Last year, we framed the buy vs. build debate as a million-dollar question. But as Europe now prepares for a third version of the Payment Service Directive, it seems timely to revisit this topic.
Yet, rather than measuring the pros and cons, let’s look specifically at the build-option through the lens of some important questions.
Or, put another way, do you have a legal department or a legal adviser?
No one can deny that PSD2 was a complex topic. We’ve seen its somewhat “free” interpretation out in the real world, especially with the smaller financial organisations overlooking vital elements of the Directive. But looking at the sheer amount of information on the subject, this isn’t surprising. Since the Directive began enforcement in January 2016, the EBA has supported its implementation by developing six Technical Standards, eight sets of Guidelines, eight Opinions, and more than 200 Q&As.
Now that’s quite a chunk to chew on. As such, once PSD3 appears, it will undoubtedly bring another new layer to SCA, prompting more clarification, setting requirements for transactions currently outside SCA, and introducing means to curb social engineering attacks.
Although security and compliance are two different topics, they share some of the same mindset regarding decision-making. For instance, should you go all in or build the bare minimum? The bare minimum might pass compliance, but will it fend off innovative fraudsters and attackers? Probably not.
Ideally, you should evaluate how strategic the security aspect of your offering is and how sophisticated it should be to meet current threats. To get a reminder into just some of the dangers out there, check out major fraud seen around the world, a 2022 fraud update, or the basics of digital fraud.
You might have the skills, and your team might be ready to take on a tech challenge, but does that mean you should move forward with building? Maybe, but there are still a few risks you need to take into account:
First, you need to look at the complexity of your transaction processes. Remember, it might be different if you are B2C or B2B2C - look at embedded finance providers, where specific flows and integrations are highly complex. Nevertheless, this is what you’re likely working with:
With this in mind, you can now consider:
Unlock updates, insights, and exclusive content delivered to you.
PSD2 is not just about two-factor authentication; It also requires a wrapper (a separate secure execution environment) that secures the authentication process and ensures the dynamic linking is not tampered with.
Here at Okay, topics like these are just a part of our daily discussions. Are you interested in learning more? Please send us an email at hello@okaythis.com. We will be more than happy to have a chat about a particular subject or assist you with SCA-related questions if you’re in doubt.
Happy authenticating!