Does Online Customer Identity Verification Matter for PSD2 Compliance?
Under PSD2 “account servicing payment service providers” — primarily banks — are forced to open up three sets of APIs giving registered third parties access to customer accounts. The customer must give permission to the bank using two-factor authentication, a process PSD2 refers to as “Strong Customer Authentication” (SCA), before the third party is allowed access.
Most access to customer accounts, including card payments, is covered under this process — sometimes even when the customer is directly querying their own account details. PSD2 sets out very specific standards for secure electronic customer identity verification, in order to keep customers’ funds and personal identities safe and meet all SCA requirements.
The European Banking Federation encourages trust in digital identity verification tools that can guarantee “the person claiming a particular identity is in fact the person to whom the identity was assigned.”
Two-Factor Authentication
One of the key requirements of the revised Payment Services Directive (PSD2) is that banks must add two-factor Strong Customer Authentication (SCA) for all remote access to customer accounts and online payments. This means that when authentication is required, two of three factors will be applied: something the customer is, something the customer has and something the customer knows. Clearly, identity verification will be critical as part of this, and when customers forget or lose a key component, banks will need to ask them to re-identify themselves.
As many businesses are already seeing, customer account access dependent on two-factor authentication leads to an increase in customers losing their authentication credentials. What is often missed in the new regulation is that PSD2 requires this credential reset process to also use two-factor authentication, and needs the end customer to use two different authentication factors to those utilised in the account access process for the Open APIs. The credential reset process means the customer has to re-identify themselves to their bank using a Strong Customer Identity Verification (SCeID) process to verify or re-verify their identity.
Both SCA and SCeID are mandated by PSD2, although the latter is not well understood. Failure to implement these capabilities exposes banks to penalties under PSD2 as set by national regulators. However, a failure to implement these capabilities properly may also expose banks to potential loss of sensitive customer data and, under the General Data Protection Regulation (GDPR), this opens up the possibility of fines of up to 2% of global annual turnover.
4 Qualities to Look for in a Compliant Online Identity Verification Solution
Identity verification is at the heart of PSD2, and must be supported by a Strong Customer Identity Verification (SCeID) process using two-factor authentication. According to a report from Consult Hyperion and Jumio, a compliant PSD2 credential reset process should have the following characteristics:
Strong
Use two factors of identity document verification to demonstrate that the consumer is in possession of their ID and live facial biometric matching to establish the person behind the transaction matches the person holding the ID.
Fast
Online and near real-time process to get customers transacting quickly.
Accurate
Deliver a high level of accuracy using proven technologies and services.
Simple
Convenient for the customer, while limiting additional compliance costs for the business.
Back to Compliance & Regulations
