PSD2: ‘strong customer authentication’ – what, when & how?

The challenges of secure electronic payment services are exacerbated by the circular and often ambiguous language that’s been used in the second European Union directive on the subject, as well as the draft Regulatory Technical Standards, comments Chris Finney.

Chris Finney (cfinney@cooley.com) is a partner in Cooley’s London office, where he leads the law firm’s London financial services and financial technology regulatory practices.

From 13 January 2018, banks, electronic money issuers and other payment service providers (together,PSPs) will be required to “ appl[y]strong customer authentication”. Now that we have both the second Payment Services Directive (PSD2)andthe European Banking Authority’s draft Regulatory TechnicalStandards (RTS), we can begin to see what this might mean, and what it might involve.