DIGITALEUROPE proposes 5 key recommendations for a successful implementation of Strong Customer Authentication (SCA)

Recommendation 4: Clear and timely communication by NCAs and the EBA

As the regulation on SCA soon takes effect, all relevant stakeholders need a clear communication from their respective authorities on what they should expect with regards to the enforcement of the regulation. It is understandable and reasonable that achieving harmonisation across Europe in such a complex matter takes a lot of time and effort from all parties involved, thus full clarity is difficult to expect before 14 September 2019. However, in order to avoid a high transaction decline rate, the industry needs a strong and clear signal from all NCAs in all countries whether flexible enforcement will be granted. It also needs to clearly understand what to expect after the regulation takes effect. A good example of this practice is in the recent announcements of the Italian and the Dutch central banks, as well as in an earlier announcement in France. Furthermore, the EBA and the NCAs are strongly encouraged to communicate their final and fully comprehensive decisions in a timely manner.

Recommendation 5: Introduce a permanent and targeted exemption for remote and unconnected environments.

The provision of online connectivity and online sales on board aircraft, ships and other remote areas, such as oil platforms, is a growing service sector. At present, there are no technological solutions able to effectively address all potential methods banks may utilise to comply with SCA. As a concrete example, if SCA rules were to apply in remote, unconnected environments such as airplanes, a passenger that intends to purchase a Wi-Fi package onboard would first need to receive a verification code (called dynamic link) via SMS/email/push notification that verifies the legitimacy of its transaction, before the Wi-Fi service is purchased. If the passenger cannot receive the verification code due to connectivity issues in the plane, the SCA rules will require the cardholder’s bank to decline the transaction. This would result in passengers unable to purchase in-flight Wi-Fi and in substantial revenue losses for several actors in the value chain. Applying SCA rules in remote and unconnected environments is also difficult considering that card issuers are free to choose their preferred method of secondary authentication. Providing the means for all possible authentication methods at all times is not feasible.

A second and equally important challenge is about passenger payments in an unconnected (offline) environments where no external connectivity is available. Giving passengers the option to purchase a variety of onboard goods and services (food, drink, Pay-Per-View) via their personal electronic device or inflight entertainment system is increasingly popular. The market for infotainment content is growing. However, if SCA were to apply in unconnected environments such as airplanes, providing these infotainment services would become impossible. Only a permanent and targeted exemption for remote and unconnected environments, similar to the one granted to unattended terminals for transport fares and parking fees, would bring clarity in the industry and properly recognise the legitimacy of such payment environments. We, therefore, urge policymakers to consider this exemption and implement it as soon as possible.