New EBA clarifications on one-leg transactions

What is a one-leg transaction?

Art. 2 (4) Directive (EU) 2015/2366 (“PSD2“) applies certain provisions of PSD2 (including Art. 97 PSD2, which requires payment service providers (“PSP“) to apply SCA) to transactions where only one of the PSP is located within the Union. However, this only applies to those parts of the transaction which are carried out in the European Union. Although it seems to be clear from the wording of PSD2 that the location of the PSPs involved is relevant for the determination of the applicability of SCA provisions, the EBA publications were not entirely clear on this question.

In the Final Report regarding “Draft Regulatory Technical Standards on Strong Customer Authentication and common and secure communication under Article 98 of Directive 2015/2366 (PSD2)” (EBA/RTS/2017/02, 23 February 2017, the “Final Report”), rationale 16, the EBA refers to the country in which the PSP is established.

In its opinion of 13 June 2018 (EBA-Op-2018-04, the “2018 Opinion”), however, the EBA states that “SCA applies to all payment transactions initiated by a payer, including to card payment transactions that are initiated through the payee within the EEA”. This indicates that the residence of the payer could be relevant for the determination of applicability of SCA in one-leg situations.

In its statement of 6 September 2019 (Question ID 2018_4030 and Question ID 2018_4233) the EBA (on behalf of the Commission) has now provided clarification that only the location of the PSPs involved is relevant for the applicability of SCA.

The EBA’s reasonable efforts or best effort approach in one-leg transactions

Possibly the most controversial and confusing statement in relation to one-leg transactions by the EBA was that the “European PSPs shall make every reasonable effort to determine the legitimate use of the payment instrument”, which the EBA proposed in rationale 16 of the Final Report. The EBA also stated, in the 2018 Opinion, that PSP should apply SCA “only on a best-effort basis for cross-border transactions with one leg out of the EEA”.

These statement have resulted in various consequential questions. Would, for instance, a best/reasonable effort approach require the PSP located in the European Union to conduct active measures (such as entering into agreements with third country PSPs) to ensure that such PSPs would support the applicability of SCA in one-leg situations, too? Or could this obligation require a PSP to reject a transaction in specific situations, if the applicability of SCA cannot be ensured?

The best effort approach does not follow from PSD2. Moreover, Art. 2 (4) PSD2 requires a PSP to apply SCA in one-leg situations only “in respect to those parts of the payments transaction which are carried out in the Union”, which would admittedly also raise questions on the applicability of SCA. However, as a consequence, PSD2 does not help to interpret the content of the best effort approach as it does not explicitly follow from PSD2.

The Swedish Banker’s association has submitted various questions on the applicability of SCA in one-leg situations and has asked the EBA for clarification. The Swedish Banker’s association was asking what best efforts would mean if, in case of card payments, only the PSP of the merchant (hereinafter also acquirer), but not the PSP of the payer (hereinafter also the card issuer), is located in the European Union and whether it would make a difference if the third country of the issuer would require comparable measures to SCA or not.

The Swedish Banker’s association has also asked what card issuers located in the European Union would need to do in order to comply with the best effort approach if the PSP of the merchant is located outside the European Union and does not support SCA.

In its answer to Question ID 2018_4233, the EBA has now provided clarification in specific situations:

1. The card issuer is located in the European Union and the acquirer of the merchant is located outside the European Union.

In this case, the card issuer is subject to SCA, but the acquirer is not. The EBA is of the opinion, that the issuer shall in that case make its own assessment whether to block the payment or be subject to the liability requirements under Art. 73 of PSD2 in the event that the payment has been unauthorized.

There is therefore no specific best efforts obligation for the card issuer to comply with. However, it seems that, if the card issuer can technically impose the use of SCA on the acquirer, the best effort approach requires the card issuer to do so. Unfortunately, the EBA does not answer the submitter’s question whether this obligation of the card issuer also applies if the acquirer is not able to apply exemptions from SCA and whether, in consequence, each transaction would be subject to SCA.

2. The card issuer is located outside the European Union and the acquirer is located in the European Union.

In this case, the card issuer is not subject to SCA, but the acquirer is. Here, the EBA is of the opinion that the acquirer must be in a position to accept SCA and thus has to put in place mechanisms that allow for SCA. It does not follow from this statement whether the acquirer only has to provide the same measures that it has to provide for payments of customers of card issuers located in the European Union, or whether the best effort approach would also require to have such mechanisms in place if the country where the card issuer is located has rules in place which are only similar to the SCA provisions in the RTS.

Therefore, the question, which measures the acquirer has to take in order to comply with the best effort approach, are still not entirely clear in this situation. It does, however, not explicitly follow from the EBA’s answer that an acquirer located in the European Union would need to take measures going beyond of what is required under the SCA RTS.

Comment

The EBA’s answers (on behalf of the Commission) are not binding for the National Competent Authorities (“NCA”) of the Member States. Therefore, firms will need to monitor which approach the relevant NCA(s) take in this respect.

Although the EBA’s answers still leaves some questions with respect to one-leg situations open, it has at least provided some clarification that the best effort approach does not require PSPs located in the European Union to block transactions and that the obligations following from the best efforts approach do not seem to require PSPs to make arrangements with third country PSPs to ensure the applicability of SCA.