Innovation and security are two of the driving forces behind the revised Payment Services Directive (PSD2) but disagreement between fintechs and banks must be resolved to achieve an integrated and innovative payments environment for Europe. BNP Paribas's Alain Bénédetti, who is also co-Chair of the Euro Retail Payments Board (ERPB) working group on Payment Initiation Services (PIS), recently discussed these issues in an interview with the European Payments Council (EPC). Several interesting points came out of the conversation, which is reported in full on the EPC website. 

Some important issues to resolve

Bénédetti pointed out three areas that need to be resolved before the ERPB's final report is presented in November 2017:

1. There is a need for an operational register to include the elements that must be verified when a third party payment service provider (TPP) connects to an account servicing payment service provider (ASPSP).
2. There is also a need to clarify the issue of liability – the ERPB says this should be provided by the European Banking Authority (EBA).
3. Will payment initiation services providers (PISPs) be able to assess risk by sifting through payment service users’ (PSU's) data, and second, who would provide the user interface to the PSU?

PSD2's biggest challenge

Bénédetti also acknowledged that establishing a mutual understanding between the TPPs and the ASPSPs was a considerable challenge. There is an ongoing disagreement between the two sides – essentially fintechs on one side in disagreement with banks on the other – about the nature and extent of allowing TPPs to access bank account data in a process known as direct access or 'screen scraping'. There is currently disagreement on the interpretation of the PSD2 text on this area, with debate around customer security, identity authentication and liability for payment initiation. CTMfile has covered this topic previously:

• Fintechs and banks clash over ‘screen scraping’
• Why banks want a ban on ‘screen-scraping’
• European fintechs ask EC to amend PSD2 technical standards

Next steps towards PSD2

The ERPB is due to present its final report on PSD2 in November 2017. Before then it will follow up on some of the recommendations of the first phase. Bénédetti says it will take into account the finalisation of the EBA regulatory technical standards (RTS) on strong customer authentication (SCA) and secure and common communications, as well as the clarifications to be provided by both the EBA and European Commission.

According to Bénédetti, an important future step for PSD2 will be to put in place the Application Programming Interface (API) governance. This will come after the publication of the ERPB's November report.