The Second Payment Services Directive

Background

The first Payment Services Directive (PSD1) was proposed by the European Commission in 2005, and adopted by the European Parliament and Council in 2007.

Since then, the retail payments market has grown significantly, and new payment services have been developed. However, the payments market is still fragmented along national borders; some payment products and services are out of scope, and some of PSD1 is "too ambiguous, too general or simply outdated". This has resulted in "legal uncertainty, potential security risks in the payment chain and a lack of consumer protection in certain areas". It has also made it difficult for innovative and easy to use digital payment services to "take off".

The European Commission therefore proposed "new rules … to close the regulatory gaps[; provide] more legal clarity[; ensure] a consistent application of the legislative framework across the Union[; facilitate] new means of payment …and [ensure] a high level of consumer protection … across … the Union".¹

For the purposes of this client alert we have assumed that, if these new rules are made, they will be in materially the same form as the final compromise text of the proposed Second Payment Services Directive (PSD 2), published by the European Council on 2 June 2015. If the new rules are made, PSD2 will repeal and replace PSD1. Many of the provisions in PSD2 will be materially the same as those in PSD1, but some will require more than they require today, and others will be entirely new. For brevity and simplicity, this client alert is concerned only with the most significant differences between PSD1 and PSD2. We have not used it to summarise the existing regime.

Scope

PSD1 applies to "payment services provided within the Community". However, PSD1 Title III (Transparency of conditions and information requirements for payment services),² and PSD1 Title IV (Rights and obligations in relation to the provision and use of payment services),³ only apply:⁴

• Where both the payer's payment services provider (PSP) and the payee's PSP are, or the sole PSP is, in the EU; and
• To payment services that use the Euro or the currency of an EU Member State outside the Eurozone.

PSD2 will apply more widely because (for example):

• It will also apply to:
  • The carrying out of two new payment services (payment initiation services, and account information services, as to which, see below);⁵ and
  • Payment transactions initiated by the payee, the payer and those initiated on the payer's behalf;⁶ and
• Most of PSD2 Title III⁷ and PSD2 Title IV⁸ will also apply⁹ to:
  • Transactions in any currency, if both the payer's PSP and the payee's PSP, or the sole PSP, are located in the Union; and
  • Payment transactions where only one of the PSPs is in the EU, in respect of those parts of the payments transaction which are carried out in the EU (these arrangements are sometimes referred to as "one leg out" transactions).

Payment initiation services

Article 58 of PSD2 will require the EU Member States to:

• Ensure that payers have the right to use a payment initiation service provider (PISP) to obtain payment initiation services;

• Require the account servicing PSPs domiciled in their jurisdiction to:
  
  "(a) provide facilities to securely communicate with [PISPs]in accordance with article 87a, paragraph 1(d);
  
   (b) immediately after the receipt of the payment order from a [PISP,] provide or make available all information on the initiation of the payment transaction... to the [PISP]; and
  
   (c) treat payment orders transmitted through the services of a [PISP] without any discrimination for other than objective reasons, in particular in terms of timing, priority or charges vis-à-vis payment orders transmitted directly by the payer himself and

• (When the payer gives its explicit consent for a payment to be executed in accordance with article 57), require their account servicing PSPs:
  
  "(-a) not to hold … the payer's funds in connection with the provision of the payment initiation service;
  
  (a) to ensure that the personalised security credentials of the payment service user, are not, with the exception of the user and the issuer of the personalised credentials, accessible to other parties and that they are transmitted by the payment initiation service provider through safe and efficient channels;
  
  (aa) to ensure that any other information about the payment service user, obtained when providing payment initiation services, is only provided to the payee and only with the payment service user's explicit consent;
  
  (b) every time a payment is initiated, to identify itself towards the account servicing [PSP] of the account owner and communicate with the account servicing [PSP], the payer and the payee in a secure way, in accordance with article 87a, paragraph 1(d)
  
  (d) not to store sensitive payment data of the payment service user ; 
  
  (da) not to request from the payment service user any data other than those necessary to provide the payment initiation service;
  
  (e) not to use, access and store any data for purposes other than for the provision of the payment initiation services; 
  
  (f) not to modify the amount, the recipient or any other feature of the transaction".

For these purposes:

However, PSD2 does not define or explain the terms:

Account information services

Article 59 of PSD2 will also require the EU Member States to make sure that payment service users have the right to use payment account information services. To facilitate this, articles 59(2) and (3) of PSD2 will require:

• The account information service provider (AISP):
  
  "(a) to provide services only based on the payment service user's explicit consent[as to which, see above];
  
  (aa) to ensure that the personalised security credentials of the payment service user, are not, with the exception of the user and the issuer of the personalised credentials, accessible to other parties and that when they are transmitted by the account information service provider, this is done through safe and efficient channels;
  
  (b) for each communication session, identify itself towards the account servicing [PSP] of the payment service user and securely communicate with the account servicing [PSP] and the payment service user, in accordance with Article 87a, paragraph 1,(d)[as to which, see above];
  
  ([c]) to access only the information from designated payment accounts and associated payment transactions;
  
  ([d]) not to request sensitive payment data linked to the payment accounts;
  
  ([e]) not to use, access and store any data for purposes other than for performing the account information service explicitly requested by the payment service user, in accordance with data protection rules"; and

• The account servicing PSP to:
  
  "(a) to securely communicate with the [AISP], in accordance with article 87a, paragraph 1,(d)[as to which, see above]; and
  
  (b) treat data requests transmitted through the services of an [AISP] without any discrimination for other than objective reasons [as to which, see above]".

However, "An account servicing [PSP] may deny access to the payment account for an [AISP] or a [PISP] for objectively justified and duly evidenced reasons related to unauthorised or fraudulent access to the payment account…" In such cases, the account servicing [PSP] shall inform the payer of the denying access to the payment account and the reasons for it …, where possible, before the access is denied and at the latest immediately thereafter, unless giving such information would compromise objectively justified security reasons or is prohibited by [law]. The account servicing [PSP] shall allow access to the payment account once the reasons for denying access no longer exist"¹⁰.

For these purposes:

Strong customer authentication

Under article 87 of PSD2, the EU Member States will be obliged to ensure that PSPs apply "strong customer authentication when the payer:(a) accesses his payment account on-line; (b) initiates an electronic remote payment transaction; [or] (c) carries out any action, through a remote channel, which may imply a risk of payment fraud or other abuses".

Member States must also ensure that PSPs:

• Meet specific security requirements to "protect the confidentiality and integrity of payment service users' personalised security credentials"; and
• (Where a payer initiates an electronic remote payment transaction) adopt "strong customer authentication that shall include elements dynamically linking the transaction to a specific amount and a specific payee".

Draft regulatory technical standards will be developed by the European Banking Authority and submitted to the Commission within 12 months of PSD2 entering into force that will specify:

"(a) the requirements of the strong customer authentication procedure;

(b) the exemptions to the application of [strong customer authentication];

(c) the requirements that technical security measures have to comply with … to protect the confidentiality and the integrity of the payment service users' personalised security credentials; and

(d) common and secure requirements for communication for the purpose of authentication, notification and information, as well as for implementation of security measures between account servicing [PSPs], [PISPs], [AISPs], payers and payees".

For these purposes:

Lost or stolen payment instruments and unauthorised payment transactions

Articles 61 to 66 of PSD2 set down the respective obligations of payment services users and PSPs in relation to payment instruments. A payment service user entitled to use a payment instrument will be obliged to "use the payment instrument in accordance with [its] terms … [which] must be objective, non-discriminatory and proportionate [and] notify the [PSP]… on becoming aware of loss, theft or misappropriation of the payment instrument or of its unauthorised use".

A PSP issuing a payment instrument will be obliged to "ensure that appropriate means are available at all times to enable the payment service user to make a notification [as described above, and]… provide the payer with an option to make a notification … free of charge and to charge, if at all, only replacement costs directly attributed to the payment instrument".

PSD2 will continue to require the PSP to provide rectification to the payment service user if the payment service user "notifies the [PSP] without undue delay on becoming aware of any unauthorised or incorrectly executed payment transactions giving rise to a claim". However, it will also require that "the credit value date for the payer's payment account … be no later than the [debit] date" and that where a transaction is initiated through a PISP, "the account servicing [PSP must] refund immediately... the amount of the unauthorised payment transaction" before seeking compensation from the PISP if appropriate.

The payer may be obliged to pay up to a maximum of €50 (the equivalent amount under PSD1 is €150) for "losses relating to any unauthorised payment transactions … resulting from the use of a lost or stolen payment instrument or from the misappropriation of a payment instrument".

Internal dispute resolution

PSD2 will require PSPs to maintain more robust and complete internal dispute resolution systems than PSD1 requires today. In particular, PSPs will be required to:

"(1) … put in place and apply adequate and effective complaint resolution procedures for the settlement of complaints of payment service users [which shall be] applied in every Member State where the [PSP] offers the payment services … and … available in the official language or one of the official languages of the relevant Member State or in another language if agreed between the [PSP] and the payment service user.

(2)… make every possible effort to reply … to the payment service users' complaints [addressing] all points raised … at the latest within 15 business days of receipt of the complaint. In exceptional situations, if the answer cannot be given within 15 business days for reasons beyond the control of the [PSP], it shall...send a holding reply clearly indicating the reasons for delay … and specifying the deadline by which the payment service user will receive the final reply. That deadline may not, in any case, exceed another 35 business days" (see article 90 of PSD2).

A maximum harmonising directive

PSD2 will be a maximum harmonising directive. The European Member States will not therefore be able to require any more or any less of the firms established in their jurisdictions than PSD2 itself will require. Article 95 of PSD2 lists a small number of exemptions to this rule.

Implementation and next steps

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may be considered Attorney Advertising and is subject to our legal notices.