We understand that many retailers have been contacted by their acquirers with regards to Strong Customer Authentication (SCA) and the regulatory timescales for the new Payment Services Directive v2 (PSD2).

As a quick recap, the Card Payments Authority suspended the end of life directive for the Verifone Vx and Ingenico IPC range of PEDs from the 1st April 2020 to the 1st April 2021, due to the COVID-19 pandemic. End of support for these PEDs is still 1st April 2023.

Please read their latest statement below:

As part of our continued commitment to provide updates on Strong Customer Authentication, and as the payments industry continues to prepare within the current climate, the regulatory timescales have now changed.

The current SCA enforcement deadlines are:

  • 14 September 2021 for cards issued in the UK
  • 31 December 2020 for cards issued in the European Economic Area

In the UK, the date has been moved from March 2021, giving an additional six months to achieve compliance, however the European date will remain unchanged.

This additional time for UK issued cards should be used to improve implementation, not to delay it.

Both UK and European Issuers will begin to implement their requirements for cardholders to authenticate themselves earlier in 2021, so earlier adoption is essential, to avoid an increased level of declines.

Over the next 18 months, there are some milestones that you’ll need to factor into your 3DS 2 implementation:

  • 1 July 2020 Mastercard will require merchants operating in Europe to evidence at least one full 3DS V.2 transaction by this date.
  • 1 January 2021 Mastercard will increase its authentication fees for 3DS V.1 from this date. This increased fee will not apply to 3DS V.2, so we encourage you to move your secure transactions to 3DS V.2 before this date, where possible.
  • October 2021 Visa will remove liability protection from 3DS V.1 in Europe after this date, meaning 3DS V.2 will be the only version providing liability protection.

In addition to implementing 3DS V.2, it’s critical you review your current acceptance and validate that you have developed the ability to process stored card transactions and that you understand the new, soft decline authorisation response.

  • Merchant Initiated/Credential on file: Merchant initiated and credential on file (including recurring transactions) benefit from an exemption to SCA but failure to correctly process these transactions could mean the Issuer doesn’t recognise the transaction as exempt. This could lead to the Issuer requesting a full 3D Secure authentication, meaning you will be unable to complete the transaction.
  • Soft declines: Issuers are already increasing their use of the soft decline response code. This decline code is used to indicate that the Issuer wants to fully authenticate a transaction, and the instruction is for a merchant to ‘step up’ the payment to 3DS. Issuers will increase their use of soft declines as we near the implementation dates for SCA, but this response is being used now. You must be able to recognise a soft decline response and be ready to reassure your customers there’s no problem with their card or their account, that it’s just an extra security check requested by their Card Issuer, or you risk losing these transactions.

Swan Retail are committed to providing PSD2 solutions for card payments and have already received accreditation for our EPoS solutions: Cygnus, Midas EPoS, Swan PoS and TRIMS PoS, but the payments landscape has changed with this new generation of PEDs.

We have, in the past, been used to our payment solutions being acquirer agnostic. However, this is no longer the case for the new range of PEDs and the new payment standards.

Acquirers have adopted or developed their own payment gateways and limited their solution to a specific range of PEDs. This in turn means our customers have less choice with the Swan range of EPoS solutions.

Whilst we are continuing to accredit our EPoS solutions with new acquirers, we cannot feasibly cover all options across our entire range of EPoS solutions and accredit for all acquirers.

Our Current Accreditations

The current accreditations for our EPoS solutions on the new PEDs are:

  • Cygnus – Verifone, Worldpay (and Global Payments coming soon)
  • Swan PoS – Worldpay
  • TRIMS PoS – Paymentsense
  • Midas EPoS – Verifone, Worldpay

As noted in the statement, Mastercard and Visa are working to different timeframes and it would seem prudent to start reviewing your payment solutions.

We will, of course, keep you informed of additional changes within the payments sector and new accreditations for our EPoS solutions.

Cygnus EPoS