessons learned in recent years around security enhancements and looking at better standardisation for APIs across EU.

The report said, “One inherent challenge for regulators involved in these areas is keeping up with the fast advances in technology and rapidly changing industry standards.”

Open Banking in the UK has advanced with more than 2.1 million active open banking users in the UK, as the API call volume increased to six billion in 2020 from only 67 million in 2018.

Citing this growth in the UK, the report states, “There is every reason to believe that open banking will end up being adopted by an increasingly large share of businesses and individuals. This clearly raises the stakes for financial institutions still on the sidelines.”