The European Banking Authority (EBA) granted an extension to the original 2019 deadline by accepting a gradual implementation process, allowing many countries to enforce SCA regulations in phases. 

Now this extension has come to an end, especially since so many European countries were able to properly enforce the new regulations as of December 31st, 2020. In these countries, two-factor authentication has been mandatory for all online purchases, and one-time passwords by SMS are no longer considered a safe authentication factor. 

However, there are still a few EU/EEA countries that have needed the extension to carry over into 2021 and 2022:

United Kingdom: After announcing a new extension in May 2021, the Financial Conduct Authority (FCA) has settled on a final SCA for the UK on 14th March 2022.

France: The French Banque de France has chosen an SCA enforcement that can be done in phases based on transaction value. All transactions should be SCA compliant by 31st March 2021.

Germany: The German BaFin is enforcing SCA in accordance with a ‘ramp-up plan’ based between mid-January 2021 and mid-March 2021. All transactions in Germany should be SCA compliant by 15th March 2021.

Italy: Banca d’Italia has chosen to enforce SCA in stages during the first quarter of 2021. So by the end of Q1, or April 1st, all Italian transactions will have to be SCA compliant.

Spain: Banco de España is enforcing SCA in stages. All transactions are subject to SCA compliance starting 1st March 2021. 

Belgium: The National Bank of Belgium (NBB) has set the final deadline for SCA compliance on 18th May 2021. 

Ireland: The Central Bank of Ireland has announced that SCA will be fully enforced in Ireland starting 1st July 2021. 

Denmark: Nearly making the 2020 cut-off, the Danish Finanstilsynet decided to give their payment industry a few extra days to get their SCA processes in order, and didn’t start full enforcement of SCA until 11th January 2021. 

Austria: In Austria the final deadline for Issuers to become fully SCA compliant is 15th March 2021. 

Switzerland: Switzerland is the last country (together with the UK) to fully enforce SCA. Swiss issuers have until 15th September 2021 to become compliant.

The following countries did make the 2020 cutoff, and were operating under fully enforced SCA regulations by the beginning of 2021:

• Bulgaria
• Cyprus
• Czech Republic
• Finland
• Greece
• Hungary
• Lithuania
• Luxembourg
• Malta
• Norway
• Poland
• Portugal
• Romania
• Slovenia
• Sweden

By having a bit of extra time before SCA compliance is fully enforced, the payment industry in countries such as the United Kingdom and Switzerland have the advantage of learning from other markets. Looking at some of the countries where SCA has been enforced since the new year, UK and Swiss issuers may be at a slight advantage when it comes to ensuring that their users have optimal online experiences. Perhaps, even, with new technology not available today. Of course, only time will tell.

Are you still looking for an SCA solution to be compliant with the new regulations? Get in touch today! 

Sources: 
1. payment-universe.com/strong-customer-authentication-and-new-deadlines-what-to-do-with-it/
2. https://thepaypers.com/thought-leader-insights/psd2-sca-authentication-requirements-will-bring-about-better-user-experience--1245957