Irish ecommerce chief welcomes grace period to avoid PSD2 'chaos'

The chairman of Ireland’s ecommerce alliance has welcomed the news that a grace period will apply to the EU’s PSD2 directive in order to allow Irish businesses to get up to code, saying the alternative would be “absolute chaos”.

The European directive, known as PSD2, will go live on Sept 14, with bodies such as the Banking and Payments Federation Ireland (BPFI) running awareness campaigns calling on Irish consumers to be aware of what’s coming and to prepare accordingly.

Last month, the Central Bank acknowledged the problems around the directive from an Irish perspective and said that a “limited migration period” would be put in place in order to allow Irish businesses adjust to the coming regulation.

That migration period is understood to be 18 months long (although official confirmation from the Central Bank has not yet been released) and applies to ecommerce transactions only, at the end of which businesses will be expected to have their house in order or face the consequences.

Two-step verification is by now commonplace in order to clamp down on verification fraud, and the coming Payment Services Directive aims to apply such security measures to how financial institutions and online traders deal with their customers.

The new security measures, known as Strong Customer Authentication (SCA), will see changes apply to how end users experience logging onto their mobile banking and online shopping portals from Saturday next.

“If this applied across the board from Sept 14 we would be facing absolute chaos, no kidding, that was what we were facing,” Niall Bodkin, chairman of the Ecommerce Association of Ireland, told the Irish Examiner.

“To a man we gave up our summer to get this ready, it’s of critical importance. Do it right is our message, and test your changes. You need to get this right for your customers.”

Mr Bodkin explained that at the start of the summer Irish businesses were in a heightened state of unawareness of what was coming down the tracks, despite PSD2 first being introduced as a concept two years previously: “We started our own campaign in late June because we realised we had to do something. Specifically we got onto at least 120 developers and got them aware of what needed to be done. Nonetheless the fear remains that developers will leave it until the last minute of the 18 months and that won’t be good enough.”

The most obvious way in which Irish consumers will be affected by PSD2 is in their dealings with their credit institution online.

For some time now Irish banks and other financial institutions have been messaging customers urging them to clarify security details such as their mobile phone number ahead of the go-live date next Saturday.

Those who neglect to do so may find themselves locked out of their bank accounts from that date, with no obvious route to remedy the problem short term.

A report commissioned earlier this summer by online payments company Stripe emphasised that Europe’s online economy risk losing as much as €57 billion as a fallout from just one in two businesses being compliant with the new SCA regime.

The new authentication framework is expected to disproportionately impact small businesses, with three in five companies with under 100 employees either not planning on being compliant, unfamiliar with what’s expected, or unsure when they will be ready.

“SCA is unequivocally the single most disruptive event to impact European digital commerce, and many businesses have yet to fully grasp its extensive impact,” Jordan McKee, analyst with 451 Research, said at the time of the report’s launch in early June.