How is COVID-19 affecting regulation in the payments industry?

The UK's financial services regulators, industry bodies and market participants all have a part to play in ensuring that firms are prepared to meet the challenges coronavirus poses to customers and staff, and to mitigate the impact of the virus on the UK's economy. In this Insight, we highlight the regulatory changes being implemented in recognition of the role that the payments industry has.

New contactless upper limit

Should we be worried about the spread of Covid-19 through handling cash? Using the ATM? Punching our PIN number into the chip and PIN device? Whilst the Bank of England says there is no need to disinfect notes (as was done in China), the World Health Organisation has warned against using cash and has recommended moving to contactless payments as a method of avoiding contagion.

Political pressure has been mounting on the UK's financial services industry to increase the current limit of £30 on contactless transactions in response to the current coronavirus crisis. The industry has now responded with an announcement from UK Finance on 24 March 2020 confirming that the spending limit for contactless card payments will be increased from £30 to £45. The British Retail Consortium, Barclaycard and Mastercard all support the increased threshold which will allow more customers to make payments without touching card terminals or handling cash.

Timeframe

This is not a new idea. Work on increasing the upper limit has been ongoing as part of a two-year programme, and follows similar increases in several other European countries over the past week. The rationale for choosing £45 is that it is roughly equivalent to the €50 limit in the Strong Customer Authentication Regulatory Technical Standards (SCA RTS) Article 11 exemption (see below), which is already incorporated into issuer systems.

The change will be rolled-out nationally commencing 1 April 2020. The focus of acquirers will initially be on supermarkets and pharmacies. There is a question mark over whether the change should also be expedited for petrol stations.

Terminal manufacturers have indicated that they can be ready with software updates in a matter of days. Whilst retailers are generally supportive and able to move quickly to implementation, increasing the upper limit requires system changes at a time when the larger supermarkets are already battling higher volumes and longer queues. Where retailers are operating at peak capacity, the roll out is likely to take longer.

Assistance from UK Finance

We understand that UK Finance are proposing a weekly call with members and merchants to help work through the changes and address any key issues. This will also keep issuers updated in respect of imminent merchant implementations.

Looking further ahead, UK Finance will take forward discussions around amending or delaying the cumulative SCA counters in the Article 11 exemption, of €150 and 5 transactions and reviewing the limit of £35 in regulation 77(1) of the Payment Services Regulations 2017.

Regulatory forbearance

Strong Customer Authentication

Currently, all firms processing contactless card transactions are required to have appropriate systems and controls in place so that all contactless payments meet the conditions to apply for an exemption under Article 11 of the SCA RTS (Contactless Payments at Point of Sale). This requirement came into force on 14 March 2020, having been delayed from 14 September 2019 to allow all parts of the card payment ecosystem more time to get ready.

The payments industry has been considering what impact the implementation of the rules on SCA (which will require more frequent step ups to PIN and physically touching keypads) could have in a contagion situation.  In circumstances where the benefits of a further extension of the adjustment period in respect of contactless transactions are likely to be relatively small, and could lead to greater systematic risk, regulatory forbearance is unlikely to be sought at this stage.

On 25 March 2020 the European Banking Authority (EBA) announced that it will support issuing and acquiring payment service providers’ efforts to focus on their customers, by removing their National Competent Authority’s obligation to report by 31 March 2020 their readiness to meet the strong customer authentication requirements for e-commerce card-based transactions. The EBA will continue to monitor events and assess whether additional measures need to be taken.

EU-level requests

Meanwhile, the European Banking Federation is seeking extensions for upcoming deadlines for reporting and legislative obligations (such as EBA fraud reporting, reporting of SCA migration milestones, and the entry into force of certain imminent requirements of the Second Cross-Border Payments Regulation). Obligations with a longer timeframe for implementation such as the overall SCA migration and T2/T2S consolidation will be assessed at a later stage.

New FCA 'Rapid Response Unit'

Following on from the FCA's announcement that it has dedicated significant resources focused on its response to Covid-19, the regulator has now set up a 'Rapid Response Unit' within its payments department. This new unit is focussed on identifying emerging risks within the payments sector, as well as identifying firms where harm may already be occurring.

The FCA appears to be focusing its attention on those firms it has identified as being higher risk using a range of indicators to identify emerging risks (including financial risk), and has made extensive requests for financial information and documentation to be produced by these identified firms within a relatively short timeframe.  These requests include information on losses being incurred, the firm's cashflow and liquidity position, and details of its regulatory capital, safeguarding and management information.

Confirmation of Payee deferred

On 20 March 2020, the PSR released an update on Confirmation of Payee (CoP), advising the directed banks that:

• they must take appropriate steps to roll out CoP, taking into account the impacts of Covid-19, even if that means they do not meet the original 31 March 2020 deadline;
• the PSR expects the directed banks to ensure customers who would have benefited from the protections of CoP are not otherwise disadvantaged from any Covid-19 related delay, including refunding victims of fraud if CoP would have prevented it from happening; and
• the PSR will not take any formal action in respect of delays to the introduction of CoP ahead of 30 June 2020 and will keep these arrangements under review as the wider impacts of Covid-19 are better understood.

Notwithstanding this deferral, the PSR has stressed that the directed banks are still expected to do everything they can to protect people and implement CoP as soon as possible.

Consultations and calls for input deferred

The FCA has announced that it will be delaying or postponing activity which is not critical to protecting consumers and market integrity in the short-term, thereby allowing firms to focus on supporting their customers during the current crisis. One of the immediate steps the FCA has taken is to extend the closing date for responses to various open consultation papers and calls for input until 1 October 2020. This includes:

• CP19/32: Building operational resilience: Impact tolerances for important business services.
• CP20/1: Introducing a Single Easy Access Rate for cash savings.
• Call for Input on Open Finance.

The FCA has also decided to delay publication of (among other things) its vulnerability guidance and research and Consumer Credit Act review, which were due before the end of June 2020.

Key workers in financial services

As part of the UK government's package of measures to tackle the spread of Covid-19, schools are being asked to continue to provide care for a limited number of children whose parents are critical to the coronavirus response and cannot be safely cared for at home. This includes parents who work in financial services and are needed for the provision of essential financial services ("key financial workers").

On 20 March 2020, the FCA set out guidance on the steps firms should take to help identify key workers in financial services:

• A key financial worker is an individual at a dual-regulated, FCA solo-regulated or PSR-regulated firm, or an operator of financial market infrastructure, who fulfils a role which is necessary for the firm to continue to provide essential daily financial services to consumers, or to ensure the continued functioning of markets.
• Firms are best placed to decide which staff are essential for the provision of financial services. To help firms identify who they are, firms should:
  • First, identify the activities, services or operations which, if interrupted, would be likely to lead to the disruption of essential services to the real economy or financial stability.
  • Second, identify the individuals that are essential to support these functions.
  • Third, identify any critical outsource partners who are essential to continued provision of services, even where these are not financial services firms.

The FCA has stated that it expects only a limited number of people to be identified as being key financial workers, and has provided a list of the types of roles that may be considered as providing essential services. This includes: individuals captured by the Senior Managers and Certification Regime, persons essential in the running of online services and processing and those essential to the functioning of payments processing and of cash distribution services.

The FCA has recommended that the Chief Executive Officer Senior Management Function (SMF1) is accountable for ensuring an adequate process so that only roles meeting the definition are designated. For firms that do not have an SMF1 Chief Executive Officer this will be the most relevant member of the senior management team.