Announcement NBB_2019_23 / EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06)

mBanqueNationaleBqnk
DEBELGIQUE VAN BELGIE de Beriaimontlaan 14-BE-1000 Brussels phone +32 2 221 48 66 company number: 0203. 201. 340 RLP Brussels www. nbb. be Eurosystem Announcement Brussels, 27 August 2019 Ref: NBB 2019 23 Your correspondent:
Reinout Temmerman phone:+32 2 221 3209 reinout. temmerman@nbb. be Announcement NBB_2019_23 / EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06) Belgian issuers of payment cards and Belgian acquirers for card transactions that occur in the framework of online commerce (e-commerce), i. e. Belgian credit institutions/payment institutions/electronic money institutions that provide - in an e-commerce environment - the payment service set out in point 5 of Annex I.A of the Law of 11 March 2018 on the statute and supervision of payment institutions and electronic money institutions, access to the business of payment service provider and to the activity of issuing electronic money, and access to payment systems ('the Law of 11 March 2018'). Summarv/purpose This announcement sets out the Bank's expectations regarding the market implementation - in the frame work of e-commerce - of the procedure of strong customer authentication as set out in the Delegated Regulation (EU) no. 2018/389 with regard to the regulatory technical standard for strong customer authentication and common and secure communication. NBB_2019_23 - 27 August 2019 Announcement - Page 1/2

Dear Madam,
Dear Sir, rfi
Payment Services Directive (EU) 2015/2366 (PSD 2) provides new security requirements applicable to payement services providers, including strong customer authentication requirements. The latter are specified in the Regulatory technical standards on strong customer authentication and common and secure communication1 (the "RTS") which require, amongst others, the implementation of strong customer authentication (SCA) in certain circumstances, including card payments in the framework of e￾commerce. On 21 June 2019, the European Banking Authority (EBA) published an Opinion on the elements of strong customer authentication under PSD 2 (EBA-Op-2019-06). The Opinion is the EBA's response to key industry questions about which authentication factors comply with the requirements for SCA. In response to concerns about industry's preparedness and ability to comply with the requirements for SCA, the EBA "accepts that, on an exceptional basis and in order to avoid unintended negative consequences for some payment service users after 14 September 2019, [Competent Authorities] may decide to work with PSPs and relevant stakeholders, including consumers and merchants, to provide limited additional time to allow issuers to migrate to authentication approaches that are compliant with SCA, such as those described in this Opinion, and acquirers to migrate their merchants to solutions that support SCA". The legal deadline for complying with the RTS - and the SCA requirements - remains 14 September 2019. However, the Bank ackowledges the challenges - for Belgian issuers of payment cards and Belgian acquirers for card transactions that occur in the framework of e-commerce - in meeting this deadline and the necessity to work together with the relevant stakeholders (payment services providers, card schemes, merchants and consumers association.... ) to agree on a reasonable and acceptable plan to migrate - as soon as reasonably possible after 14 September 2019 - the industry to implement SCA for card payments in e-commerce. Next stees The Bank will work in close cooperation with the industry stakeholders to agree as soon as possible on a reasonable migration plan that encompasses a blueprint for compliance and readiness, a timetable for achieving this, and key milestones and targets to deliver improved security of customer authentication and fraud reduction along the way. Once the migration plan is finalised and agreed upon by the Bank, the latter will publish it on its website., The Bank expects all stakeholders covered by the migration plan, and in particular relevant payment service providers, to fully comply with the plan and meet the agreed milestones and targets in order to be compliant with the SCA requirements by the final delivery date to be set out in the plan. In order to benefit from this scheme, payment service providers will have to provide the Bank with sufficient evidence that they have taken appropriate steps to comply with the strong authentication
requirements at the final delivery date set out in the plan. A copy of this announcement is sent to the external auditors of your institution. Yours sincerely, Pterfe Wunsch governor 1 As endorsed by the Delegated Regulation (ED) no. 2018/389. Announcement - Page 2/2 NBB_2019_23 - 27 August 2019