Why the incoming PSD3 / PSR and SEPA Instant legislation levels the playing field for Irish and European Payments and improves Open Banking and Consumer Protection

Executive Summary

The European payments landscape has changed considerably since the introduction of Payment Services Directive 2 (PSD2) in 2015. Demand for cashless payments has increased greatly over the past number of years, further accelerated by the Covid 19 pandemic, while the launch of new payments rails such as SEPA Instant Payments in 2017 have shifted the European payments landscape considerably.

In parallel, there has been significant technological advancements with institutions delivering more sophisticated customer journeys and full-featured digital wallets, while providing customers with more choice around payments to reflect the ubiquity and popularity of contactless payments.

The growth has created lots of opportunities for new players but obstacles still remain for Payment Service Providers (PSPs). For example, the introduction of Open Banking has allowed consumers to access financial data efficiently and securely, but Account Information Service Providers (AISPs) and Payment Initiation Service Providers (PISPS) still have trouble accessing data.

To address some of the challenges in the payments market and to keep pace with consumer and business requirements a new legislative framework has been proposed by the European Commission; Payment Services Directive 3 (PSD3) and the Payment Services Regulation (PSR).¹The proposals will be reviewed by the European Parliament and Council. The exact timelines for entry into force are not yet known. Based on the usual legislative process, the final versions may become available by the end of 2024. Since Member States are usually granted an 18-month transition period, the Directive and Regulation will likely start to apply somewhere in 2026. The proposed requirements aim to strengthen customer protection and define parameters within which Open Banking should operate, enhancing opportunities in this space. They will also help level the playing field for all participants across the payments industry by allowing, for the first time, non-banks to participate directly in the SEPA payment schemes.

In addition to PSD3 / PSR, new SEPA Instant Payments legislation has been provisionally agreed and is expected to enter into force in Q1 2024. This will most notably make participation in the instant payment scheme mandatory for all PSPs who currently offer SEPA Credit Transfer to their customers. This is a welcome move which reflects the relative lack of uptake for this scheme thus far and supports the vision that instant payments in euro will be affordable, secure, readily available and processed without hindrance across the EU.

In Ireland, we have seen the Central Bank of Ireland’s (CBI’s) supervisory approach to payments and e-money institutions intensify over the past 24 months with the publication of two industry Dear CEO letters and the focus will continue to grow through the shift to instant payments, growth in open banking and broader regulatory landscape.

In this article, we provide an overview of some of the key regulatory changes including the impacts of PSD3/PSR and the evolution of instant payments. The pace of change is challenging leaders like never before and Fintechs should not only be aware of these upcoming changes but should be preparing for them in the short, medium and long term.

PSD3 / PSR

Macro drivers of change since PSD2

The highly anticipated proposals for the PSD3 and PSR were published by the European Commission on 28 June 2023. To understand the impact PSD3/PSR will have on European Payments and Open Banking, it is perhaps useful to reflect on what has brought us to this point.

During a European Commission evaluation²The proposals will be reviewed by the European Parliament, Council and Commission. The exact timelines for entry into force are not yet known. Based on the usual legislative process, the final versions may become available by the end of 2024. Since Member States are usually granted an 18-month transition period, the Directive and Regulation will likely start to apply somewhere in 2026. of the PSD2 implementation, the European Commission found that while PSD2 positively impacted fraud prevention through SCA (70-80% lower for remote card payments) and brought increased efficiency, transparency and choice of payment instruments, some improvements were still required. They found that AISPs and PISPs experienced issues accessing data as the APIs varied in quality and performance. In some member states, including Ireland, there is no publicly available data showing API volumes, efficiency, uptime etc, as distinct from other jurisdictions which do publish regularly.³E.g. UK, API performance stats – Open Banking

An evolution, not a revolution

The findings from the European research formed the basis of the EU proposals for PSD3/PSR. The proposals aim to achieve four key objectives and introduce a number of revisions and improvements to PSD2:⁴KPMG Netherlands, PSD3 & PSR: New EU proposals game-changing for payments?, https://kpmg.com/nl/en/home/insights/2023/06/psd3—psr-.html

1. Strengthening user protection and confidence in payments

Proposed fraud and liability improvements:

• Extended IBAN/name matching verification to all credit transfers
• Strengthening of transaction monitoring, most notably the introduction of a legal basis for sharing fraud-related information between PSPs.
• Obligation to provide education to increase awareness of payments fraud among customers and staff
• Extension of refund rights: in case of failure of IBAN/name verification or for victims of ‘spoofing’ fraud, victims can be entitled to claim damages from their PSP.
• Improvements to strong customer authentication. For example, requiring PSPs to ensure that SCA methods do not depend on one single technology, device or mechanism, such as the possession of a smartphone.

Proposed consumer rights and information improvements:

• Obligation to inform payment service users on estimated charges for currency conversion for credit transfers and money remittances from the EU to third countries.
• PSPs must provide information on payment account statements to unambiguously identify the payee.

2. Improving the competitiveness of open banking services

• New requirements for dedicated data access interfaces with prohibited obstacles. For example, requiring additional checks of the permission given by the payment service users to a PISP or AISP or restricting payments initiation via a PISP only to those payees that are on the payer’s beneficiaries list.
• No permanent “fall-back” interface for banks required anymore.
• Banks and PSPs are required to set up a dashboard for consumers of open banking to provide insight in data access rights they have granted and to whom, with a withdrawal functionality.
• To ensure the continuity of open banking, PSPs can request the national authority to be allowed to use an effective alternative interface, such as using the interface banks use for their customers, if the dedicated interface is down and the bank cannot rapidly offer effective alternative solutions.

3. Improving the enforcement and implementation in Member States

• Shifting elements from PSD2 into the new PSR, which applies directly and consistently across the EU.
• Integration of the Electronic Money Directive (EMD) with PSD3 and PSR. The EMD will cease to exist. E-money institutions will disappear. Payment Institutions can be authorised to offer e-money services.
• Enhancing enforcement of the rules, including a list of breaches (infringements) and administrative sanctions and measures. For these breaches, such as on the rules on access to accounts maintained by banks, secure data rules by ASPSPs, AISPs, PISPs and fraud prevention mechanisms, the nature of sanctions and measures will therefore be known upfront.

4. Improving (direct or indirect) access to payment systems and bank accounts for non-bank PSPs

• Toughened requirements for banks to provide bank account services to non-bank PSPs. For example, banks need to explain and justify access refusal based on the specific situation including serious grounds to suspect illegal activities by or via the PSP.
• PSPs may be offered an additional possibility to safeguard users’ funds, namely to hold those funds at a central bank.
• Possibility of direct participation to payment systems for non-bank PSPs.

While these proposals have been put forward as evolutionary rather than revolutionary, they do represent a welcome move to strengthen Open Banking and level the playing field for participating Fintechs across the European payments landscape.

The proposals for PSD3 / PSR will undoubtedly evolve but firms should not delay in considering the likely impacts the regulatory requirements will have on their business models. Firms will need to prepare by undertaking a gap analysis against the PSD3/PSR requirements to identify a remediation plan. Firms should identify the impacts of regulatory change on their business and strategy to determine the necessary changes in process, capability, technology etc. and undertake implementation of the necessary requirements to meet the enhanced regulatory regime.

Re-Authorisation under PSD3 / PSR

Merging the E-money and Payment firm regimes

A key proposed change in PSD3 is the merger of the licencing and authorisation frameworks applicable to Payment and E-money Institutions to increase harmonisation of the regulation and supervision process across Europe with the removal of the Electronic Money Directive. With the consolidation of their legislative basis, E-money firms will become a subset of Payment Institutions and all existing PSPs will have to reapply for authorisation under PSD3.

What that re-authorisation will look like for firms, depends on a number of factors, including:

• Where competent authorities have evidence that a currently authorised Firm meets the requirements of PSD3 they can automatically authorise these firms as PSPs.
• Firms will need to seek re-authorisation from national authorities within 24 months of the new rules coming into force, with existing licences grandfathered for 30 months after PSD3 enters into force.
• Where a Firm does not meet the authorisation requirements of PSD3, the competent authorities will decide what measures are necessary to ensure such compliance.
• If a Firm ultimately does not meet the requirements of PSD3 it will no longer be authorised as an E-money firm or Payment Institution once the grandfathering period ends.

The authorisation requirements should not change significantly from previous requirements, however some of the key changes are outlined below:

• Winding-up plan: A “winding-up” plan will be required for all firms under PSD3.
• Notification procedures for limited network activities or exclusion based on payment volumes: Self-assessments will no longer be effective and firms will be obliged to notify their competent authority when seeking to benefit from the limited network or exclusion based on payment volume thresholds. This notification process will allow authorities to assess whether the relevant requirements are fulfilled.
• Professional indemnity insurance: PISPs and AISPs will be able to hold initial capital of €50,000 instead of obtaining professional indemnity insurance. This will apply at the licensing or registration stage only.
• Initial capital requirements adjusted for inflation: Initial capital requirements have been increased to reflect the impact of inflation since the adoption of PSD2, with the exception of PISPs.

Payment and E-money Institutions will need to prepare for re-application for authorisation. This may include preparation of re-authorisation material, discussion with the CBI and remediation of any areas of deficiency identified as part of the re-authorisation process or the regulatory regime more broadly.

SEPA Instant

Instant payments; the new normal?

In parallel to the PSD3/PSR draft legislation, work to finalise the SEPA Instant Payments legislation has been provisionally agreed on 7 November 2023 by European Parliament and Council allowing up to €100k to be transferred within 10 seconds, anywhere in the SEPA zone 24 hours a day, 7 days a week and every calendar day of the year.

The legislative intervention was brought about as the current non-mandatory SEPA instant payments scheme, which was launched in 2017, has not seen the impacts and uptake initially envisaged. Today 61% of PSPs operating in the SEPA Credit Transfer scheme (SCT) in Europe also operate in Instant.⁵As at 15 October 2023 That number is significantly less in Ireland, with only 11 of 195 SCT participants operating in the SEPA Instant scheme.⁶Registers of Participants in SEPA payment and payment related schemes | European Payments Council

Research conducted by the European Commission indicates lack of uptake was largely down to four reasons:

1. Reluctance to Invest: As the PSP of both the sender and receiver must use instant payments technology for the instant transaction to be successful, many PSPs are reluctant to invest without having the guarantee that other providers will be able to support these transactions.
2. High cost to the consumer: Consumers and businesses are put off by the high price of instant payments.
3. Perceived Concerns about the risk of Fraud and Errors: Consumers and businesses do not have sufficient assurances to address concerns with instant payments.
4. High failure rates: A high number (9.4%) of cross border instant payments fail due to slow, inefficient sanctions screening methods used by the industry which are not fit for fast payments.⁷https://ec.europa.eu/commission/presscorner/api/files/attachment/873809/2022-10-instant-payments_en-.pdf.pdf

As such, the new SEPA Instant Payments mandate, which is intended to co-exist alongside the mandatory SEPA Credit Transfer scheme, needs to be seen as affordable, secure and the ‘new normal’.

The incoming legislation is expected to enter force in Q1 2024 and sets out:

1. Mandatory participation: All PSPs currently offering SEPA credit transfers must offer instant payments to all customers
2. Restrictions on cost to the consumer: Charges for instant payments must be equal to or lower than charges for non-instant euro credit transfers
3. Verification Process: All providers must offer a service to check the match between IBAN and beneficiary name, warning about any detected discrepancy as it could suggest fraud
4. Harmonisation of sanctions screening processes: All PSPs must follow a harmonised procedure for sanctions screening based on daily checks of their own clients against EU sanctions lists.

The legislation’s final implementation timeline for the receiving and sending of SEPA Instant Payments is nine and 18 months, respectively. Separately, the name and IBAN matching requirement will be applicable at 18 months, while the new sanctions screening requirements will be applicable at nine months.

The real value of Instant Payments

For consumers, online and mobile banking payments have jumped 60% in Ireland in the last 5 years.⁸BPFI Payments Monitor – Q2 – Banking & Payments Federation Ireland Consumers are tapping for 85% of their in-store transactions, showing the customer preference for digital and quick, frictionless payments – which Instant Payments will support. Migrating payment flows from same day to instant will allow the releasing of funds that are locked in the financial system (currently €200bn in Europe at any given time)⁹https://ec.europa.eu/commission/presscorner/api/files/attachment/873809/2022-10-instant-payments_en-.pdf.pdf, making them immediately available to end users for consumption and investment.

For businesses, instant payments mean better real-time visibility of cash and an improved cash flow. For e-commerce retailers particularly, it means less risk, since they can fulfil orders immediately (for comparison, online card payments take up to three days to settle).

In order to be ready for ready for SEPA Instant Payments, Firms should prioritise the performance of a gap analysis to understand the areas of work that must be completed to bring your current environment to the desired end state.

This should include, for example,:

• Current state diagnostics and development of overall Payments and Product Strategies, Revenue, cost and competition analysis;
• Alignment and implementation of ISO strategy;
• Design of programme and governance structures;
• Implementation and migration plans based on use cases;
• Design of the payments system architecture;
• Platform build, development and testing;
• Business and change readiness; and,
• Review of existing sanction screening approach, systems and methodologies, including establishing an appropriate and robust risk-based approach.

The movement from a bulk processing environment Mon – Fri (as is the case with SCT), to having all channels, across all accounts, operating in real time (less than 10 seconds) 24 x 7 x 365 means significant change. Firms that embrace these opportunities with their customers will be the long-term winners.