Alongside blockchain and crypto currencies, the Payment Services Directive 2 (PSD2) has become a much talked-about buzzword in the FinTech world - sparking discussions about a revolution in banking and financial services. One may argue that disruption to established practices may only result from technological advancement and not from (yet another) massive bundle of regulatory rules. However, through PSD2, the shift towards open banking is being fostered by the European legislator to support innovation and improve competition in the payment services area.
With open data and open access as guiding principles of the regulation, PSD2 introduces new payment services. Through the payment initiation service (PIS) a client gives his or her consent to a third-party provider (TPP) to initiate a payment order with the client’s bank, without using a payment card or accessing a payment account. The account information service (AIS), on the other hand, consists of the provision of consolidated information from all client payment accounts kept in various banks.
Via screen scraping, payment services were available on the market before PSD2. This required clients sharing their login data to allow TPPs to access information from their bank accounts. The risks of misuse of information or unauthorized transactions were borne by the clients, as banks in general did not allow access by TPPs.
Under Regulatory Technical Standards (RTS), screen scraping is no longer allowed, except for specific circumstances defined therein. On the basis of client consent, banks are obliged to allow TPPs safe access to the client’s information and provide for a dedicated interface (API) enabling secure communication channels for sharing information between the bank and the TPP.
For the provision of PIS and AIS, no contractual relationship needs to be established between the bank and the TPP. The banks are obliged to treat the TPP’s requests for payment initiation or for the provision of information without any discrimination, in particular in terms of timing, priority, or charges vis-à-vis direct client requests. Liability for unauthorized payments rests with the bank, which is obliged to refund the relevant amount to the client immediately and can only then find recourse from the PIS provider, who has to compensate the bank for its losses, unless authentication and proper execution of the transaction within its sphere of competence can be proven.
TPPs also have to undergo an authorization process with a competent national authority, typically a central bank. While PIS providers have to obtain a payment institution license, which is subject to the minimum registered capital and compliance with extensive technical and corporate requirements, simple registration suffices for the sole provision of AIS.
Slovakian authorities managed to transpose the Directive without delay on January 13, 2018 through the amendment of the Act on Payment Services. While existing payment institutions were granted a transition period of six months, banks, which have a full-scope license for the provision of payment services in the form of their bank permit, were required to comply with the new rules immediately.
From a market perspective, banks will naturally react with plans to foster innovation and come up with their own PIS and AIS products, including the setting-up of incubators, investments into in-house innovation centers, and cooperative relationships with startups. Slovakia has a well-established and traditionally strong banking sector, and major banks (typically subsidiaries of European banks) will be expected to focus on implementing the group strategies of their parent companies. As Slovak consumers are generally open to online banking, the market provides a decent basis for the testing of new apps and products. Earlier moves can realistically be awaited from smaller, locally owned banks. Moving away from the finance world, large telco operators could become true disruptors, able to fully seize the opportunities provided by PSD2 in Slovakia. They are well positioned to take advantage of their strong market penetration, existing infrastructure and sufficient resources.
Now, half a year after PSD2 entered into force, it appears that the highly-anticipated revolution in payment services will require more time. In order not lose their relationships with clients and overcome possible disintermediation, banks will have to react quickly to the coming changes. FinTechs on the other hand, even in the absence of partnerships with banks, can gain a significant advantage from the inefficient and tedious approach of banks and their regulatory obligation to provide third party providers with access to client information (subject to client consent). Ultimately, given the risks of sharing sensitive financial data, the nature of banking will depend in the future on winning clients’ trust with secure, effective, and user-friendly solutions.
By Silvia Hlavackova, Partner, and Dominika Gricova, Associate, Taylor Wessing Slovakia
This Article was originally published in Issue 5.8 of the CEE Legal Matters Magazine. If you would like to receive a hard copy of the magazine, you can subscribe here.
