Drawing on my experience of heading up the Payment Services Authorisations Team at the FCA for many years, I spoke last week about the FCA’s expectations for authorisations and re-authorisations, and offered some insight into how they might approach the challenges brought about by PSD2. I now explore the risks inherent in firms wishing to ‘upgrade’ their licences, the new entrants under PSD2 and the FCA’s approach to supervision.
Licence upgrades
Recently, it has emerged that the FCA may not be as ‘proportionate’ as one might expect, certainly when it comes to firms taking the PSD2 re-authorisation requirements as an opportunity to instead ‘upgrade’ their licence e.g. an authorised payment institution (API) seeking to become an authorised e-money institution (AEMI). Whilst it may be reasonable to assume that a well-completed AEMI application submitted in good time ought to have been able to be determined ahead of the 13 April deadline for re-authorisation submissions, the FCA is only now advising such firms to also submit an application for re-authorisation as an API. Whilst I understand the legislative requirement here and that the firm runs the risk of not being able to continue to provide payment services beyond 13 July 2018 if the AEMI application has not been determined by then, it is entirely disproportionate to require the firm to complete (and pay for) a second application which will largely be identical to the first, given they are both based on the EBA Guidelines for Authorisation. Note that this situation also applies to small e-money institutions wishing to become AEMIs and, to a lesser extent by virtue of longer timescales, to small payment institutions applying to become APIs.
One would hope that the obvious – and proportionate – solution would be for the firms in question to submit a shell application for re-authorisation, with all answers to the application questions being cross-referenced to the first application, where relevant. One would also hope that the application fee is waived; why should the firm expect to pay for a licence it doesn’t want and for an application that has, essentially, already been submitted?
What about FinTechs?
The expectation, or perhaps simply a generalisation, is that FinTechs will be entering the market through the new services introduced by PSD2, account information services and/or payment initiation services (AIS and PIS respectively). Whilst this may not be entirely true, there is no denying that these services are underpinned by new technology or interfaces, which often come to market as financial apps. More pertinently, these services are new to regulation. As such, the FCA itself has to quickly try to understand the business models at play. To help them in this effort, the FinTech should try to present their business model and the customer journey as clearly and simply as possible.
That is not to say that all firms (FinTechs or not) undertaking AIS/PIS need to seek registration with the FCA just yet. There is a transitional ‘fuzzy period’ hidden at the back of the PSD2 text which allows firms who were already doing this business before 12 January 2016, to continue to do so without the need for registration, until the introduction of regulatory technical standards on Strong Customer Authentication and Common and Secure Communication (the fabled ‘RTS’ that has dominated much of PSD2 discussion). However, absence of a registration with FCA means that these firms are not entitled to plug in to Open Banking or, indeed, any API or interface provided by another online account service provider. This is all set out in last year’s helpful joint communication from HM Treasury and the FCA.
What does the FCA expect in terms of ongoing requirements?
In many respects, PSD2 changes little in terms of compliance. However, the FCA has introduced changes to the FSA056 reporting return (to reflect the changes to the qualifying items that can be used as capital resources) and additional reports covering, for example, complaints handling, fraud reporting, controllers and close links, and incident reporting. There are also new notifications required in respect of, among other things, major operational or security incidents.
With more information coming its way, it is unsurprising that the FCA has set up a new Payments Department within its Retail Banking Supervision directorate. This department is now gearing up to assess the payments ecosystem and has already embarked on a series of visits to firms to better understand the business models operating within that ecosystem. It is true that supervision under PSD1 was entirely reactive (e.g. based on complaints or other intelligence about firms being notified to the FCA), but it seems that supervision under PSD2 may be an entirely different proposition, reflecting that payments touch almost every consumer in the UK and warrants more scrutiny and understanding than afforded it previously. That said, FCA has c.56,000 firms to supervise across industry verticals, with more on the way with Claims Management Companies coming under FCA supervision in 2019 (and, maybe, cryptocurrencies in the near future – see Karen Vickers’ helpful blog article on this. It would be understandable, therefore, if FCA’s supervisory budget didn’t quite stretch as far as it might want in this sector.
What will be a FinTech’s most important challenges and concerns in relation to PSD2?
If we assume that most of the interest will be focussed on AIS and PIS, then systems security will clearly be pivotal. In the run-up to PSD2 implementation, the banks were prophesying ‘cybergeddon’ or widescale cyber attacks on AIS/PIS firms which would impact them and, more importantly, the security of their customers’ money and data. This was their reaction to PSD2 opening up the market and increasing competition. A successful cyber attack on an AIS or PIS would make their case for them. But, let’s not forget, firms offering AIS (and, to a far lesser extent, PIS) are already out there, and there has been no cyber catastrophe to speak of. For FinTech, it is important to have robust systems and security policies and to be clear about what happens if there is a breach. Certification under Cyber Essentials, the government-backed scheme to help firms protect themselves against cyber attacks and other online threats, is one way a FinTech can satisfy itself, its customers, and the FCA, that it has taken appropriate steps to ready itself for the coming storm.
This post contains a general summary of advice and is not a complete or definitive statement of the law. Specific advice should be obtained where appropriate.
