PSD2: Overview on Regulation - Axerve

1. Status

Final RTS published and will enter into force on September 14th, 2019

To help RTS implementation, EBA has:

Published new papers (Opinion on the implementation of the RTS on SCA, Guidelines)

Opened a Q&A portal for additional clarification

2. Key Considerations

SCA is the new standard (payment transactions and access to accounts)

The final authorisation will be approved (or declined) by the issuer

SCA Exemptions are permitted but are not a given. Actions are required (fraud monitoring, White List, …)

SCA Exemptions enable higher flexibility to create a frictionless customer user experience (One Click check-out)

3. RTS Requirements on SCA and Exemptions

Scope

Online / Remote payments (incl. card on file)

In store electronic payments (e.g. mobile/ contactless)

Access to mobile banking app

Two-leg transactions*

MIT are out of scope of SCA requirements**

Payment transactions where both the issuer and the acquirer are located within the EEA

MIT (Merchant Initiated Transactions) are card payments initated ‘by the payee only’. There is pre-existing agreement between payer and payee for provision of services. SCA is required for initial mandate.

MIT use cases are limited and clearly defined:Utilities bill payments (e.g. electricity and gas)Mobile phone subscriptionsDigital services subscriptions (e.g. Google Ads)Funding transactions for staged wallets (e.g. PayPal)

----

*

**

Key Principle

Knowledge: Something you know

• Password• Passphrase• Pin• Sequence• Secret fact

Possession: Something you own

• Mobile phone• Wearable device• Smart card• Token• Badge

Inherence: Something you are

• Fingerprint• Facial features• Voice patterns• Iris format

Main exemptions (for low risk transactions)

Remote transactions up to EUR 30 (for 5 consecutive transactions, or alternatively for total of EUR 100)

Remote transactions between EUR 30 and EUR 500 provided RBA** is applied by the issuer or the acquirer and their fraud rates are under specific thresholds

Issuer bps

TRA

Thre

shol

ds

Exempt up to:

< 13 bps € 100

€250

€500

< 6 bps

< 1 bps

Remote transactions to white lists of trusted beneficiaries and recurring transactions (SCA is required for the initial ‘subscription’)

Contactless transactions up to EUR 50 (for 5 consecutive transactions, or alternatively for total of EUR 150)

** Risk based authentication

Knowledge Possession

Inherence

2-factor

2-factor2-factor

PSD2: Overview on Regulation

Il documento è proprietà intellettuale di: Axerve S.p.A. - gruppo Sella – P.zza Gaudenzio Sella, 1, 13900 Biella – [email protected] – [email protected] www.axerve.com – Capitale sociale: € 2.040.566,00 i.v. – CF 02027040027 – REA BI 177809 – Società appartenente al Gruppo Iva Maurizio Sella S.A.A. con P. IVA 02675650028. Soggetta all'attività di direzione e coordinamento di Banca Sella Holding S.p.A. - Iscrizione Tribunale di Biella n. 71524

1/4

4. Checkout examples

Frictionless in mobile app

5. Mastercard Recommandations

1. EMV 3DS 2.0 is the best way to achieve compliance with PSD2 RTS2. Leverage the additional authentication & authorization information provided by Mastercard3. Maximize SCA Exemptions4. Leverage Biometric Authentication for SCA5. Issuers can delegate the SCA

Biometric (Bank app) in mobile app

2 factor in browser



2/4

6. Richer Authentication Message – EMV 3DS versus 3DS 1.0

3DS 1.0 Data (Initial Message – VEReq)

• Message, Extension, Version• Browser User-Agent• Acquirer BIN• Acquirer Merchant ID• DS URL• Cardholder Account Number

Mor

e th

an 10

x D

ata

EMV 3DS Data (Initial Message – AReq)

• Merchant Risk Indicator (Delivery Timeframe, Re-order, Pre-order, Gift Card)

• Cardholder Account Information (Account Age, Change, Password Change, Number of Transactions per Day / Year, Shipping Name Indicator, Suspicious Activity, Payment Account Age etc.)

• DS Reference Number, Transaction ID• Cardholder Shipping Address• 3DS Requestor Authentication Information (Method),

Challenge Indicator, ID, Initiated Indicator• Purchase Date & Time• SDK Reference Number, SDK Transaction ID• Purchase Amount, Currency, Date & Time• Transaction Type• Device Channel, Device Information, Rendering Options

Supported• Card Expiry Date• and more…

You can easily integrate the mandatory data like Cardholder, Card, Acquirer, Billing and Shipping informations with Gestpay by Axerve API. For further information see our documentation and our API.


7. GDPR

The 3DS 2.0 will require more information from the buyer. It is therefore essential to collect a specific consent from the card holder for the transmission of all data entered during the purchase (shipping address, addresses, etc ...) that will be sent to third parties for the correct processing of the payment transaction.

Without such consent the transaction will be deprived of the information needed for the assessment of its riskiness: the authentication will be processed through SCA. Ask your acquirer how to modify your GDPR policy.


3/4

8. “Call to Action” for Merchants

Increase Transparency

• Enrol into EMV 3DS• Enrich authentication message

to encourage issuers to maximise exemptions

• Adapt terms and conditions (GDPR)

Drive Loyalty

• Promote whitelisting solutions for customers

• Leverage recurring transactions and MITs

Reduce Fraud

• Increase visibility on your fraud levels

• Implement new solutions (e.g. tokenization, fraud engines)

• Collaborate with acquirers (e.g. bring down fraud levels and leverage TRA exemptions)

Adopt Innovative Solutions

• Implement or adopt biometric solutions

Merchants SCA approach

https://docs.gestpay.it/soap/3ds-2.0/how-change-integration/

https://api.gestpay.it/#3ds-2-0-fields

9. Increase your conversion rate with Axerve Guaranteed Payment

Merchant

SDK iFrame API / S2S

Axerve Server

Trx < 500€ Trx > 500€ 1 LEG / Moto

Trx Engine Trx 3DS no ex. Existing flow

Trx 3DSSCA with

exemptions

EMV 3DS Authentication with Acquirer

Exemption Flag (no forced SCA)Low payment < 30€

Recurring / Subscription

Whitelist / Recurring from the 2nd transaction

SCA Issuer

SCA Issuer

Auth OKwithout SCA

Auth OK without SCA

Auth OKwith SCA

Auth OK with SCA

Auth KO

Auth KO

Axerve liabilityvs Merchant liabilily

Issuerliability



4/4

PSD2: Overview on Regulation - Axerve

Documents

Transcript of PSD2: Overview on Regulation - Axerve