The different players in the new PSD2 world E-Payment & SEPA Adviser FINTECH FUTURE - OPEN BANKING. The different players in the new PSD2 world (AISP, PISP, IISP) ADVAPAY Moscow - 2018.06.27 Ugo Bechis E-Payment & SEPA Adviser © 2010 Colt Telecom Group Limited. All rights reserved.

PSD2 RTS address the payment step along the chain Ugo Bechis © 2010 Colt Telecom Group Limited. All rights reserved.

Players’ scope in the payments value chain Many players claim a role in the payment chain On the payment instruments Customer’s ID Money transaction Plastic / HW /SW Data Data capture/storage Execution / clearing What qualifies payment as “money” vs a “non-money” servicing only activity ? Ugo Bechis Ugo Bechis © 2010 Colt Telecom Group Limited. All rights reserved.

EBA RTS qualify the TPPs roles (key points) TPP - Third Party Payment Service providers : 3 categories PISP - Payment Initiation Service Providers : initiating a payment with an instrument at another PSP account, without handling the funds whether or not there is any contractual arrangement between PSP and payer’s ASP AISP - Account Information Service Providers : if customer’s consent to AISP, provide & consolidate payment account(s) transactions info, whether or not a contractual arrangement between AISP and the user’s ASPSP (the Bank). Issuing of Payment Instruments (new definition) : “to provide payment instruments to initiate and process payer’s payment transactions”. Mandatory open access Banks “must grant TPPs unhindered, efficient access to payment account info on an objective, non-discriminatory, proportionate basis” (ref. to Antitrust principles) Ugo Bechis

PSD.2 RTS : focus on ‘payment instrument’ and its ‘issuer’ Issuer od a payment instrument can be a TPP : Licensed P.I., E-Money Institution, Bank Payment Instrument can be a service where payment option are offered (i.e. the wallet) Cfr. Morrison Foerster opinion - 2016.02.01 : “ … PSD2 refers to stage of options’ choice in checkout process itself as “the issuance of a payment instrument”, as opposed to each of the available payment methods. methods. This suggests that the entity that serves up this part of the checkout process is itself the issuer of a payment instrument , to be authorised accordingly … ” A TPP issuing a wallet could bilaterally authenticate its user (as TPP’s customer) via its own SCA or other identifier (eID), without re-addressing the user ASPSP. The TPP issuing the ‘wallet instrument’, hosting the single instruments (cards, SCT) issued by the ASPSPs via bilateral eIDAS autentication with the ASPSP (Bank) could legitimately claim to act on behalf of its user as the owner of the single instruments issued by the Bank Ugo Bechis

PSD.2 RTS - SCA : EP ECON clarifications (03.2017) The EP ECON Committee issued a ‘RTS Scrutiny paper’ with clarifications on p.8, § 6) Third-country payment instruments “When third-country payment instruments used in EU for cross-border transactions, the EU PSP shall make every effort to avoid fraud, but not necessarily applying SCA, if not possible. Cross-border trx are not taken into account for fraud rates, re new Art. 16 RTS. Article 16 – Exemptions “Some services would no longer qualify (e.g. Amazon 1-Click, single authentication) unless they are exempted (Art. 10-18), i.e. : amount, recurrence of beneficiary, TRA Ugo Bechis (*) discussed at the European Parliament ECON meeting - 27.03.2017 © 2010 Colt Telecom Group Limited. All rights reserved.

RTS: SCA implementation : EBA Opinon 13.06.2018 The EBA released an Opinion on SCA, CSC following queries to Competent Authorities (CAs) The application of SCA and two-factor authentication (p.7) (under PSD2) SCA applies to all payments initiated by a payer within the EEA SCA applies on a best-effort basis for cross-border transactions with one leg out of the EEA. In such a case, the liability regime stated by Article 74(2) PSD2 applies. Authentication uses two elements from two different categories, e.g. knowledge (pw) and inherence (fingerprints). An inherence element is typically biometrics, provided they comply with Art. 8 RTS. Card no. , CCV, expiry date is not a knowledge element ‘something only the user knows’ A device is ‘possession’ if confirmed via generation of dynamic validation on the device Ugo Bechis - 2018.06.13_Opinion on the implementation of RTS SCA and CSC (EBA-2018-Op-04)_eba.europa.eu

The access workflow : Regulations - standards Work flow steps EU Regulatory Acts - Standards Entry device authentication PSD.2 & RTS ( PC , Tablet , Phone / Mobile HW , card ) Wallet (physical/mobile/cloud) PSD.2 ID + credentials to wallet/Instruments e-IDAS + RTS ( e-ID + biometric > Token > two factor credentials) Payment initiation, info TPP-to-Bank RTS / eIDAS Account holder/payment data intelligence PSD.2 / GDPR Ugo Bechis © 2010 Colt Telecom Group Limited. All rights reserved.

Key factors for customer ownership & use of payments Customer identification at the entry point Info: beavioral, financial, loyalty schemes, commercial Choice of instrument at entry point/wallet > Use of the chosen payment instrument © 2010 Colt Telecom Group Limited. All rights reserved. Ugo Bechis

PSD2 + RTS + EIDAS : impacts on customer relationship PSD2 e-IDAS requirements in the TPP-to-AIPSP domain identify ‘who’ is the gateway where users access the chain 2) PSD2 & RTS + ’instrument definition’ allow choice of instrument at the TPP ‘wallet’ step > > 3) PSD.2: mandatory open access to Banks shifts the point of customer capture at the TPP step > A Bank can be a ‘digital agent’ (‘TPP’) vs other banks PSD2 RTS: Info availability is key for the ‘value’ of entry point © 2010 Colt Telecom Group Limited. All rights reserved. Ugo Bechis

A out-of-EU perspective : Focus points The access player “owns” the customer wallets can operate within or out-of-EU PSD2 rules The big (non-EU) web players will have a choice whether to operate within the EU PSD2 or out of EU jurisdiction A no friction wallet interface, e.g. choice of payment instruments with a ‘one click’ check-out (i.e. 30-60 seconds), info availability, are key SCA exemptions allow it to some degree Cross-jurisdiction Data Protection rules on payment data capture and behavioral data are can influence the choice of jurisdiction Ugo Bechis

PSD.2 Agents/TPP (+Wallet) : Business & Economic Impacts Wallets to be based not only on owner’s direct issuing Wallet owners can claim “broker fees” to host a brand (eg: Google was offered a rebate by a Card Scheme) (eg: ApplePay wallet getst rebates from card Issuers) Wallet instruments ”non-fee” revenues to be enhanced Pre-paid cards benefit from (stable) average float P2P card-to-card allows non-IF fees P2P opened to non-4corner models P2P card-to-card /pre-paid proprietory models P2P based on non-card “internal account” models P2P , card-to-card > lower costs of processing Ugo Bechis © 2010 Colt Telecom Group Limited. All rights reserved.

Last mile Gateways vs Banks : the economics Ugo Bechis 2016.04.22_Digital crack in bankings business model_McK

e-Payments & SEPA Advisor Ugo Bechis e-Payments & SEPA Advisor ugo.bechis@gmail.com Ugo Bechis Ugo Bechis © 2010 Colt Telecom Group Limited. All rights reserved.