PSD2
The facts about PSD2
The Payment Services Directive 2 (PSD2), is an EU Directive intended to bolster payment security and reduce the opportunity for fraud. The directive looks to regulate both payment processes and the payment service providers throughout the European Union.
Download our free PSD2 Guide (PDF)
Although administered by the EU and the European Banking Authority (EBA), its reach will be much wider. Regardless of where they are based, banks and other organisations seeking to trade within the EU region will need to implement payment and transaction systems that comply with the new regulations.
The Directive also looks to increase pan-European competition and participation in the payments industry, encouraging new entrants (such as non-banks) into the market and levelling-up the playing field on consumer protection with rights and obligations for both payment providers and users.
“European consumers want to know that their payments are safe when they shop or make a payment online. The new Payment Services Directive will ensure that electronic payments in Europe become more secure and more convenient for European shoppers. This legislation is a step towards a digital single market; it will benefit consumers and businesses and help the economy grow.”
PSD2 A Timeline
Oct 2015
In October 2015, the European Parliament adopted the European Commission proposal to create safer and more innovative payments in Europe. This became known as the Payment Service Directive or PSD2.
The new rules aim to better protect consumers when they pay online, promoting the development and use of innovative online and mobile payments through open banking, making cross-border European payment services safer.
Nov 2015
In November 2015, the Council of the European Union (EU) passed PSD2, giving member states two years to incorporate the directive into their national laws and regulations. This was supplemented with regulatory technical standards for Strong Customer Authentication (SCA) with common and secure open standards of communication.
An important element of PSD2 is the requirement for strong customer authentication on the majority of electronic payments.
Aug 2019
In August 2019, the FCA (UK) announced that they will not take action against firms if they do not meet the relevant requirements for SCA, where there is evidence that they have taken the necessary steps to comply with the plan.
Sept 2019
In September 2019, PSD2 went into full effect, but due to delays, the European Banking Authority (EBA) allowed for an extension for Strong Customer Authentication (SCA) to be implemented.
Mar 2021
By March 2021, after an 18-month period, the FCA expects all firms to have made the necessary changes and undertaken the required testing to apply SCA.
Onescan dynamically links a specific amount and a specific payee with seamless easy-to-use Strong Customer Authentication (SCA): no passwords, no SMS or one-time passcode (OTP), no download
Strong Customer Authentication (SCA)
One of the biggest changes under the terms of PSD2 is that it will require all online transactions over €30 to be authenticated using a Strong Customer Authentication (SCA) compliant process.
The SCA process requires transactions to be authorised using a combination of two of the three approved SCA elements. Those elements are defined as:
Knowledge – something the person knows, such as a PIN number
Possession – something the person owns, such as a mobile phone
Inherence – something the person is, such as a fingerprint scan
And in a landmark ruling earlier this year, the EBA ruled that sending a one-time passcode to a mobile phone could not be used to prove both knowledge (of the passcode) and possession (of the mobile phone). This is a ruling that has left many within the industry scrambling for a compliant solution.
Compliance doesn’t have to be a headache
Experience shows that although consumers welcome extra security, too many steps in the payment process also leads to abandoned baskets and a loss of sales – and PSD2 adds another layer to the process.
Our Onescan solution fully meets the requirements of PSD2 but at the same time simplifying the payment process. Onescan combines possession, the ownership of the mobile phone, with either knowledge or inherence. With Onescan the process of authorising the transaction from the mobile phone involves the use of a PIN, a fingerprint scan or even facial recognition. It fully meets the new regulations.
Your customers already have all they need
We have built Onescan so that anyone with a smartphone can use the service to make a payment straightaway. There’s no requirement to download an app or upload any information in advance.
Our App-free approach simply uses the existing camera on the consumer’s smartphone to trigger the authorisation process for a transaction. It doesn’t rely on SMS so there’s no need for the retailer to know the consumer’s phone number in advance; nor is there any need to download an app, or to set-up usernames and passwords to start the process.
Using the camera opens the Onescan web app, and all the information about the goods to be purchased will be pre-loaded from the retail site, together with any information already held by the retailer – name and delivery address for example. All the customer has to do is enter the payment info and then authorise the transaction using their PIN or a biometric.
It really is that simple. Onescan:
Friction-free authentication process
Any smartphone can initiate a secure transaction
Improves payment security
Fully meets the new EU regulations
Available Now
The facts about Onescan from Ensygnia
How we manage payment data
Firstly, Onescan doesn’t store or hold any payment data on the customer’s mobile phone and nor does it store or hold it within the Onescan web app.
Equally, our secure online platform processing the Onescan transactions, does not store any payment information or customer data. Instead it links to compliant, industry standard wallets, vaults or payment providers such as ApplePay and PayPal. We keep your data secure during transactions as the credentials can be tokenised or sent directly to or from your payment processor.
Security
Our platform performs to the highest industry security standards including P2PE (Point-to-Point Encryption), Public Key Infrastructure (PKI), key management, cryptography, incursion detection, tamper evidencing, audit and threat prevention safeguards.
We provide multi-factor authentication as standard. Beginning with simple phone and PIN, we also enable best-of-breed, industry-standard bio-metrics, geo-location and data validation services.
No central data store
Unlike other solutions on the market, we undergo independent testing for Financial Conduct Authority (FCA) regulated companies. This goes well beyond the requirements of Payment Card Industry (PCI) Level 1 and Payments Service Directive 2 (PSD2) compliance.
What’s more because we do not store data centrally, there are no usernames, passwords or payment details for hackers to target and steal.
Full industry and PSD2 Compliance
Onescan ticks all the EU and EBA compliance boxes and is ready for implementation now. Onescan is patented and has already achieved full certification for its transaction platform, its app or web-only equivalent, and for its Software Developer Kit (SDK).
Onescan is both PCI Level 1 compliant (certified) and PSD2 ready.
Latest Blog Posts on PSD2
