Countries with confirmed delay in enforcement
The NBB (National Bank of Belgium) has announced that while the deadline of 14 September is still valid, enforcement will be delayed until a sensible migration plan is finalized and agreed upon. Belgium issuers has started soft declining non-compliant transactions from 25 August 2020 in a phased approach, starting with transactions > EUR 1,500. They will gradually lower the amount for Soft Declines until they reach EUR 0 at 17 November 2020. Belgium adheres to the 31 December 2020 deadline to be fully SCA compliant.
We are currently (half September) seeing soft declines being applied above EUR 1,500.
The CBC (Central Bank of Cyprus) announced that they do not intend to take supervisory enforcement action against licensed institutions which have not implemented SCA in remote electronic card transactions by 31 December 2020, provided that these institutions have submitted a migration plan to the Central Bank of Cyprus.
This announced follows a previous announcement that regulated entities which currently support a non-reusable and non-replicable element for online card transactions, will be granted a limited migration period for the purpose of adequate preparation for the introduction of SCA in remote electronic card transactions.
The FinantilSysNet (Financial Regulator) has announced an 18-month delay. The Danish FSA will now, together with all card issuers and card issuers in Denmark, translate the implementation plans that have been discussed with the players in the market into concrete, operational milestones for how the players will ensure compliance with the rules by 14 March 2021. This after having announced previously that no delay would take place.
In Finland soft declines are being applied to a small extent on both customer initiated transactions (without SCA) and merchant initiated transactions without a networkTxReference already.
The BF (Bank of France) has announced that a migration plan will be pending. The timeline announced covers 18 months. Additionally, non 2FA authentication solutions will be progressively forbidden for a 'large majority' of customers before December 2020. In March 2021 all merchants should connect to the new 3DS infrastructure.
On 28th of October 2019 France published a press release stating that the final deadline will be 31st of December 2020 both for authentication solutions for consumers as well as for merchant to connect to the new 3DS infrastructure.
The Observatoire de la sécurité des Moyens de Paiement published the French SCA migration plan which states that the final deadline for SCA enforcement is 31 March 2021.
On 22nd of September 2020, The BF (Bank of France) has announced a ramp-up plan for soft-decline of non-compliant transactions. The plan covers the period from October 2020 to March 2021.
Latest information (beginning of September) is that the migration plan is the following:
- From September to December 2020: non-3D Secure transactions of more than EUR 2.000
- per January 2021 non-secure transaction of 1000 EUR and above
- per February 2021 non-secure transaction of 500 EUR and above
- per March 2021 non-secure transaction of 250 EUR and above
We are currently (half September) seeing soft declines being applied on a small percentage of transactions above EUR 2,000.
During migrations, no soft-declines will be applied for non compliance with PSD2 for the following MCCs:
BaFin (Federal Financial supervisory authority) has announced a delay in enforcement for PSD2. This statement was followed by a press release) stating that they will not enforce SCA until the 31 December 2020 provided certain milestones are met.
Bank of Greece has announced a a delay in enforcement for SCA until 31 December 2020
MNB (Bank of Hungary) has announced a 12-months extension plan for SCA migration. The timeline covers 12 months starting from the 14th of September 2019, and more details will follow.
The Central Bank of Ireland has announced a delay in enforcement for all payment methods during a limited migration period. No specific timeline was announced.
Banca d'Italia (Bank of Italy) has announced a migration period. It recommends parties that want to use such migration period to present a detailed migration plan. The deadline for the migration period is 31 December 2020.
Lietuvos Bankas (Bank of Lithuania) has announced a migration period. It recommends parties that want to use such migration period to present a detailed migration plan. No specific timeline was announced.
The CSSF (Surveillance Commission of the Finance Sector) has announced an extension of the implementation period for SCA for all payment methods. They mention an interest in harmonization of the migration plan with the EBA and requires parties that want to make use of the additional period to submit a detailed migration plan. In December 2019 the CSSF announced that PSPs should be compliant with SCA on 31 December 2020.
The Central Bank of Malta has announced an extension of the SCA enforcement period after 14th of September. In October 2019 they announced that the SCA provision will come into force on 31 December 2020.
The DNB (Dutch Bank) has announced an extension of the SCA enforcement period after 14th of September. DNB encourages market parties to cooperate in order to ensure that the phased introduction of SCA proceeds in an orderly fashion and that it is completed on 31 December 2020.
Starting October 2020 issuers will gradually introduce SCA compliant behaviour on transactions above a certain amount: part of transactions without SCA that would previously have been approved, will now be soft-declined to force authentication. The plan is:
- per start of October 2020 non-secure transaction of 250 EUR and above
- per half of October 2020 until beginning of November non-secure transaction of 100 EUR and above
- per half of November 2020 non-secure transaction of 30 EUR and above
- Per December: no more soft declines until end of the year
Merchants should make sure their implementation or their service provider is ready to support the new, mandatory transaction flows that include 3DS authentication. Failing to implement and test the new transaction flows may impact merchants’ conversion from this date.
The Finanstilsynet (Financial Supervisory Authority) has announced an extension of the SCA enfocement period. Parties wishing to make use of this extension would need to reach out to the Finanstilsynet. The Supervisory Authority allows for a migration period until 31 December 2020.
The KNF (Financial Supervisory Authority) has announced an extension of the SCA enfocement period. Parties wishing to make use of this extension would need to reach out before 14 september. No specific timeline was announced.
On 17th October 2019 Banco de Portugal announced that the deadline for banks/PSPs to fully apply the strong customer authentication requirements in e-commerce card-based payment transactions is 31 December 2020.
The BdS (Bank of Spain) has announced an extension of the SCA enfocement period. The Spanish SCA migration plan described the phased roll-out of SCA and the roll-out deadline of 31 December 2020.
Parties can request an extension, but the supervisory body will otherwise enforce the regulation. It is currently not known which banks have filed for an extension.
We are seeing that some issuers are already applying soft declines.
The FCA (Financial Conduct Authority) has announced an 18-months extension plan for SCA migration. The timeline covers 18 months starting from the 14th of September 2019, and more details will follow.
On January 28th 2020 the UK Financial Conduct Authority (FCA) published the enforcement date for the UK market. The new enforcement date is 14 March 2021 in the UK and 31 December 2020 across the rest of the EU. As a result, UK card issuers will be required to decline all non-SCA-compliant transactions after 14 March 2021.All UK based merchants, acquirers, gateways, and issuing banks or payment service providers must be ready to support SCA from this date, to avoid consumers experiencing declined e-commerce transactions. The FCA has confirmed that there will be no further extensions to this deadline. More information can be found here.
On 30 April 2020 the FCA announced an additoinal 6 months delay for SCA enforcement due to the exceptional circumstances of the COVID crisis. The new deadline will shift from 14 March 2021 to 14 September 2021. After this date, any merchant that fails to comply with the requirements for SCA will run the risk of lower authorization rates.
The UK's current migration plan is to apply PSD2 SCA-compliance to:
- June 2021: 10% of transactions
- July 2021: 30% of transactions
- August 2021: 60% of transactions
- September 2021: 90% of transactions
Countries with no clear position
Although the following countries have not publicly commented on SCA migration deadlines, it is expected they will follow the EBA deadline of 31 December 2020:
- Czech Republic