The Financial Conduct Authority (FCA) has revealed that customers will no longer need to reauthenticate with their account servicing payment service provider every three months as part of Strong Customer Authentication (SCA) rules.

Previously, customers were required to reauthenticate every 90 days to continue accessing account information through a third-party provider (TPP).

The regulator explained that the reauthentication process was one of the key barriers to the continued development and uptake of Open Banking because it creates friction for customers when using TPP services and “increases the likelihood of customers dropping off.”

However, SCA will continue to be required when customers first decide to connect their account to a third-party service, and TPPs will still need to reconfirm their customers’ consent every three-months.

“We consider that these measures are proportionate, taking into account the level of risk,” said the UK watchdog in a policy statement. “They balance the need to protect consumers from TPP access without explicit consent, and unwittingly sharing data, with reducing friction for customers."

The FCA identified the use of existing customer interfaces, or modified customer interfaces (MCIs), that are not specifically designed for TPPs to access customer account information, as another barrier to Open Banking.

“Many TPPs face operational difficulty when accessing customers’ payment accounts via MCIs,” added the authority. “This has discouraged them from serving customers whose account providers enable access through MCIs.”

The regulator now requires some account servicing payment service providers to have dedicated interfaces so that TPPs have access to customer account information for retail and SME payment accounts. Alongside this, rules on providing interface technical specifications, testing interfaces, and fallback interfaces by these payment service providers will be amended so that they can launch products and services more quickly.

Finally, the FCA said that it will allow account servicing payment service providers with a deemed authorisation under the Temporary Permissions Regime (TPR) to rely in the UK on an exemption from setting up a fallback interface granted by a home state competent authority located in the EU.

Share Story: