The Payment Services Directive 2 (PSD2) David Bell - Barclaycard Commercial Payments Intro Nice to be back – topical Day after England beat Wales in euros Asked to contribute on session on connectivity very excited – central theme Payment can connect every element of the journey When I presented last year it got me thinking about how I didn’t take any cash out over 2 days… New payment methods – collision of trends

What is PSD2? To improve the original PSD1 by increasing consumer rights 1 PSD2 is a new EU regulation that’s coming into effect from January 2018 and is focused on these 3 key principles: 2 To enhance payment security through strong customer authentication (SCA) To allow third parties to access customers’ accounts so they can aggregate data or initiate payments 3

Increasing Customer Rights Helps to standardise payments across the EU Expands the reach of regulated payments to include payments that start, finish or end in the EU Removes surcharging on consumer card transactions Increases the number of institutions covered by regulations From 13th January 2018 all surcharges will be banned for consumer cards and pre-paid consumer products.  Internal Only

Considerations – exemptions and customer journey times Keeping Payments Safe All face-to-face and online transactions will need to be authenticated by Strong Customer Authentication (SCA) using two of the following authentication measures, unless they fall within an exemption: Knowledge (something only the customer knows) – like a password or PIN Possession (something only the customer has) – like a mobile or a card Inherence (something unique to the customer) – like a fingerprint or their behavioural data The Regulatory Technical Standard (RTS) for SCA is next due for update in November 2017 and the implementation deadline is currently set at July 2019 Considerations – exemptions and customer journey times

Allowing third-party account access PSD2 is set to open up the payment market to new services and new providers. That’s because third parties will be able to access account data or initiate payments directly from the customers’ payment account, once they have consent. This will bring about two new payment services: Account Information Service Providers (AISP) – this will aggregate data across multiple providers Payment Initiation Service Providers (PISP) – they’ll be able to push a payment directly from a bank account Points to consider: The RTS that governs this element of PSD2 won’t happen until at least April 2019 Currently there isn’t a framework for liability, chargebacks and reconciliation with respect to PISP and AISPs and this still needs to be defined

The priorities The surcharge ban comes into effect from 13th January 2018 PSD2 could bring more choice, but it could also bring more complexity. We continue to engage with the European Banking Authority (EBA) and UK Regulators to understand how the changes will impact customers. Focus: Getting the balance between managing fraud and minimising disruptions caused by the new authentication requirements Protecting customers and merchants, and their security details, against fraud Developing common and secure open standards for communications between parties in the payments sector

Thank you. Any questions?