The Financial Conduct Authority have been in touch with AFEP regarding SCA.
In November 2021, the FCA published the Policy Statement (PS21/19) “Changes to the SCA-RTS and to the guidance in ‘Payment Services and Electronic Money – Our Approach”, where they introduced several changes to the Regulatory Technical Standards on Strong Customer Authentication and Secure Communication (SCA-RTS). This includes the creation of a new exemption to strong customer authentication (SCA) under Article 10A for when customers access account information through a third party provider (TPP).
Where an account services payment service provider (ASPSP) adopts the exemption, their customers will not need to reauthenticate when they access their account information through a TPP. Instead, TPPs will be required to obtain explicit consent from customers at least every 90 days. TPPs must not access information without the customer actively requesting it unless the customer has reconfirmed their consent within the previous 90 days.
The changes to the SCA-RTS come into effect on 26 March 2022.
As previously mentioned, the FCA strongly encourage ASPSPs to apply the new Article 10A exemption. Implementing this change will help remove the barriers identified to the continued growth of open banking and to support competition and innovation in the sector.
During their recent engagement with industry, some firms and associations have expressed concerns and sought clarity on the timeline for implementing the new SCA exemption that comes into force on 26 March 2022.
Following discussions with industry and other stakeholders and with a view to limit disruption for consumers and SMEs and ensure a degree of consistency, our expectations are as follows:
They strongly encourage ASPSPs to apply the exemption as soon as possible after the changes to the SCA-RTS has come into effect on 26 March 2022 with a view to the widespread adoption of the exemption by 30 September 2022.
They expect TPPs to be technically ready to reconfirm customer consent under Article 36(6) of the SCA-RTS as soon as possible after 26 March 2022. However, up to 30 September 2022 they will not object if TPPs do not reconfirm customer consent, provided that SCA is applied at least every 90 days during that period. This is to limit the risk of consumer disruption and to ensure that either SCA has been applied or re-consent obtained in any 90-day period.
They monitor use of the exemption, and if they find that ASPSPs’ application of SCA is unnecessarily hindering TPP services, they will consider taking further steps to encourage or require the adoption of the exemption.
They have updated our website to reflect the above. For questions related to the implementation of the SCA exemption, please contactpaymentservices@fca.org.uk.