Intuit fully supports the aims of PSD II to open up the EU payments market and harmonise rules for all payment services in the EU. We agree that there is a need for strong customer authentication and agree with the EBA’s reasoning on the requirements for strong customer authentication.
Intuit would, however, urge the EBA to ensure that strong authentication requirements are proportionate and appropriate to the need, and do not adversely impact the potential for ongoing innovation in service to customers. For example, having a SCA applied “each time” a payment user initiates a payment transaction. Using authentication process each time the customer makes a payment may not be necessary – but rather, illustratively, providing them with an authentication token would not only ensure security standards but also allow for innovation. Non-prescriptive requirements that are proportional to the need, while permitting continued innovations and improvements in security and service delivery, would best advance a thoughtful policy balance that serves the multiple needs and expectations of European consumers.
Intuit agrees with the EBA’s reasoning that the requirements should remain neutral. However, we would call on the EBA to provide more clarity to the wording in Article 2 of the draft RTS to take account of a write-access API.
Article 2.2 is perhaps too prescriptive on a detail level regarding ‘dynamic linking’. This type of security requirement may be best put forward in terms of desired public interest outcomes, with detailed execution accomplished through continuous innovation and improvement over time rather than via a static solution required of Account Information Services Providers.
Intuit is not currently aware of any additional threats, other than those listed in articles 3, 4 and 5 of the draft RTS.
Regarding frequency of access and re-authentication, Intuit is concerned about the exemption for Account Information Services (AIS) providers when strong customer authentication is required. Here the AIS providers’ customer(s) will have to re-authenticate on a monthly basis. This may result in AIS providers not using APIs as a result.
Intuit believes there should be no expiry of access as the customer is free to cancel the access at any time.
Intuit does not have concerns with the list of proposed exemptions, but would highlight again, that SCA requirements should not impede innovation. It will be important for EBA to define what it means by these exemptions so as to not create confusion among the industry – and essentially, limit the innovation.
Intuit agrees that the confidentiality and integrity of the payment service users’ personalised security credentials are of utmost importance. The EBA’s reasoning in the draft RTS would appear to sufficiently address the issue and ensure no unauthorised use of the personalised security credentials and of authentication devices.
Intuit fully supports the core aim of PSD II to open up the EU payments market. We therefore, support common and secure open standards of communication.
However, Intuit is concerned by the wording of Article 19 of the draft RTS and the notion of a ‘dedicated interface’. We urge the EBA to reflect carefully upon the draft RTS to ensure that open access to APIs is not impeded. Providers of Payment Initiation Services (PIS) should have the ability to offer services based on open access and should not be tied to a dedicated interface imposed upon them. Open access to APIs for PIS providers would ensure direct access to a payers account. However, the notion of a dedicated interface would suggest only ‘indirect’ access to a payers account. Intuit is concerned that this would be moving away from one of the very core goals of PSD II, to open up the EU payments market.
Furthermore, Article 19 (3) of the draft RTS shifts the responsibility to define common and secure open standards for communications to third parties. Intuit believes these standards should be clarified and defined by the EBA. We also believe these standards must ensure direct and open access.
In order to ensure the core aims of PSD II are reached (i.e. open market, increased competition and innovation) there needs be legal certainty for all players involved in the payment services market.
ISO 20022 is a bank-to-bank communication standard. Intuit would, therefore, question if ISO 20022 is the best standard available for communication interface. The EBA should also carefully reflect whether the wording of Article 19 (3) of the draft RTS would impede direct and open access to payment accounts, given the reliance on i) a potential unsuitable and outdated standard; and ii) the perceived delegation of powers to third parties to develop standards of communication.
Intuit would urge the EBA to consider how countries outside the EU would perceive the adoption of e-IDAS identification services. We would propose that the draft RTS remain neutral as regards the identification technology.
Given the fact that the nature of different businesses will require varying access to data, and the fact that the data is used to service the customer, Intuit believes that there is no need to limit access to data. Any limit to data access could be to the detriment of the customer. Instead there should be Guidelines issued on the responsible use of APIs.