Published by Gbaf News
Posted on September 23, 2019
6 min readLast updated: January 21, 2026
By Ramesh Ramani, Head of Banking & Financial Services Europe, Cognizant
The UK’s Financial Conduct Authority (FCA) has confirmed an 18-month deadline extension for the introduction of Secure Customer Authentication (SCA) regulations, in an attempt to give firms more time to prepare for the impending Second European Payment Services Directive (PSD2) deadline. With the new rules for cashless payments originally due to come into force on 14th September 2019, this has given cause for a temporary sigh of relief amongst many in the e-commerce industry.
This is because, as part of PSD2, the SCA requirement stipulates stronger payment security standards for higher value transactions based on multifactor authentication, increasing the security of electronic payments. This comes as FCA data reported that cyber incidents at financial services firms increased by 1,000 per cent in 2018, and this figure is only expected to rise with the growth in mobile payments.
The delay to the implementation of the directive is intended to prevent disruptions to online payment processes and facilitate the smooth transition to the new requirements put in place to make cashless payments safer. But why has the deadline been extended, and what can businesses do to make sure they are ready for the revised implementation date?
What is going to change?
Applicable across the whole of the EU including the European Economic Area (EEA), the directive will provide better customer data protection and ensure that data transmission over the internet is more secure. Simply put, only payment services that are PSD2-compliant can be used for online purchases using cards.
Another important element of the directive is that those who accept payments online will have to demand a two-factor authentication. Customers will no longer be able to order with just one click or by credit card number, but will instead have to confirm their purchase with two security features.
According to the directive, the security features must combine two out of the three following security criteria:
This means that the traditional combination of a PIN and password is no longer sufficient, as both entries will come under the “knowledge features” category.
A future without the extension
While banks and third-party providers like Fintechs – such as as Monzo and Revolut – are already well prepared to meet the deadline, many organisations that offer online payments and even entire markets are not. In fact, levels of readiness for implementing a PSD2-compliant process in time for 14th September are now extremely varied. But as SCA comes into effect, all parties in the payments chain will need to be ready at the same time to avoid challenges. An extended deadline will therefore provide regulators with more time to consult, engage and work with relevant market participants, industry representatives and financial institutions. It will also provide the opportunity to educate customers of the impending security measures as many still remain blissfully unware of the upcoming changes.
Without an extended deadline, a significant number of transactions could have been abandoned, resulting in a loss of revenue as well as disgruntled customers. According to an EU-wide study by the payment platform Stripe and 451 Research, revenues would have fallen by €57 billion in the first year after the directive came into force.
Needless to say, this could have impacted the retail industry and have had an adverse effect in terms of what the EU wants to achieve with the new directive: more security and protection against fraud; more innovation by registered third parties; and, above all, a better, frictionless, convenient customer experience.
Three tips for businesses preparing for PSD2
This extension may now be in place, but it is not a time for retailers to rest on their laurels. It is time for retailers to act and take advantage of the increased time they have been given to prepare for PSD2. But how should they best use the time? Here are three of the most important considerations merchants should take into account:
The 18-month deadline extension in the UK is considerable, but as with anything, it will come around soon enough and the timetable that businesses not yet ready to meet the directive will need to stick to will be tight. Merchants should therefore seize the opportunity offered by the extension and ensure they are offering customers a seamless experience as they make the transition to being PSD2-compliant.
Explore more articles in the Business category
