What is SCA?

Strong Customer Authentication (SCA) is a requirement of PSD2*, which asks businesses to use at least two authentication elements to verify electronic payments. The point of this is to reduce fraud and make online payments more secure for you.

SCA will apply to ‘customer-initiated’ online payments. This means all bank transfers and most card payments will require SCA. Recurring direct debits, on the other hand, are considered ‘merchant-initiated’ and will not require strong authentication.

*PSD2 explained

The Second Payment Services Directive (PSD2) is going to be implemented across EU member states in September 2019.

PSD2 is a new payments-related legislation in Europe and requires payment service providers, like Ebury, to make a number of changes to ensure better service, increase security and reduce costs.

Why does it need updating?

The original Payment Services Directive (PSD) was created in 2007 to focus on improving payments—particularly credit transfers, direct debits and cards.

As the digitisation of the European economy has progressed massively over the last few years, the PSD has needed to update to include new players—such as fintechs like Ebury.

PSD2 is coming into force to make payments safer, increase client protection, foster innovation and competition, and ensure a level playing field for banks and other payment service providers alike.

What does this mean for you?

You will need to activate two-factor authentication (2FA) over the next few weeks, as it will become compulsory when logging in to their Ebury Online account AND when instructing new payments. 2FA is already available to set up when logging in to Ebury Online, and will soon become a feature when making payments.

2FA will require:

1. Something you know (e.g a password)
2. Something you own (e.g a mobile device)

After the new regulation comes into effect, banks will start to decline SCA required payments that don’t meet the SCA criteria, so it’s important to activate two-step verification on Ebury Online now.

If you are interested in reading the original SCA requirements, they are set out in the Regulatory Technical Standards (RTS).

If you have any questions about how we’re implementing PSD2, please talk to your Relationship Manager or email [email protected].