Payment Services Directive 2

The Second Payment Services Directive (PSD2) requires strong customer authentication for electronic payments (SCA). Find the links to the EU Directive as well as the final report of the European Banking Supervision in the link section of this page.

What does the PSD2 require?

Payments a person initiates will require strong customer authentication. A process verifies whether the person using the payment method (e.g. credit card) is entitled to use the payment method. 3D Secure payments or Verified by Visa payments with a credit card are commonly known methods applying SCA. Electronic payments are, e.g. payments a customer triggers on a website. This also includes payments via an app or POS terminals. Excluded from the definition of electronic payment are (SEPA) direct debits, mail order bookings and telephone order bookings (MoTo payments). These regulations aim to reduce the risk of fraud in electronic payments.

What is strong customer authentication?

SCA identifies customers eligibility to use a payment instrument. Authentication is strong if personalised security features deliver proof. during payment. Currently applied features are:

• Ownership (e.g. the credit card and the printed CVC code itself, a mobile phone, a token (a physical device that generates one-time codes))
• Knowledge (e.g. PIN, password, card number)
• Personal characteristics of the user (e.g. fingerprint, iris (eye), speech/voice recognition)

As technical development progresses, this list of examples changes. The EU demands innovative technical solutions. Strong Customer Authentication must take place in digital payments whether you just process payment information or fulfil the payment itself.

If your contract is a so-called "eCom" (eCommerce) contract, you will have to apply the SCA (Strong Customer Authentication) in the future.

So-called "MoTo" (MailOrder-TelefonOrder) contracts are not seen as electronic payment transactions according to the current state of knowledge.

1. You work as a travel agent and operate a website through which you arrange travel for various tour operators or service providers and are responsible for payment collection (agency debt collection). The client provides consent to the payment on the website immediately after the booking or already with the booking.

The customer wants to pay by credit card.

At this point, secure/strong customer authentication must in place.

=> SCA applies

2. You work as a travel agent, operate a website through which you arrange travel for various tour operators or service providers collecting payment (agency debt collection). The customer provides consent to payment on the website directly after the booking or already with the booking.

The customer wishes to pay by direct debit or invoice.

These payment methods do not count as electronic payment methods and therefore nothing changes compared to today's process.

=> SCA does NOT apply

3. You operate a website through which you mediate travel products for various tour operators or service providers collecting payment (agency debt collection). The customer provides consent to the payment on the website immediately after the booking or already with the booking.

The customer would like to pay by Sofortüberweisung.

Although Sofortüberweisung falls under the regulations of the Payment Services Directive 2, you as the intermediary do not come into contact with the customer's payment details. The customer authenticates himself as soon as he logs on to his bank in online banking to trigger the payment. So nothing will change for you compared to the process that already exists today.

=> Payment provider is responsible for SCA

4. You operate a website through which you mediate travel products for various tour operators or service providers. The Tour Operator collects the payment (direct debt collection). As an intermediary, you do not come into contact with the customer's money at any point.

Regardless of the payment method, you collect and forward the customer's payment information to the tour operator.

According to the information available to us today, the person who acts as an intermediary in the following payment transaction should also ensure authentication.

=> SCA applies

1. A customer walks into your travel agency and books a trip.

The customer pays the travel booking at your travel agency directly with his credit card via the payment terminal (POS terminal), which allows online payments - i.e. is connected online with the payment service provider.

The same applies to the remaining payment via the POS terminal.

=> SCA applies

2. A customer books a trip Agency collection is used. You do not use a POS terminal for payment.

The customer decides to pay by credit card and provides card details to you. You identify the cardholder (for example, by comparing credit card details with the customer's ID ).

This is not an "electronic payment" because the customer did not trigger the payment online (via app or website).

=> SCA does NOT apply