аÄÃÅÁùºÏ²Ê¹ÙÍø¿ª½±

The European Banking Authority (EBA) has published three new Q&As covering transaction risk analysis (TRA), inactivity periods and contingency mechanism exemptions in relation to the EU’s revised Payment Services Directive (PSD2). 

The authority has now published 248 final Q&As on PSD2, having rejected 23, and it still has 19 Q&As under review. 

TRA exemptions

±õ²ÔÌý to a query from a national authority, the EBA clarified the appropriate criteria for calculating fraud rates used to qualify for TRA exemptions. 

Under Article 19 of , fraud rates must be calculated on a rolling quarterly basis, and the EBA confirmed that the fraud rate calculation should be based on the transaction date — the date when the transaction was executed — as opposed to the registration date of the fraud classification. 

According to the banking authority, this ensures that the fraud rate accurately reflects the activities of the quarter in question.

If a fraudulent transaction is discovered after the quarter has ended, the EBA said that payment service providers (PSPs) must assess whether the fraud rate exceeds the threshold for that quarter and, if necessary, report to their competent authority. 

Failure to do so could result in the loss of the TRA exemption.

Inactivity periods

Another ruling  a query from the central bank of Hungary regarding the maximum inactivity period under strong customer authentication (SCA) rules for corporate payments. 

The EBA reaffirmed that although PSPs may be exempt from applying SCA under certain circumstances, such exemptions do not automatically permit extensions to the five-minute inactivity period required under Article 4(3)(d) of Regulation (EU) 2018/389.

PSPs seeking to extend the inactivity period beyond five minutes must introduce additional security measures to maintain equivalent security levels. If these additional measures are not in place, the EBA’s inactivity period must remain capped at five minutes to ensure compliance with PSD2.

Contingency mechanism exemptions

The EBA also provided  on the revocation of contingency mechanism exemptions for account servicing payment service providers (ASPSPs) in the event of prolonged service outages. 

It stated that if an ASPSP’s dedicated interface remains unavailable for more than two consecutive weeks, the national competent authority (NCA) must revoke the exemption from the fallback mechanism under Article 33(7) of the regulation. 

The fallback mechanism ensures that payment service users (PSUs) can continue accessing their accounts and initiating payments during service disruptions. 

The EBA ruled that the NCA must ensure that the ASPSP implements the fallback mechanism within two months, guaranteeing uninterrupted service to users during any future outages.

This issue links with the EU's proposed Payment Services Regulation (PSR), which requires ASPSPs to maintain dedicated interfaces for sharing information with account information service providers (AISPs) and payment initiation service providers (PISPs), restricting them from using the same interfaces as their customers. 

However, ASPSPs will no longer be obligated to provide a "fallback" interface in case the primary one fails. 

The PSR also expands the functionality of these dedicated interfaces, mandating that they must allow PISPs to perform various payment-related actions, such as placing or revoking standing orders and direct debits, initiating single or multiple payments (including to non-listed beneficiaries), and securely communicating payment details. 

In addition, PISPs will be able to verify account holder names and initiate payments using a single SCA, provided specific information is shared with the ASPSP.