PSD2 Country specific information

 

On this page you will find:

  • The 'Latest PSD2 migrations': where you can see the most up to date breakdown of the countries that have started to enforce PSD2 
  • A country-by-country list of migration plans and implementation dates for PSD2, as presented by the country's National Competent Authority (NCA).

Given that individual issuers might deviate from their NCA's advice, we strongly recommend to process SCA-compliant transactions from 1 January 2021, irrespective of national ramp-up plans. 

 

Latest PSD2 migrations

Austria

Since 14 January we are seeing Soft Declines on a very small percentage of transactions returned for non-authenticated transactions above 250 EUR.

Bulgaria

Several issuers in Bulgaria started using soft declines already in the last several weeks of 2020. 

Denmark

As of Monday 11th January, we are seeing PSD2 widespread enforcement from multiple Issuing Banks  in Denmark. 

On Friday 15 January one issuer that reverted soft declines earlier in the week, started enforcing PSD2 compliance again.

Finland 

As of January 12th we are seeing PSD2 enforcement in Finland primarily from one Issuing Bank. 

Germany

Since 14 January we are seeing Soft Declines on a very small percentage (<1%) of transactions returned for non-authenticated transactions above 250 EUR.

Hungary

Although expected to migrate on the 30th of December, the first increase in declines was visible just after midnight on the 31st of December. This happens for one issuer only, who is not using the the soft decline codes. Per the morning of 5 January they started using the soft decline codes.

Latvia

As of January 18th, we are seeing we are seeing PSD2 enforcement in Latvia, largely from one Issuing Bank. 

Netherlands

Some issuers in the Netherlands have started applying soft declines on non-authenticated transactions above 250 EUR per 5 January and subscription 0 EUR sign ups as of January 6th.   

Norway

In Norway all issuers migrated to PSD2 logic on December 28th, but they reverted after a couple of hours. Since then, we are seeing Soft Declines on a small percentage of transactions returned for non-authenticated transactions.

Poland

We are seeing Soft Declines on a small percentage of transactions returned for non-authenticated transactions.

Sweden

We are seeing Soft Declines on a small percentage of transactions returned for non-authenticated transactions, largely from one Issuing bank. 

 

Countries with confirmed delay in enforcement

Austria
The FMA (Finance Market regulator) has announced an extension for all payment methods. The FMA extended the deadline for implementation of SCA until 31 December 2020.

In the third week of December FMA presented a migration plan to their issuers which is as follows:

  • Starting 15 January: SCA enforcement on transactions above 250 EUR
  • Starting 15 February: SCA enforcement on transactions above 150 EUR
  • Starting 15 March: SCA enforcement on all transactions

Not all issuers have confirmed they will follow this plan.

Belgium
The NBB (National Bank of Belgium) previously announced that while the deadline of 14 September is still valid, enforcement will be delayed until a sensible migration plan is finalized and agreed upon. They agreed on a new migration plan on 7 October 2020: they agreed to review the > EUR 1,500 soft-decline testing on 15 November 2020 and have planned further decreasing this threshold to EUR 500 on 18 January, 100 EUR on 23 February and EUR 0 on 23 March 2021.

  • Starting 19 January: SCA enforcement on transactions above 1500 EUR
  • Starting 23 February: SCA enforcement on transactions above 500 EUR
  • Starting 23 March: SCA enforcement on transactions above 250 EUR
  • Starting 19 April: SCA enforcement on transactions above 100 EUR
  • Starting 18 May: SCA enforcement on all transactions

We are currently (half October) seeing soft declines being applied above EUR 1,500.

Cyprus
The CBC (Central Bank of Cyprus) announced that they do not intend to take supervisory enforcement action against licensed institutions which have not implemented SCA in remote electronic card transactions by 31 December 2020, provided that these institutions have submitted a migration plan to the Central Bank of Cyprus.

This announced follows a previous announcement that regulated entities which currently support a non-reusable and non-replicable element for online card transactions, will be granted a limited migration period for the purpose of adequate preparation for the introduction of SCA in remote electronic card transactions.

Denmark
The FinantilSysNet (Financial Regulator) has announced an 18-month delay. The Danish FSA will now, together with all card issuers and card issuers in Denmark, translate the implementation plans that have been discussed with the players in the market into concrete, operational milestones for how the players will ensure compliance with the rules by 11 January 2021. This after having announced previously that no delay would take place.

 

Finland
The FIN-FSA has announced a delay in enforcement. They will adhere to the 31 December 2020 deadline proposed in the EBA opinion and the supervisory measures described therein.

In Finland soft declines are being applied to a small extent on both customer initiated transactions (without SCA) and merchant initiated transactions without a networkTxReference already.

France
The BF (Bank of France) has announced that a migration plan will be pending. The timeline announced covers 18 months. Additionally, non 2FA authentication solutions will be progressively forbidden for a 'large majority' of customers before December 2020. In March 2021 all merchants should connect to the new 3DS infrastructure.

On 28th of October 2019 France published a press release stating that the final deadline will be 31st of December 2020 both for authentication solutions for consumers as well as for merchant to connect to the new 3DS infrastructure.

The Observatoire de la sécurité des Moyens de Paiement published the French SCA migration plan which states that the final deadline for SCA enforcement is 31 March 2021.

On 22nd of September 2020, The BF (Bank of France) has announced a ramp-up plan for soft-decline of non-compliant transactions. The plan covers the period from October 2020 to March 2021.

Latest information (beginning of December) is that the migration plan is the following:

    • From September to December 2020: non-3D Secure transactions of more than EUR 2.000
    • per 5 January 2021 non-secure transaction of 1000 EUR and above
    • per February 2021 non-secure transaction of 500 EUR and above
    • per March 2021 non-secure transaction of 250 EUR and above

During migrations, no soft-declines will be applied for non compliance with PSD2 for the following MCCs:

France_MCC_exceptions.png

Germany
BaFin (Federal Financial supervisory authority) has announced a delay in enforcement for PSD2. This statement was followed by a press release) stating that they will not enforce SCA until the 31 December 2020 provided certain milestones are met.

In the beginning of December BaFin presented a migration plan to their issuers which is as follows:

  • Starting 15 January: SCA enforcement on transactions above 250 EUR
  • Starting 15 February: SCA enforcement on transactions above 150 EUR
  • Starting 15 March: SCA enforcement on all transactions

Not all issuers have confirmed they will follow this plan.

Greece
Bank of Greece has announced a a delay in enforcement for SCA until 31 December 2020

Hungary
MNB (Bank of Hungary) has announced a 12-months extension plan for SCA migration. The timeline covers 12 months starting from the 14th of September 2019, and more details will follow.

Ireland
The Central Bank of Ireland has announced a delay in enforcement for all payment methods during a limited migration period. The current migration plan is as follows:

  • 1st January to 28th February 2021: SCA for all securely presented transactions >€500
  • 1st March to 31st March 2021: SCA for all securely presented transactions >€250 and all direct to authorisation transactions are soft declined >€750
  • 1st April to 30th April: y SCA for all securely presented transactions as necessary i.e. no value threshold all direct to authorisation transactions are soft declined >€500
  • 1st May to 31st May 2021: SCA for all securely presented transactions as necessary i.e. no value threshold and all direct to authorisation transactions are soft declined >€250
  • 1st June – 30th June 2021: SCA for all securely presented transactions as necessary i.e. no value threshold and direct to authorisation transactions are soft declined >€150.

Italy
Banca d'Italia (Bank of Italy) has announced a migration period. It recommends parties that want to use such migration period to present a detailed migration plan. The deadline for the migration period is 31 December 2020.

Lithuania
Lietuvos Bankas (Bank of Lithuania) has announced a migration period. It recommends parties that want to use such migration period to present a detailed migration plan. No specific timeline was announced.

Luxembourg
The CSSF (Surveillance Commission of the Finance Sector) has announced an extension of the implementation period for SCA for all payment methods. They mention an interest in harmonization of the migration plan with the EBA and requires parties that want to make use of the additional period to submit a detailed migration plan. In December 2019 the CSSF announced that PSPs should be compliant with SCA on 31 December 2020.

Malta
The Central Bank of Malta has announced an extension of the SCA enforcement period after 14th of September. In October 2019 they announced that the SCA provision will come into force on 31 December 2020.

The Netherlands
The DNB (Dutch Bank) has announced an extension of the SCA enforcement period after 14th of September. DNB encourages market parties to cooperate in order to ensure that the phased introduction of SCA proceeds in an orderly fashion and that it is completed on 31 December 2020.

Starting 1 October 2020 issuers will gradually soft-decline non-authenticated transactions, starting with amounts larger than EUR 250 down to EUR 30.

Merchants should make sure their implementation or their service provider is ready to support the new, mandatory transaction flows that include 3DS authentication. Failing to implement and test the new transaction flows may impact merchants’ conversion from this date.

Norway
The Finanstilsynet (Financial Supervisory Authority) has announced an extension of the SCA enforcement period. Parties wishing to make use of this extension would need to reach out to the Finanstilsynet. The Supervisory Authority allows for a migration period until 31 December 2020.

Poland
The KNF (Financial Supervisory Authority) has announced an extension of the SCA enforcement period. Parties wishing to make use of this extension would need to reach out before 14 september. No specific timeline was announced.

Portugal
On 17th October 2019 Banco de Portugal announced that the deadline for banks/PSPs to fully apply the strong customer authentication requirements in e-commerce card-based payment transactions is 31 December 2020.

Slovenia
Banka Slovenije (Bank of Slovenia) has announced an extension of the SCA enforcement period. In November the Bank of Slovenia announced a transition period that lasts until 31 December 2020.

Spain
The BdS (Bank of Spain) has announced an extension of the SCA enforcement period. The Spanish SCA migration plan described the phased roll-out of SCA and the roll-out deadline of 31 December 2020.

End December 2020 a new migration plan was published:

  • Starting 1 January: SCA enforcement on transactions above 250 EUR
  • Starting 1 February: SCA enforcement on transactions above 30 EUR
  • Starting 1 March: SCA enforcement on all transactions

The plan includes a statement that exemptions can be applied. Final acceptance will still be up to issuers.

Sweden
Parties can request an extension, but the supervisory body will otherwise enforce the regulation. It is currently not known which banks have filed for an extension.

We are seeing that some issuers are already applying soft declines.

United Kingdom
The FCA (Financial Conduct Authority) has announced an 18-months extension plan for SCA migration. The timeline covers 18 months starting from the 14th of September 2019, and more details will follow.

On January 28th 2020 the UK Financial Conduct Authority (FCA) published the enforcement date for the UK market. The new enforcement date is 14 March 2021 in the UK and 31 December 2020 across the rest of the EU. As a result, UK card issuers will be required to decline all non-SCA-compliant transactions after 14 March 2021.All UK based merchants, acquirers, gateways, and issuing banks or payment service providers must be ready to support SCA from this date, to avoid consumers experiencing declined e-commerce transactions. The FCA has confirmed that there will be no further extensions to this deadline. More information can be found here

On 30 April 2020 the FCA announced an additoinal 6 months delay for SCA enforcement due to the exceptional circumstances of the COVID crisis. The new deadline will shift from 14 March 2021 to 14 September 2021. After this date, any merchant that fails to comply with the requirements for SCA will run the risk of lower authorization rates.

The UK's current migration plan is to apply PSD2 SCA-compliance to:

  • June 2021: 10% of transactions
  • July 2021: 30% of transactions
  • August 2021: 60% of transactions
  • September 2021: 90% of transactions

Countries with no clear position

Although the following countries have not publicly commented on SCA migration deadlines, it is expected they will follow the EBA deadline of 31 December 2020:

  • Bulgaria
  • Croatia
  • Czech Republic
  • Estonia
  • Latvia
  • Liechtenstein
  • Romania
  • Slovakia

 

 

 

 

Was this article helpful?
13 out of 13 found this helpful