Understanding the EU’s Revised Payment Services Directive and what it means for your business.
PSD2, or the Revised Payment Services Directive, is a key piece of European Union legislation that went into effect in 2018. Its primary goal is to make online payments safer, encourage innovation in the financial sector, and give consumers greater control over their financial data. More than just a regulation, PSD2 has fundamentally reshaped the financial landscape, opening up the space to new fintech players through a mandate known as Open Banking.
PSD1 vs. PSD2: Key Differences
PSD2 is an evolution of the original Payment Services Directive (PSD1). The key updates introduced by PSD2 include:
- Stronger Security: It introduced a stricter authentication standard called Strong Customer Authentication (SCA).
- Wider Scope: PSD2 covers “one-leg-out” payments, meaning transactions where one of the payment providers is located outside the EU.
- Increased Consumer Rights: The directive provides more rights for consumers, including a greater degree of control over their financial data.
Who Needs to Comply?
A wide range of entities must comply with PSD2. If your business handles payments or financial data in the EU, you are likely affected. This includes:
- Banks and Credit Institutions
- Payment Initiation Service Providers (PISPs)
- Account Information Service Providers (AISPs)
- E-money Institutions
- Fintech Startups
- Merchants and E-commerce Platforms
Main Components of PSD2 Compliance
Achieving compliance requires addressing several core components of the directive:
- Strong Customer Authentication (SCA): This is a key pillar of PSD2. It requires multi-factor authentication for most online transactions. SCA requires at least two of the following three elements to verify a user’s identity: something they know (like a password), something they have (like a phone), or something they are (like a fingerprint).
- Open Banking APIs: Banks are now mandated to provide secure APIs that allow licensed third-party providers (TPPs) to access customer account information and initiate payments, but only with explicit customer consent. This has fueled the growth of fintech services.
- Explicit Customer Consent: Businesses must obtain clear and explicit consent from customers before accessing or sharing their data.
- Transparency in Fees: The directive requires greater transparency regarding transaction fees, preventing hidden charges.
- Incident Reporting: Organizations must have a robust process for reporting payment-related security incidents to relevant authorities.
Penalties for Non-Compliance
The risks of non-compliance are severe and can result in significant consequences, including:
- Hefty fines and legal action from regulatory bodies.
- Suspension of a company’s license to operate.
- Severe reputational damage and a loss of customer trust.
How to Begin Your PSD2 Compliance Journey
The first step toward compliance is establishing a strong security posture. Given that modern financial services are often accessed from a variety of endpoints—laptops, smartphones, and tablets—focusing on endpoint security is a critical starting point. Key measures include:
- Implementing secure access controls for all devices.
- Ensuring all devices accessing financial data are encrypted.
- Deploying malware protection and other security tools.
- Establishing clear app and user-level boundaries to prevent unauthorized data access.
About Scalefusion
Scalefusion’s company DNA is built on the foundation of providing world-class customer service and making endpoint management simple and effortless for businesses globally. We prioritize the needs and feedback of our customers, making sure that they are at the forefront of all decision-making processes. We are dedicated to providing comprehensive customer support services, and place emphasis on customer-centric thinking throughout the organization.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.