Current issues: February 2019

Temporary Permissions Regime for incoming EEA E-money and Payments institutions

In December 2018 the Financial Conduct Authority (FCA) released, as part of its plan to deal with a no deal Brexit, its proposals to introduce a Temporary Permissions Regime (TPR) applicable to EEA inbound electronic money and payment institutions (amongst others). These plans have been published in a consultation paper (CP18/29) and feedback received on this consultation will be published in early 2019. So far, the FCA has only said that it will publish final versions of the TPR "shortly before exit day".

There is also a related second consultation dealing with specific aspects of the FCA's rules that will apply to firms when they are operating from inside the TPR.

EEA electronic money and payment institutions and registered account information service providers passporting into the UK are able to use the TPR and should read these two consultation papers.

PSD2 Customer Authentication in a no deal Brexit

Firms subject to the second Payment Services Directive (PSD2) have been preparing for new European standards for strong customer authentication and for common and secure open standards of communication since early 2018. These detailed, technical standards (or "SCA-RTS" for short) supplement PSD2 by supporting the security and safety of electronic payments. In particular, the detailed European technical requirements necessary to support PSD2 set out two main areas of support: verification and secure communication.

The FCA issued its final policy position on these EU requirements and their UK implementation in December 2018 (PS18/24).

However, the possibility of a no deal Brexit complicates matters for the payments sector because by the time Brexit occurs, on 29 March 2019, only a part of SCA-RTS will be effective in the UK and the balance of the requirements will not be due to come into effect until September 2019, after the UK has left the EU.

Firms preparing to implement SCA-RTS will need to navigate both its numerous requirements as well as the FCA's approach to Brexit.

In focus: No deal Brexit

How would the Temporary Permissions Regime for incoming EEA firms work?

At the point that the UK leaves the EU, in a no deal scenario, it will become a "third country" to the EU. This means that any incoming EEA firm will no longer be able to operate in the UK ("passporting"). To continue as they did before, an incoming EEA firm would need to seek authorisation from the UK regulatory authorities.

In order to mitigate the immediate impact of this, relevant incoming EEA firms passporting into the UK will be able to enter into a TPR that will enable them to continue to operate in the UK after their current passport falls away on 29 March 2019. The regime is intended to provide sufficient time for those firms to seek full UK authorisation.

In order to use this regime, the firm must have submitted a notification to the FCA by the end of the day on 28 March 2019.  The TPR will then come into force at 23:00 on 28 March 2019. The FCA's proposed rules for the TPR were set out in its December 2018 consultation paper CP18/29, followed by a second consultation paper (CP18/36) on certain specific issues.

Incoming EEA PIs, EMIs and RAISPs wishing to continue to provide services in or into the UK should take advantage of the TPR, but should not leave submission of the notifications until the last minute.  They should also review the FCA's CP18/36 in order to identify the changes to conduct and FCA supervision which will take effect on exit day.

For more detail on the TPR, see our separate Insight here.

What would be the impact of a no deal Brexit on UK firms seeking to implement SCA-RTS?

Since early 2018, firms subject to the revised PSD2 have been preparing for new European regulatory technical standards SCA-RTS.

If the UK leaves the EU with no deal, the EU (Withdrawal) Act 2018 will trigger a transfer of EU laws as they stand on that day into UK law (becoming "retained EU law").  However, as of that day, only paragraphs 3 and 5 of Article 30 of SCA-RTS will be in effect so only those provisions will become UK law.

For the payments sector, this scenario presents a great deal of uncertainty.  For example, account servicing payment service providers (ASPSPs), such as banks, have been busy preparing to meet the new requirement to have built testing interfaces for third party providers under open banking by 14 March 2019, the deadline required to meet the specific provisions of SCA-RTS that will already be in effect prior to exit day.

To address this, the FCA has been given powers by regulations made under the EU (Withdrawal) Act 2018 to make a UK version of the SCA-RTS, which will be "substantially in the same form" as the EU SCA-RTS.

The effect of this is that, regardless of the outcome:

• by 14 March 2019 ASPSPs must make documentation available to TPPs specifying the routines, protocols and tools needed by them to allow their software and applications to interoperate with the systems of the ASPSPs.
• from 14 September 2019, all PSPs (unless an exemption applies) will need to ask customers for more information to verify their identity before an electronic payment is made.

The proposals are intended to support an aim of the Payment Services Regulations 2017 to prevent harm caused by payment fraud.  Making the UK-RTS will support strong customer authentication by setting out certain security measures, which will help support market integrity, as well as encouraging open banking.

For further detail, see our separate Insight here.

Dates for the diary