The Second Payment Services Directive and its Realization

Open Banking, faster payment transactions and enhancing consumer’s protection – these are just some of the areas that the Second Payment Services Directive (PSD2) focuses on. Two years after coming into force, PSD2 still concerns banks as well as corporations when it comes to the successful realization of its guidelines. Especially connecting banks with Third Party Providers (TPPs) via Application Programming Interfaces (APIs) has yet to be fully accomplished while ensuring quality and security standards. What benefits does PSD2 grant and how far are the respective parties in the implementation process?

Innovative Payment Transactions through PSD2

Having been introduced in two consecutive phases, PSD2 aims at making European payment transactions more innovative, secure and competitive since January 2018.

Its core lies in „Strong Customer Authentication” and opening up payment accounts for TPPs through API connections, also called „Access to Accounts (XS2A)“. Primarily, the directive serves to protect consumers from online fraud but also enables TPPs such as Payment Initiation Service Providers (PISPs) or Account Information Service Providers (AISPs) to access valuable account data of consumers upon their permission. It goes along with faster payment processing as well as increasing competition between payment service providers.

What does PSD2 imply for the individual Actors?

Martin Dietz, Managing Partner of ConVista assumes that “PSD2 creates the possibility of a real-time access to account balances and transactions like never before. Payment transactions and cash flow analyses are becoming more transparent and real-time information will have a new role in treasury. It will lead to a profound change in processes that will also affect the banking industry. Real-Time Treasury is becoming more and more realistic.” However, PSD2 has quite different implications for the different actors concerned.

Banks main concern was to enable TPPs access to consumer accounts. Since the directive itself gave only little advice on technical standards for the required APIs, most financial institutions follow the Berlin Group NextGen Standards. Several FinTechs such as ndigit or finAPI also offer their services to support banks with the creation and launch of XS2A APIs. By opening their interfaces to TPPs, the majority of banks see their customer proximity in danger and fear the increasing competition to FinTechs serving their client base. For banks and financial institutions, the challenge is now to adapt their business models as quickly as possible to meet the new requirements and keep their clients close.

Third Party Providers clearly benefit from PSD2 as they are granted access to consumer accounts and information. For this, TPPs need a BaFin license tied to many legal requirements and prerequisites, which demand a high use of resources from the applicants. Additionally, TPPs will need certain certificates, so-called QWACS to prove their integrity and compliance with security standards. In order to simplify this process, many IT specialists such as fintechsystems or BANKSapi offer their own BaFin license as a service to other TPPs which can save them valuable time and money.

For corporates, PSD2 means a simplification and acceleration of payment transactions. Whereas banks were in place as intermediaries between third parties and the corporate itself before, this can now be circumvented through TPPs issuing payments from the client account directly to the company. In addition to that, corporates can use one central Account Information Service Provider to have an overview over all their accounts with different banks. In combination with the strong customer authentication, such a procedure is not only more comprehensive but also more secure and easer to implement.

The Second European Payments Directive PSD2 and its implementation

Continuing Difficulties in the Implementation

Two years after the first implementation phase, many prerequisites for successful realization of the PSD2 are not yet established. Quality of APIs seems to be sufficient by now but they are not being used as extensively as expected. According to a survey of finanz-szene.de, Sparkasse APIs are being used most frequently in Germany. It registers between 500.000 and 600.000 daily accesses followed by Commerzbank, Fiducia and Deutsche Bank. However, it is estimated that this only represents one quarter of all accesses that should have been redirected from old to new, PSD2-compliant APIs thus far. As of right now, there is still the opportunity for banks to keep the old HBCI-APIs as an emergency mechanism. While some banks such as Sparkassen, Volks- and Raiffeisenbanken or Deutsche Bank have started the BaFin required three month test launching phase already in Spring 2020, many others such just recently started.

Current APIs seem to be showing major gaps as well. They are not capable of showing information on over drafting accounts and problems occur in the area of Multiple User Consent, when two TPPs try accessing a client account via the same API specialist.