PSD2 is the second iteration of the Payment Services Directive (PSD) implemented by the European Union and it affects both individual consumers and businesses. PSD2 enables bank customers to use third-party providers to manage their finances. The regulation went live in January 2018 and has implications for all companies in Europe that deal with payments, ranging from how to regulate the emergence of Third Party Providers (TPPs) to the need for strong customer authentication (SCA).
Under PSD2 “account servicing payment service providers” — primarily banks — are forced to open up three sets of APIs giving registered third parties access to customer accounts. The customer must give permission to the bank using two-factor authentication, a process PSD2 refers to as “Strong Customer Authentication” (SCA), before the third party is allowed access.
Most access to customer accounts, including card payments, is covered under this process — sometimes even when the customer is directly querying their own account details. PSD2 sets out very specific standards for secure electronic customer identity verification, in order to keep customers’ funds and personal identities safe and meet all SCA requirements.
The European Banking Federation encourages trust in digital identity verification tools that can guarantee “the person claiming a particular identity is in fact the person to whom the identity was assigned.”
One of the key requirements of the revised Payment Services Directive (PSD2) is that banks must add two-factor Strong Customer Authentication (SCA) for all remote access to customer accounts and online payments. This means that when authentication is required, two of three factors will be applied: something the customer is, something the customer has and something the customer knows. Clearly, identity verification will be critical as part of this, and when customers forget or lose a key component, banks will need to ask them to re-identify themselves.
As many businesses are already seeing, customer account access dependent on two-factor authentication leads to an increase in customers losing their authentication credentials. What is often missed in the new regulation is that PSD2 requires this credential reset process to also use two-factor authentication, and needs the end customer to use two different authentication factors to those utilised in the account access process for the Open APIs. The credential reset process means the customer has to re-identify themselves to their bank using a Strong Customer Identity Verification (SCeID) process to verify or re-verify their identity.
Both SCA and SCeID are mandated by PSD2, although the latter is not well understood. Failure to implement these capabilities exposes banks to penalties under PSD2 as set by national regulators. However, a failure to implement these capabilities properly may also expose banks to potential loss of sensitive customer data and, under the General Data Protection Regulation (GDPR), this opens up the possibility of fines of up to 2% of global annual turnover.
Identity verification is at the heart of PSD2, and must be supported by a Strong Customer Identity Verification (SCeID) process using two-factor authentication. According to a report from Consult Hyperion and Jumio, a compliant PSD2 credential reset process should have the following characteristics:
Use two factors of identity document verification to demonstrate that the consumer is in possession of their ID and live facial biometric matching to establish the person behind the transaction matches the person holding the ID.
Online and near real-time process to get customers transacting quickly.
Deliver a high level of accuracy using proven technologies and services.
Convenient for the customer, while limiting additional compliance costs for the business.
Jumio’s online identification solutions enable EU banks to incorporate the necessary PSD2 safeguards to ensure that each customer’s identity is verified before each interaction with a third-party service provider.
PSD2 requires that EU banks have a process of establishing the identity of the customer including determining to an appropriate level of assurance certain information (attributes) such as name, address and date of birth. Jumio helps these banks establish authentication credentials that allow their customers to assert their identity in the future without needing to redo the relatively expensive identification process each time.