Okay LogoOkay Logo
Go back to Okay blog

SCA Deadlines Across Europe

First published: 23/02/2021

updated: 21/10/2022

artifact

We have spoken a lot about strong customer authentication (SCA) over the past year. However, the regulation has technically been in effect since mid-September of 2019. Like many major economic or financial overhauls, change takes time and most European countries have chosen to take a pretty gradual implementation approach. Now well into 2021, it is time for all European countries to fully enforce the updated SCA regulations. Let’s take a look at some of the deadlines.

SCA Deadlines in EU/EEA

The European Banking Authority (EBA) granted an extension to the original 2019 deadline by accepting a gradual implementation process, allowing many countries to enforce SCA regulations in phases. 

Now this extension has come to an end, especially since so many European countries were able to properly enforce the new regulations as of December 31st, 2020. In these countries, two-factor authentication has been mandatory for all online purchases, and one-time passwords by SMS are no longer considered a safe authentication factor

However, there are still a few EU/EEA countries that have needed the extension to carry over into 2021 and 2022:

United Kingdom: After announcing a new extension in May 2021, the Financial Conduct Authority (FCA) has settled on a final SCA for the UK on 14th March 2022.

France: The French Banque de France has chosen an SCA enforcement that can be done in phases based on transaction value. All transactions should be SCA compliant by 31st March 2021.

Germany: The German BaFin is enforcing SCA in accordance with a ‘ramp-up plan’ based between mid-January 2021 and mid-March 2021. All transactions in Germany should be SCA compliant by 15th March 2021.

Italy: Banca d’Italia has chosen to enforce SCA in stages during the first quarter of 2021. So by the end of Q1, or April 1st, all Italian transactions will have to be SCA compliant.

Spain: Banco de España is enforcing SCA in stages. All transactions are subject to SCA compliance starting 1st March 2021. 

Belgium: The National Bank of Belgium (NBB) has set the final deadline for SCA compliance on 18th May 2021. 

Ireland: The Central Bank of Ireland has announced that SCA will be fully enforced in Ireland starting 1st July 2021. 

Denmark: Nearly making the 2020 cut-off, the Danish Finanstilsynet decided to give their payment industry a few extra days to get their SCA processes in order, and didn’t start full enforcement of SCA until 11th January 2021. 

Austria: In Austria the final deadline for Issuers to become fully SCA compliant is 15th March 2021. 

Switzerland: Switzerland is the last country (together with the UK) to fully enforce SCA. Swiss issuers have until 15th September 2021 to become compliant.

Now Fully SCA Compliant

The following countries did make the 2020 cutoff, and were operating under fully enforced SCA regulations by the beginning of 2021:

  • Bulgaria
  • Cyprus
  • Czech Republic
  • Finland
  • Greece
  • Hungary
  • Lithuania
  • Luxembourg
  • Malta
  • Norway
  • Poland
  • Portugal
  • Romania
  • Slovenia
  • Sweden

Watch-Then-Do Advantage?

By having a bit of extra time before SCA compliance is fully enforced, the payment industry in countries such as the United Kingdom and Switzerland have the advantage of learning from other markets. Looking at some of the countries where SCA has been enforced since the new year, UK and Swiss issuers may be at a slight advantage when it comes to ensuring that their users have optimal online experiences. Perhaps, even, with new technology not available today. Of course, only time will tell.

Are you still looking for an SCA solution to be compliant with the new regulations? Get in touch today! 

Sources: 
1. payment-universe.com/strong-customer-authentication-and-new-deadlines-what-to-do-with-it/
2. https://thepaypers.com/thought-leader-insights/psd2-sca-authentication-requirements-will-bring-about-better-user-experience--1245957


Follow us on LinkedIn