Chris Hill, a partner and head of the fintech team at Kemp Little LLP, discusses changes to payments law.
Payments are something that retailers can’t do without, but often don’t want to have to engage with in too much detail. That is what the banks and payments companies are for. They are paid by the retailers to take care of that side of things so that the retailers can focus on their businesses, improving products and services and looking to create the best possible user experiences.
However, there is a big change on the horizon in payments law. Alongside everything else going on in the world that is making retailers’ lives difficult right now, it could have a big effect on user experience and ultimately cash flow and profit margins.
In March 2021, the new rules on “strong customer authentication” or “SCA” are due to come into force. They aim to reduce fraud and will affect all retailers because they affect all payments other than cash transactions. Retailers need to be aware of them and start preparing for their introduction as soon as possible.
This is quite a big topic, but the main points are as follows:
1. When SCA is in force, unless an exemption applies, customers will have to authenticate every non-cash payment with two of the three factors of something you have; (e.g. a mobile or a payment card), something you know (e.g. a password) and something you are (e.g. a biometric).
2. In practice this is likely to mean that customers will have to use, alongside a payment card, a one-time password sent to them by their bank (which relies on having mobile connectivity). Or, some kind of biometric identification such as fingerprint or facial recognition (on some of the more sophisticated smartphones). Banks have already started applying these rules to an extent and you may have seen requests for such authentication steps over the last few months.
3. The exemptions relevant to retailers mainly revolve around low transaction value (under €30 for remote transactions and €50 for contactless point of sale transactions). However, even then they only apply up to either a cumulative value or a cumulative number of transactions since the last authentication process – meaning that even sellers of low-value items need to grapple with the issue.
4. Whichever way you look at it, it’s another hurdle in the sales process. It is, therefore, likely to have a big effect on retailer revenue. Research from Amazon estimated that each additional click in the purchasing experience increases basket abandonment by 15%.
“Whilst large merchants are mostly aware of SCA, most small and medium retailers are not.”
5. The only real way of preserving customer experience – and therefore revenues – is likely to be the implementation of relatively sophisticated technology that will allow retailers’ and customers’ banks either to use SCA exemptions or otherwise to go through the authentication process but to do so seamlessly. Without this, banks/issuers will take the safe path and just decline more payments.
6. There are various technologies out there that can help with making the authentication process as seamless as possible. Biometric solutions seem to be the front runner in this area. But to use them, you need to be using a payment service provider that supports them. Implementing and testing that technology takes time, arguably at least a year.
7. The main form of tech needed to make this work “well” (3DS v2.2) is to our knowledge not yet available. Even once it is available, it will take time for it to bed in before enforcement kicks in. So, retailers need to move quickly.
8. The Emerging Payments Association has produced an excellent paper on the topic, which is available here. There is a useful table of recommendations for merchants and acquirers in section 9 of the report.
The FCA has already postponed the enforcement of the rules from September 2019 to March 2021; it may well do so again in reaction to the coronavirus pandemic. However, given the scale of the challenge, planning and action by retailers are needed – if not right now then very soon – to make sure that the new deadline doesn’t creep up and get in the way of business.
Chris Hill is a partner and head of the fintech team at Kemp Little LLP, the London law firm.
