W3C IG EBA PSD2 mandate on Strong Customer Authentication and Secure Communication Geoffroy Goffinet

The role of the EBA The EBA was established by Regulation (EC) No. 1093/2010 of the European Parliament and EU Council; came into being on 1 January 2011; took over all existing tasks and responsibilities from the Committee of European Banking Supervisors (CEBS); took on additional tasks, incl. consumer protection, the monitoring of financial innovation, and payments; is an independent authority; is accountable to the EU Parliament and Council; has as its highest governing body the EBA Board of Supervisors, comprising the Heads of the 28 national supervisors. 1

Output of the EBA to date Since its creation in 2011, the EBA has issued more than 200 legal instruments, as well as more than 100 reports.   2011 2012 2013 2014 2015 Total Regulatory Technical Standards 1 39 22 15 77 Implementing Technical Standards 21 10 9 40 Guidelines 2 6 17 19 46 Opinions / Technical Advice 14 48 Published reports 12 26 23 34 111 Recommendations 4 Breach of Union Law investigations 0  Mediations 5 7 Peer reviews 3 Warnings  0 Stress tests  1 2

PSD2 - Strong Authentication & Secure Communication EBA mandates and milestones The PSD2 confers a mandate (art 98) on the EBA to develop in close cooperation with the ECB: the requirements of the strong customer authentication; the exemptions from the application of strong customer authentication; the requirements with which security measures have to comply in order to protect the confidentiality and the integrity of the payment service users’ personalised security credentials; and the requirements for common and secure open standards of communication for the purpose of identification, authentication, notification, and information, as well as for the implementation of security measures, between account servicing payment service providers, payment initiation service providers, account information service providers, payers, payees and other payment service providers. Joint CP to allow market participants to see the complete picture and provide meaningful responses

? Strong Authentication & Secure Communication milestones First publications on Dec 8th Entry into force + 12mths 13 Jan 2018 Sep 2018 Entry into force + 24mths = Application date of PSD2 (incl. all EBA mandates, except RTS SCA-CSC) Adoption of RTS by EU Commission (date tbc) Entry into force of RTS (RTS adoption + 18 months, i.e. not before Sep. 2018 ) ? Entry into force of PSD 2 EBA deliverable: 8 Feb 2016 Jul-Sept 2016 (jointly with the ECB) Security Publication of DP ↙ RTS on Strong Authentication & Secure Communication Publication of CP ↙ ? 13 Jan 2016 13 Jan 2017 End of DP consultation Milestones for the RTS and ITSs 8 February 2016 – End of public consultation on the DP Q2 2016 – Development of the requirements. Summer 2016 – Tentative publication of draft Consultation Paper on the draft RTS (3 months) End of CP – Jan 2017 – finalisation of draft RTS and submission to the EU Commission

Strong authentication and secure communication: finding a balance between competing demands When developing the RTS on strong customer authentication & secure communication, EBA and ECB will have to make difficult trade-offs between competing demands. 3) Tough security standards vs. Facilitation of innovative industry solutions in the future (which may suggest a high degree of (which may suggest the opposite, i.e. high level prescription in the requirements to requirements that provide flexibility across firms & time); avoid circumvention of rules); 2) Tough security standards vs. Customer convenience (which may suggest that payment user (which may suggest the opposite, e.g. one-click payments); should be subject to several security and authentication steps); 1) High degree of interoperability vs. Flexibility for market participants between all ASPSPs and all PISPs/AISPs (which may suggest the opposite, i.e. high level (which may suggest one single standard/ requirements that in turn allow for different market- protocol to be prescribed by the EBA); driven solutions);

Strong authentication and secure communication: finding a balance between competing demands (cont.) Discussion Paper (DP) on the RTS on strong customer authentication and secure communication, EBA & ECB raise questions on five topics. The responses to the DP will be an input to the subsequent development of the RTS, on which EBA & ECB will consult in 2016Q2. Requirements for the strong customer authentication procedure; Exemptions to the application of strong customer authentication; Protection of the payment service users’ personalised security credentials; Requirements for common and secure open standards of communication; and Possible synergies with the regulation on electronic identification and trust services for electronic transactions in the internal market (e-Idas);