# The forgotten half of PSD2
Author:  Pal Sinha, Barnali 
Author URL: https://financedigest.com/author/pal-sinha-barnali
Published: 2022-02-04
Category: FINANCE
Category URL: https://financedigest.com/category/finance
Meta Title: Enhancing Security and Innovation in Open Banking: The
Meta Description: Explore the impact of open banking on the financial sector, the regulations surrounding PSD2, and the importance of authentication for digital trust.
URL: https://financedigest.com/the-forgotten-half-of-psd2html

![undefined](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/istock-1166959376-1736816260753-compressed.jpg)

_By_ **_Amir Nooriala,_** _CCO, Callsign_

![](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/amir-nooriala-cco-callsign-1736816260671-compressed.jpg)

Amir Nooriala, CCO, Callsign

One of the core objectives of open banking is to drive innovation within the financial services sector. While banks continue to be the gatekeepers of all customer account data, the [regulations and mandates around open banking](https://www.financedigest.com/austrian-regulator-orders-system-relevant-banks-to-up-capital-buffers.html "Austrian regulator orders system-relevant banks to up capital buffers") necessitates that these institutions make their data available to any aggregator that connects to it.

However, due to the different requesting organisations wanting to use the data, the gatekeepers need to ensure they’re doing this securely, otherwise this could compromise not only the gatekeeper, but the entire [open banking](https://www.financedigest.com/how-can-open-banking-help-smbs-navigate-the-cost-of-living-crisis.html "How can Open Banking help SMBs navigate the cost-of-living crisis? ") system. The legislation has led to an explosion of new challenger banks, technologies and ecosystems to give consumers greater choice around who they use for their [financial services](https://www.financedigest.com/devops-the-secret-tool-thats-transforming-financial-services.html "DevOps: The Secret Tool that’s Transforming Financial Services"). It also enables [banks to access similarly innovative services](https://www.financedigest.com/axion-swiss-bank-and-avaloq-sign-long-term-contract-for-bpo-services.html "Axion Swiss Bank and Avaloq sign long-term contract for BPO services"), as well as potentially more customers and channels.

However, despite [rising popularity of open banking](https://www.financedigest.com/the-rise-of-the-specialist-bank.html "The rise of the specialist bank"), different regions have taken fundamentally different approaches. The European Union has chosen a more regulatory approach to open banking, passing [PSD2](https://www.ukfinance.org.uk/guidance/payment-services-directive-2-and-open-banking) to level the playing field.

[Despite the activity](https://www.financedigest.com/asias-factory-activity-contracts-despite-chinas-covid-reopening.html "Asia’s factory activity contracts despite China’s COVID reopening") within Europe around open banking, it’s just one half of the story when it comes to innovating payments. Many forget the crucial other half of the equation: authentication. In this article, I’ll discuss why it’s vital that both open banking and authentication be [considered in tandem if businesses](https://www.financedigest.com/pizza-firm-dp-eurasia-considers-divestment-of-russian-business.html "Pizza firm DP Eurasia considers divestment of Russian business") are to truly meet the aims of PSD2 and foster digital trust.

**What is PSD2?**

The revised [Payment Services](https://www.financedigest.com/igtbs-payments-services-hub-faq.html "iGTB’s Payments Services Hub – FAQ") Directive (PSD2) was introduced by the European Union to regulate payment services and service providers. First proposed in 2013, PSD2 aims to promote payment innovation, competition and efficiency across the EU.

The key objectives of PSD2 are to:

- contribute to a more integrated and efficient [European payments](https://www.financedigest.com/more-banks-join-european-instant-payments-pilot-from-end-2023.html "More banks join European instant payments pilot from end 2023") market;
- [level the playing field](https://www.financedigest.com/using-agility-to-resist-economic-instability-and-level-the-playing-field.html "Using agility to resist economic instability and level the playing field") for payment service providers;
- promote the development and use of innovative online and [mobile payment](https://www.financedigest.com/what-is-the-optimum-mobile-payment-mix.html "What is the optimum mobile payment mix?") services;
- make [payments](https://www.financedigest.com/allpay-signs-with-eckoh-to-secure-telephone-payments.html "allpay signs with Eckoh to secure telephone payments") safer and more secure;
- protect consumers;
- encourage lower prices for payments.

The two significant and intra-linked developments under PSD2 are: the liberation of account data (open banking), and the introduction of new, more secure authentication requirements ( [Strong Customer Authentication)](https://www.financedigest.com/how-strong-customer-authentication-can-prevent-cart-abandonment.html "How Strong Customer Authentication can Prevent Cart Abandonment").

The first development under PSD2 requires banks to [share raw account data](https://www.financedigest.com/european-shares-edge-higher-on-healthcare-lift-weak-china-data-stokes-worries.html "European shares edge higher on healthcare lift, weak China data stokes worries") with third-party providers, based on customer permissions. Application Programming Interfaces (APIs) allow third-parties to initiate [payment transactions on behalf of the customer](https://www.financedigest.com/curating-a-fully-contactless-customer-experience-for-payments.html "Curating A Fully Contactless Customer Experience for Payments ").

In the UK, the nine largest banks were originally mandated to share their data. But since then, many other [banks have followed suit in recognition of the opportunity](https://www.financedigest.com/uk-retail-banks-is-irrelevance-curtailing-opportunity.html "UK Retail Banks: Is Irrelevance Curtailing Opportunity?") for market innovation, as well as the benefits it brings customers.

This development forms the basis of open banking, and it has seen significant uptake in other parts of [Europe over the past couple of years](https://www.financedigest.com/europe-facing-its-worst-drought-in-500-years-study.html "Europe facing its worst drought in 500 years – study").

The second major development under PSD2 is known as the ‘Regulatory Technical Standards’ (RTS) for Strong Customer Authentication (SCA). SCA aims to enhance the security of payments by introducing the requirement for stronger authentication and consumer [protection to limit the potential for fraud](https://www.financedigest.com/protect-your-organisation-from-fraud.html "Protect your organisation from fraud"). Payment service providers are required to apply the rules of SCA when a [customer accesses their payment account online](https://www.financedigest.com/online-marketplaces-embracing-embedded-finance-to-benefit-both-customers-and-vendors.html "Online marketplaces: embracing embedded finance to benefit both customers and vendors     ") or makes an electronic payment.

**The Challenges**

Now we’ve covered exactly what PSD2 is, we can look at the challenges that come with it. They are two-fold:

- **Opening up digital channels introduces risk**

Open banking accelerates [financial services](https://www.financedigest.com/wrapping-financial-services-in-a-security-blanket.html "Wrapping Financial Services in a Security Blanket") innovation in every market it’s introduced to. As banks now [must share their data](https://www.financedigest.com/finance-firms-must-ensure-they-fix-data-fundamentals.html "Finance firms must ensure they fix data fundamentals") with aggregators, this has also opened them up to numerous unsecure digital channels. However, because open banking journeys are orchestrated through redirect flows, this potentially exposes [banks to countless unsecure digital](https://www.financedigest.com/igtb-launch-digital-transaction-banking-available-as-saas.html "iGTB launch Digital Transaction Banking available as SaaS") channels.

So, users are redirected to their bank’s [web login page or banking app to give consent when they need to authenticate their identity](https://www.financedigest.com/top-5-trends-in-decentralised-self-sovereign-identity-ssi-and-privacy-preserving-technology-in-web-3-0.html "Top 5 trends in Decentralised Self-Sovereign Identity (SSI) and Privacy-Preserving Technology in Web 3.0 "), authorise access to account information or initiate a payment. Traditional authentication mechanisms such as usernames, passwords and SMS One-Time Passcodes (OTP) add considerable friction to this process. And since they rely on analogue processes, they’re detrimental to the success of PSD2’s full objectives in the region.

- **SMS OTPs are not a long-term solution**

Widespread use of mobile phones has led to their adoption as a common authentication mechanism for transaction authorisation and identity verification. Typically, this comes in the form of an SMS OTP alongside a username and password.

Under SCA, the use of SMS OTPs is categorised as a “possession” factor, based on the possession of a SIM-card associated with the respective mobile number. SMS OTPs are typically used because it’s seen as an easy to implement solution – one [customers are familiar with and know](https://www.financedigest.com/know-your-customer-lets-make-this-easy.html "Know Your Customer – let’s make this easy") how to use.

However, it’s becoming ever more apparent that there are significant disadvantages to using of SMS OTPs for authentication purposes, namely:

1. Security vulnerabilities
2. Poor [customer experience](https://www.financedigest.com/how-partnerships-fuel-fintech-innovation-and-help-banks-deliver-a-better-customer-experience.html "How Partnerships Fuel Fintech Innovation and Help Banks Deliver a Better Customer Experience")
3. Cost implications

Whilst the move to multi-factor authentication is a welcomed enhancement to user security, approaches that rely on SMS OTP represent only the first stage in the [evolution of digital](https://www.financedigest.com/the-evolution-of-loyalty-and-its-place-in-the-digital-age.html "THE EVOLUTION OF LOYALTY AND ITS PLACE IN THE DIGITAL AGE") authentication.

**The solution**

For the purposes of proving possession for authentication, alternative and more secure methods to SMS OTP exist.

In Europe, the EBA has recognised that approaches relying on mobile apps, web browsers or the exchange of public and private keys, can be used as evidence of possession. They [must simply include a device-binding process that ensures a unique](https://www.financedigest.com/the-rise-of-finfluencers-presents-unique-opportunities-but-brands-must-proceed-with-caution.html "The rise of “Finfluencers” presents unique opportunities but brands must proceed with caution") connection between the user’s app, browser or key and the device.

New technologies offer secure and reliable methods of device identification that are more privacy-preserving. It’s important that data being accessed from gatekeepers – such as banks – is done so in an secure manner. The use of behavioral biometrics in a securely bound device represents a stronger method of authentication than SMS OTPs.

This is something that European [banks and retailers](https://www.financedigest.com/rethinking-retail-banking-embracing-a-customer-centricvalue-proposition.html "Rethinking retail banking: Embracing a customer-centricvalue proposition") are now looking to implement as part of the 3DS2.0 roll-out. This approach should help [reduce costs](https://www.financedigest.com/cobots-in-the-financial-workplace-reducing-costs-attracting-talent-and-enhancing-sustainability.html "Cobots in the financial workplace: Reducing costs, attracting talent and enhancing sustainability"), risks and vulnerabilities, while at the same time enable seamless, frictionless authentication for e-commerce user journeys.


---
This blog is powered by Superblog. Visit https://superblog.ai to know more.
---