Global Payment Regulation & Authentication Report 2020

Transcription

1 Global Payment Regulation & Authentication Report

2 Global Payment Regulation & Authentication Update We ve released an update to our Global Payment Regulation & Authentication Report, with analysis of billions of transactions during Q1. Businesses are using authentication more than last year In the run up to the original PSD2 deadline for implementing Strong Customer Authentication (SCA) in September, many merchants were not using authentication on a large proportion of their transactions. In fact, most merchants were only sending the most risky transactions to (3DS) due to the well known negative customer experience and dropout associated with 3DS1. Fast forward to Q1, and the original September deadline for SCA has been extended. Despite the extension, many merchants had already put in a significant amount of work to get ready to use 3DS2. Despite the delay in deadlines, many of the merchants in this analysis are currently already sending a larger proportion of their traffic to 3DS, including many more genuine customers. This can partially explain why more transactions are being d successfully. 3DS2 could be as good as it s promised to be Many of the merchants in this analysis are using 3DS2 when the issuer can support this, and only reverting to 3DS1 as a last resort. Although a lot of transactions were still d using 3DS1, we know that a greater proportion of transactions analysed in Q1 were d using 3DS2. In contrast, almost no transactions were d using 3DS2 in Q2, except when some forward-thinking challenger banks were using 3DS2-style authentication methods. We can expect the move to 3DS2 to continue. On the surface, it looks like 3DS2 could help deliver an improved user experience. Globally, the average time to has reduced from 42 seconds to 37 seconds, with the majority of the EEA countries seeing an even more dramatic improvement. Interestingly, the assumed percentage of frictionless payments (which take 5 seconds or less to ) has also increased across many European countries. This evidence of a better experience with 3DS2 is really encouraging for merchants who are currently sending or plan to send more transactions to authentication.

3 Consumers are more used to authentication It s also very likely that consumers are getting used to authenticating online more often, and have got better at doing it. This is supported by the widespread communications campaigns from issuing banks and merchants to consumers. We also saw coverage of PSD2 in the mainstream media at the end of during the peak shopping period around Christmas. The current situation with the Covid-19 outbreak has also led to more people staying at home and a rise in ecommerce transactions. This could also mean consumers are getting more experience using different authentication methods. High demand and limited supply in some markets may also mean consumers are more invested in a purchase if they do not have the option to buy it in store or on another website, which can also improve authentication success. What does this mean for merchants? The improvement in 3DS acceptance is great news for merchants! Especially those operating in Europe who have started the transition, or who have a solid strategy to move to 3DS2. It s important to make sure that you are ready to use the most advanced 3DS2 versions as soon as possible, in order to optimise your payment authentication to get the best possible. The for Australian-issued cards has also improved, likely as a result of the similar regulation changes. Interestingly, the 3DS for US-issued cards has decreased from 71% to 58%, meaning over two-fifths of payments sent to 3DS fail. This could be a result of the tightened measures elsewhere leading fraudsters to focus on the less secure US market. It s important to keep in mind that although the s have improved, they are not at 100%. The global average of 87% means 13% (or 1 in 7) payments sent to 3DS are lost. Of course this will include some fraud, but there are also a number of factors which could be behind this other than fraud such as customer drop off, server error, 3DS1 experience. The ultimate goal is to get as close to 100% acceptance as possible. Even if it is a vast improvement, 3DS still carries a cost and applying it on every transaction will add up fast. Even with the improvements we ve seen, leading merchants will benefit from using exemptions from authentication.

4 Next steps - keep tabs on issuers and prepare for exemptions Issuing banks are going to be ready with the 3DS versions at different stages, and it s critical to know what the issuer can support when sending the authentication request. For example, if you have enough data to prove a transaction is low-risk and the issuer is offering 3DS2, it s far better to use an exemption and avoid authenticating. Likewise, if the issuer has a history of rejecting low-risk exemption requests, sending the transaction to 3DS will save you from incurring a soft-decline and speed up the checkout process. It s likely that exemptions will be the next big focus for leading merchants who want to optimise their authentication and derive the most benefit. It s now common for card schemes to ask a consumer if they want to whitelist specific merchants after transactions - we expect to see more activity like this. At Ravelin, we re busy collecting valuable issuer intelligence to inform our client s decisions and support authentication requests with reliable data. Contents Background on PSD2 5 Global statistics 7 Europe 8 Asia & Australia 40 North America 44 South America 47 Africa 49 Global status table 51

5 Background on PSD2 & online payment regulation Worldwide trends in increasing payment regulation and 2 In, Europe s Revised Payment Services Directive (PSD2) dominated the conversation around payment regulation. However, there are a number of countries with parallel regulations already in place or in plan. For example, Australia Pay Network s CNP Fraud Mitigation Framework was released on 1st July. With similar conditions to PSD2, the framework requires two-factor authentication when a merchant's fraud rate is above the recommended rate for two consecutive quarters. Alongside formal directives, EMVCo has released 2 authentication method- a significant improvement on its predecessor which will impact the success of authentication. 2 will be rolled out worldwide throughout and will impact on the North American ecommerce market. The map covers the regulations and conditions for the major ecommerce markets worldwide. We will continue to research and add new countries to the map and report. Background on PSD2 PSD2 is a set of laws and regulations for payment services in the European Union (EU) and the European Economic Area (EEA). PSD2 was passed by the European Banking Authority (EBA) in 2015 and then transposed into local laws later by each country. The most important aspect for ecommerce merchants is the requirement for Strong Customer Authentication (SCA). In practice, this requires two-factor authentication () on many payments over 30 which start and end in the EEA. This is a huge change from the current authentication trends with most merchants authenticating only the riskiest payments. This sudden change in the terms for millions of payments could cost Europe s online economy millions. EBA s decision to delay the implementation of strong customer authentication Originally, this was due to come into effect on 14 September. However, the EBA has allowed for a grace period due to concerns over the impact on the economy and the fact that many merchants and payment providers are not prepared for the change.

6 The EBA had good intentions, and in some ways, more time to adjust to the new payment conditions is a blessing. But it s not as clear-cut as that - the EBA has given power to each local National Competent Authority (NCA) to set their own timetables. The EBA has now set a final deadline for SCA compliance of 31st December, however several states have extended full compliance past that date to March 2021 (for example France, UK). This means there will be a range of different approaches to SCA and across Europe for months. How this delay impacts merchants and payment providers The range in approaches is a massive challenge for merchants and payment providers. It makes the decision about whether to use 3DS more difficult, and means each payment has a higher risk of getting declined. There were calls for a European-wide harmonized delay and the EBA followed up with a Europe-wide final deadline of December 31,. This final deadline will help give the industry a better view of how long the uncertainty will last, but we expect some countries to speed up the implementation process ahead of the final date. Therefore, it s vital to keep an eye on how different NCAs manage payment authentication and when they will enforce SCA. How to use the global online payment regulation map and report The payment regulation map includes up-to-date information on PSD2 implementation for all the countries in the EEA and also includes major online payment conditions and regulations for ecommerce markets globally. We will regularly update, improve and iterate on the map and report to add more information over time. This map is designed to be a source of information on PSD2 and other regulations for online merchants and payment providers. Use it to prepare a strategy for approaching payment authentication and deciding priorities around payment regulations. Our statistics on s offer insight into how the device, card scheme and issuer country affect conversion. As support and usage of 3DS2 increases, we ll collect statistics on differences in acceptance across different versions of 3DS and issuer adoption levels. Ecommerce is increasingly global by nature. We aim to give you clarity on how national approaches to payment authentication will affect your global business. To do this, we ve focused on the regulation and issuer statistics for each country, but this report doesn t share insight into how consumers approach authentication.

7 Global Statistics 13% 87% 4% 30% 70% 6% Top cards by volume acceptance acceptance by device channel STATS STATS 87% 87% 79% 76% Phone 85% 91% 92% 78% Tablet 90% 96% 97% 86% Computer 79% 66% 36% 35% 11%

8 Europe

9 Austria National Competent Authority Financial Market Authority The FMA has announced it will postpone the implementation of SCA in Austria for Austrian-issued cards until a joint European deadline is agreed- now set to December 31,. Payment providers are expected to provide the FMA with migration plans. 9% 91% 4% 36 30% 70% 3% 52 Invoice 28% 31% 15%

10 Belgium National Competent Authority National Bank of Belgium The National Bank has announced it will release a migration plan and support a delayed final delivery date of December 31,. From 25 August, non-compliant transactions over 1500 will be soft declined. This will be gradually reduced to 0 by 17th November. From 31 December, Belgium adheres to the EBA deadline for SCA enforcement. 86% 14% 54 14% 28% 70% 3% 52 16% 43% 21%

11 Bulgaria National Competent Authority Bulgarian National Bank The National Bank has acknowledged the EBA opinion. It missed the original deadline to put PSD2 into law, which means the implementation of SCA is likely to be delayed. The regulator has not publicly commented on timescales or migration. GLOBAL AVERAGE 11% 88% 4% 36% 64% 6% Mobile 2% 16% 80%

12 Croatia National Competent Authority Croatian National Bank for Credit Institutions and Croatian Financial Services Supervisory Agency for Investment Firms The regulator has not publicly commented on timescales or migration. GLOBAL AVERAGE 17% 88% 4% 37 3% 69% 41 6% Mobile 9% 22% 61%

13 Czech Republic National Competent Authority Czech National Bank The regulator r is in the process of analysing market readiness and has not publicly commented on timescales or migration. GLOBAL AVERAGE 4% 83% 4% 19% 81% 6% % 76% 8%

14 Denmark National Competent Authority Danish Financial Supervisory Authority (Finanstilsynet) The regulator has announced The regulator has announced that SCA will be delayed by 18 months, until March % 95% 13% 14% 86% 2% % 50% 10%

15 Estonia National Competent Authority Financial Supervision Authority (Finantsinspektsioon) The regulator is continuing preparations to ensure payment providers are ready for the SCA deadline. There has been no public indication of a delay. GLOBAL AVERAGE 7% 93% 4% 9% 91% 6% Mobile 48% 31% 10%

16 Finland National Competent Authority Finanssivalvonta (Fin-FSA) The regulator has set up a PSD2 Monitoring Group to discuss interpretation issues and give guidance. They will be delaying enforcement of SCA and FIN-FSA will adhere to the EBA deadline of 31st December. 9% GLOBAL AVERAGE 91% 14% 86% 4% 6% % 30% 33%

17 France National Competent Authority French Prudential Supervision and Resolution Authority (Autorité de contrôle prudentiel et de Resolution) The regulator has announced a a three-year migration plan. From 1st April, issuers will implement soft declines and deploy TRA exemption. Official activation of soft declines will apply from 1st November and from 31st March 2021 all non-compliant transactions will be rejected. 11% 89% 21% 16% 84% 4% % 37% 14%

18 Germany National Competent Authority Federal Financial Supervisory Authority (BaFin) and Bundesbank BaFin has announced that Germany will de delaying enforcement to 31st December to align with the EBA. 15% 85% 27% 29% 71% 22% % 12% 28%

19 Greece National Competent Authority Bank of Greece The Bank of Greece has announced that it will will adopt the EU-wide time frame (December 31, ). Firms will be provided to provide migration plans to the Bank of Greece. GLOBAL AVERAGE 9% 91% 4% 31% 69% 6% Cash on delivery 54% N/a N/a

20 Hungary National Competent Authority Central Bank of Hungary The Central Bank has announced it will allow a 12-month transition period from the original deadline before SCA is enforced. This would mean SCA will be applied from 14 September. GLOBAL AVERAGE 15% 85% 4% 37 31% 41 69% 6% Cash on delivery 54% N/a N/a

21 Iceland National Competent Authority Financial Supervisory Authority Iceland is a state in European Free Trade Association and accepts legislation through a different process. The regulator is monitoring the situation and will aim to harmonise other regulators. GLOBAL AVERAGE 23% 85% 4% 15% 85% 6% Prepaid cards 2% 92% 2%

22 Ireland National Competent Authority Central Bank of Ireland The Central Bank supports a migration period and will adhere to the EBA deadline of 31st December. 6% 94% 1% 33 22% 78% 27 2% Bank transfer 9% 57% 23%

23 Italy National Competent Authority Bank of Italy (Banca d'italia) The Bank of Italy will grant an extension for a limited period based on the EBA final deadline of December 31,. 10% 90% 3% 27% 73% 5% % 29% 33%

24 Latvia National Competent Authority Financial and Capital Market Commission (FKTK) The regulator has not publicly commented on timescales or migration. GLOBAL AVERAGE 8% 94% 4% 37 12% 88% 41 6% Mobile 39% 43% 14%

25 Liechtenstein National Competent Authority Financial Services Authority The regulator has not publicly commented on timescales or migration. GLOBAL AVERAGE 13% 87% 4% 37 GLOBAL AVERAGE 23% 41 77% 6% Prepaid cards 57% 22% 14%

26 Lithuania National Competent Authority Bank of Lithuania They have announced a migration period, and asks that anyone who needs time to migrate should present a detailed plan. No specific timelines have been announced. GLOBAL AVERAGE 17% 83% 4% 37 27% 73% 51 5% Mobile 51% 37% 10%

27 Luxembourg National Competent Authority Commission de Surveillance du Secteur Financier The regulator has asked all PSPs to be SCA ready by 31st December. GLOBAL AVERAGE 15% 85% 4% 23% 77% 6% % 27% 10%

28 Malta National Competent Authority Central Bank of Malta and Malta Financial Services Authority The Central Bank has announced it will delay implementation to 31st December and is working on a migration plan. GLOBAL AVERAGE 14% 86% 4% 19% 81% 6% % 58% 33%

29 Netherlands National Competent Authority De Nederlandsche Bank From 1st April, und, high-risk transactions will start to be soft declined.from September, issuers will gradually introduce SCA compliant behaviour. The Netherlands adheres to the EBA deadline for full SCA enforcement of 31st December. 6% 94% 11% 31% 69% 6% % 12% 10%

30 Norway National Competent Authority Financial Supervisory Authority of Norway (Finanstilsynet) The regulator will have a limited enforcement extension. Banks will need to contact the regulator in order to secure this delay. 11% 89% 23% 17% 83% 10% % 47% 18%

31 Poland National Competent Authority Polish Financial Supervision Authority The regulator has announced it will delay enforcement of SCA, likely to comply with the final EBA deadline of 31st December. 11% 89% 4% 34 25% 75% 53 4% 52% 20% 17%

32 Portugal National Competent Authority Banco de Portugal The regulator has announced it will delay SCA enforcement and is expected to comply with the EBA final deadline of December 31,. GLOBAL AVERAGE 6% 94% 4% 37 29% 71% 41 6% 41% 24% 17%

33 Republic of Cyprus National Competent Authority Bank of Cyprus The CBC will not enforce action against any non-compliant transactions processed up until 31st December. GLOBAL AVERAGE 4% 96% 4% 37 28% 72% 41 6% Prepaid cards Mobile 60% 17% 18%

34 Romania National Competent Authority National Bank of Romania The regulator has not publicly commented on timescales or migration. There was a delay implementing PSD2 into local law, which could mean that there will be delayed implementation of SCA. GLOBAL AVERAGE 6% 94% 4% 37 20% 80% 40 8% Cash on delivery 24% 56% 10%

35 Slovakia National Competent Authority National Bank of Slovakia The regulator has not publicly commented on timescales or migration. GLOBAL AVERAGE 4% 96% 4% 37 18% 82% 41 6% Cash on delivery 16% 42% 32%

36 Slovenia National Competent Authority National Bank of Slovenia The regulator has announced they will delay enforcement of SCA and will release more details before the end of. GLOBAL AVERAGE 16% 84% 4% 37 35% 41 65% 6% Prepaid cards Mobile 63% 10% 17%

37 Spain National Competent Authority Banco de España The regulator has released a migration plan which expects harmonisation by November, and is expected to comply with the final EBA deadline of 31st December. 8% 92% 8% 37 28% 72% 39 7% 13% 39% 30%

38 Sweden National Competent Authority Financial Supervisory Authority (Finansinspektionen) The FSA has acknoeledged the EBA opinion on the delay, but SCA enforcement is expected to apply from 14th September. Individual issuers and acquirers can apply to the FSA for more time to comply and this will be granted on a case-by-case basis. 13% 87% 10% 29 14% 38 86% 17% Buy Now Pay Later 25% 30% 20%

39 United Kingdom National Competent Authority Financial Conduct Authority The FCA have confirmed they will delay full enforcement until 14 September 2021, a 6 month extension from the original deadline in the plan due to the disruption caused by Covid-19. UK Finance has developed a rollout plan on behalf of the FCA, which has staggered deadlines from February 2021 to ramp up to full SCA enforcement from September % 91% 1% 30 24% 76% 3% 29 6% 52% 29%

40 Asia & Australia

41 Australia National Competent Authority Reserve Bank of Australia and the Australian Payments Network (AusPayNet) AusPayNet released the CNP Fraud Mitigation Framework on 1st July, which is very similar to Europe's PSD2. This requires SCA when a merchant's fraud rate is above the recommended rate for two consecutive quarters. 17% 83% 1% 30% 79% 2% % 46% 22%

42 China National Competent Authority China's Central Bank The majority of transactions are mobile payments made by QR code. Since 2017, QR code transactions above 500 yuan are subjected to additional security checks. 24% 76% 8% 48% 52% 12% % 16% 71%

43 India National Competent Authority Reserve Bank of India Two-factor authentication is required for all domestic debit and credit card transactions over Rs GLOBAL AVERAGE 13% 87% 4% 37 32% 41 68% 6% 16% 33% 32%

44 North America

45 Canada National Competent Authority Department of Finance No regulation has been announced yet. The card schemes have announced the introduction of 2.0 to replace 1.0 from -. 31% 69% 11% 17 32% 17 68% 10% 11% 65% 18%

46 USA National Competent Authority Department of Finance No regulation has been announced yet. The card schemes have announced the introduction of 2.0 to replace 1.0 from -. 42% 58% 29% 29% 71% 11% % 51% 24%

47 South America

48 Brazil National Competent Authority Brazilian Central Bank Two-factor authentication is required on transactions made using domestic-issued debit cards within Brazil. 22% 78% 43% 25 58% 54 42% 20% Postpay 16% 60% 11%

49 Africa

50 South Africa National Competent Authority Payment Association of South Africa Since 2014, all ecommerce merchants are required to implement on all credit card transactions. GLOBAL AVERAGE 22% 78% 4% 37 45% 41 55% 6% 20% 41% 17%

51 Global Europe Austria The FMA announced it will postpone the implementation of SCA in Austria for Austrian-issued cards until a joint European deadline is agreed - now set to December 31,. Payment providers are expected to provide the FMA with migration plans. Belgium The National Bank has announced it will release a migration plan and support the delayed final delivery date of December 31,. Bulgaria The National Bank has acknowledged the EBA opinion. It missed the original deadline to put PSD2 into law, which means the implementation of SCA is likely to be delayed. The regulator has not publicly commented on timescales or migration. Croatia The regulator has not publicly commented on timescales or migration. Czech Republic The regulator is in the process of analysing market readiness and has not publicly commented on timescales or migration. Denmark The regulator has announced that SCA will be delayed by 18 months, until March Estonia The regulator is continuing preparations to ensure payment providers are ready for the SCA deadline. There has been no public indication of a delay. Finland The regulator has set up a PSD2 Monitoring Group to discuss interpretation issues and give guidance. They will be delaying enforcement of SCA. France The regulator has announced a three-year migration plan, with the final date for non-compliant transactions to be rejected 31st March Germany Greece Hungary Germany will de delaying enforcement to 31st December to align with the EBA. The Bank of Greece has announced that it will will adopt the EU-wide time frame (December 31, ). Firms will be provided to provide migration plans to the Bank of Greece. The Central Bank has announced it will allow a 12-month transition period from the deadline before SCA is enforced. Iceland Iceland is a state in European Free Trade Association and accepts legislation through a different process. The regulator is monitoring the situation and will aim to harmonise other regulators. Ireland The Central Bank supports a migration period and will adhere to the EBA deadline of 31st December. Italy Latvia The Bank of Italy will grant an extension for a limited period based on the EBA final deadline of December 31,. The regulator has not publicly commented on timescales or migration.

52 Global Europe continued... Liechtenstein The regulator has not publicly commented on timescales or migration. Lithuania Luxembourg Malta The regulator has not publicly commented on timescales or migration. There will be a delay beyond the 14th September deadline. The regulator is expected to comply with the EBA final deadline of December 31,. The Central Bank has announced it will delay implementation to 31st December and is working on a migration plan. Netherlands Most industry players are expected to be ready for the September deadline, as a form of SCA already exists in the Netherlands. The regulator has acknowledged the transition period and will be working on a roll-out plan. Norway The regulator will have a limited enforcement extension. Banks will need to contact the regulator in order to secure this delay. Poland There was a delay implementing PSD2 into local law, and the regulator will have a limited enforcement extension. Banks will need to contact the regulator in order to secure this delay. Portugal Republic of Cyprus The regulator has announced it will delay SCA enforcement and is expected to comply with the EBA final deadline of December 31,. The regulator has not publicly commented on timescales or migration. However, it has announced new authentication security measures for logging into 1bank, an online banking platform. Romania The regulator has not publicly commented on timescales or migration. There was a delay implementing PSD2 into local law, which could mean that there will be delayed implementation of SCA. Slovakia The regulator has not publicly commented on timescales or migration. Slovenia The regulator has announced it will delay enforcement of SCA, likely to comply with the final EBA deadline of 31st December. Spain The regulator has released a migration plan which expects harmonisation by November, and is expected to comply with the final EBA deadline of 31st December. Sweden The FSA has confirmed that no general transition period will apply, as the Swedish market already has SCA-compliant solutions available. Individual issuers and acquirers can apply to the FSA for more time to comply and this will be granted on a case-by-case basis. United Kingdom The FCA have confirmed they will delay full enforcement until 14 September 2021, a 6 month extension rom the original deadline in the plan due to the disruption caused by Covid-19. UK Finance has developed a rollout plan on behalf of the FCA, which is expected to be updated to reflect this new date.

53 Global Asia & Australia Australia AusPayNet released the CNP Fraud Mitigation Framework on 1st July, which is very similar to Europe's PSD2. This requires SCA when a merchant's fraud rate is above the recommended rate for two consecutive quarters. China The majority of transactions are mobile payments made by QR code. Since 2017, QR code transactions above 500 yuan are subjected to additional security checks. India Two-factor authentication is required for all domestic debit and credit card transactions over Rs North America Canada No regulation has been announced yet. The card schemes have announced the introduction of 3D Secure 2.0 to replace 1.0 from -. USA No regulation has been announced yet. The card schemes have announced the introduction of 3D Secure 2.0 to replace 1.0 from -. South America Brazil Two-factor authentication is required on transactions made using domestic-issued debit cards within Brazil. Africa South Africa Since 2014, all ecommerce merchants are required to implement two-factor authentication on all credit card transactions.

54 Thank you for reading This report will be updated periodically to reflect the most recent announcements on PSD2 and global payment regulation. If you think something is missing from the report please get in touch here. Report sources Ravelin transaction data collected in Q2-Q3 and Q