What is PSD2?

The Payment Service Directive 2, also known as The Revised Payment Services Directive, is a European regulation that fosters open, competitive, and secure payments throughout Europe. The PSD2 also creates guidelines for Strong Customer Authentication (SCA).

What is SCA?

Strong customer authentication (SCA) refers to three elements businesses can use to authenticate a payment such as a password, phone, and fingerprint.

PSD1 vs. PDS2

The Payment Services Directive 1 (PSD1) built a single payments market for the EU. It made payment processing easier and created laws and guidelines for payment services and infrastructures in the EU.

The Second Payment Services Directive is a revised version of the PSD1. It protects consumers’ payment types and creates a transparent, competitive payment landscape across Europe.

Benefits of PSD2

The second payment services directive improves the payment landscape in several ways:

• Allowing non-bank financial institutions (aka individuals) to access and own their data and accounts
• Encouraging innovation from solutions entering the market with new payment methods
• Increasing security levels for online and in-store payments, reducing fraud
• Earning customers’ trust with stronger security measures
• Expanding transactions across borders
• Improving financial wellbeing for consumers

PSD2 requirements

PSD2 must meet several obligations:

1. According to the PSD2 SCA, consumers must use two of three authentication methods, for two-factor authentication (2FA) on all payments. They are classified as knowledge, inherence, or possession (password, fingerprint, or code generation).
2. Financial institutions (i.e. banks and Payment Service Providers) encrypt communications and provide fraud-proof seals on data or transactions.
3. Only eIDAS (electronic identification, authentication, and trust services) certificates issued by a Qualified Trust Service Provider can identify PSPs.
4. PSD2 must use both digital certificates for secure communications:
   a. Qualified Website Authentication Certificate (QWAC) to protect data in peer-to-peer communications and to identify the endpoint controller
   b. Qualified Certificate for Electronic Seals (QSealC) to create e-seals to protect data or documents using different standards (ETSI’s PAdES, and so on) and assert their origin from a legal entity
5. PSD2 certificates can only be issued by certain organizations to legal persons with a PSD2 authorization number issued by a National Competent Authority (NCA).

Who Must Comply with PSD2?

All financial service providers, banks, and TPPs within the EU (like app developers, fintech programmers, or retail merchants) must comply with the Second Payment Services Directive. Although the United Kingdom (UK) separated from the European Union, requirements still apply to certain entities within the country.

Where is PSD2 Applicable?

PSD2 applies everywhere within the EU and in areas where both the card issuer and the bank are within the European Economic Area (EEA). Essentially, SCA applies to all merchants conducting business in the EEA.

How does PSD2 Affect the US?

Many US organizations could feel the effects of the regulation including the following:

1. 1. Any US business with locations within the EU
   2. Any US business that sells goods or services to EU citizens
   3. Any US business that conducts significant business with EU organizations

PSD2 may not always directly impact US organizations, but large, multinational organizations or those that meet one of the above criteria must comply with the regulations.

Additionally, US businesses operating in the EU must ensure that they are PSD2 and SCA-compliant.