Banks and financial services institutions are preparing for a shake-up, with the new payments services directive (known as PSD2) coming into force in a matter of months. The rules are set to transform the payments and banking industries, bringing exciting new opportunities for fintech, along with strict new requirements and responsibilities. Here, we outline the key changes to be aware of.
What is PSD2?
PSD2 replaces the original Payments Services Directive, taking into account the huge developments in online payments, financial services and the use of customer data, many of which fall outside the scope of the original rules. The new directive aims to provide a framework for the many new players in the market, giving customers more choice and control over how they manage their money, while ensuring their security is protected.What are the main changes?
Under the new legislation, banks will lose their monopoly on customer accounts information and payment services, as they’ll be required to give third-party providers access to customers’ details – where the customer has authorised them to do so. This means that from January, banks will be opening up their application programme interface (API) to communicate with third party providers, enabling them to access the customer data they need.
PSD2 has also identified two types of third party providers in this new financial ecosystem; namely AISPs (Account Information Service Providers) and PISPs (Payment Initiation Service Providers). An AISP is any business that uses a customer’s account information to aggregate their financial information in one place, to help them track their spending or plan their finances. A PISP is any company that initiates online payments on behalf of the user, offering an alternative to the use of a card or online banking.
Under PSD2 any company offering either of these services must be registered, licensed and regulated at an EU level, as well as abiding by a number of security requirements, including:
- All internet transactions will require at least two of the following:
- Something only the user knows, e.g. a pin or password
- Something only the user has, e.g. a payment card
- Something the user is, e.g. a unique fingerprint
- Remote transactions, for example via mobile, will require an extra level of security in the form of a unique authentication code.
