How To Fix The UK Card Acquiring Market for SMEs

The Payment Systems Regulator (PSR) is consulting on remedies to address its findings that the payment card acquiring market does not work well for merchants with turnover of up to £50m a year - by far the majority by number! Responses to the consultation are due on 6 April 2022. If my experience of working in the card acquiring market for several decades is anything to go by, the kind of remedies that the PSR is recommending seem likely to improve the experience of all participants...

Key Problems in the Card Acquiring Market 

The PSR identified three features of the acquiring market that restrict the ability and willingness of merchants to shop around for acquiring services and switch between card acquirers to get a better service at better prices: 

• Lack of published pricing for card-acquiring services: pricing structures and approaches also differ, making it hard to compare prices across independent sales organisations (ISOs), acquirers and ‘payment facilitators’ who gather together transactions from small merchants (those with the GBP equivalent of less than 1 million USD turnover each year).
  

• The indefinite duration of acquiring service contracts: there is no clear trigger for merchants to think about shopping around and switching. 
  

• Point of sale (POS) terminals and leases: terminals won’t work with a new card-acquirer, so need to be replaced; and there may be a charge for terminating an existing terminal lease (which spreads the cost of terminals over a period of up to 5 years while the related acquiring contract has a minimum term of 12 months). 

Remedies Being Considered 

To help resolve these problems, the PSR is considering four remedies in combination: 

• Summary information boxes 
• Boosting the use of digital comparison tools by merchants 
• Trigger messaging 
• Removing barriers to switching to that arise from POS terminals/leases.
  

The combination is important. Summary boxes may not work as expected, and transparency is more effective to aid shopping around and switching when combined with remedies that facilitate service comparison, personalised information on product use and trigger remedies. Price simplification may also be required if other remedies prove ineffective. 

To aid in the design of the remedies, the PSR is asking card acquirers to provide: 

• mock summary boxes and trigger warnings; 
• technical specifications for summary boxes, trigger warnings, the submission of data to DCTs and POS terminal portability; and 
• an explanation of system changes required. 

Summary information boxes 

Acquirers would have to provide standardised key facts information setting out key price and non-price features, both in bespoke format provided to each merchant, and in generic format which would be published more widely: 

• Bespoke individual summary: tailored information for each merchant about the pricing and other service information, with consumption data and information on options to migrate to other tariffs or how to switch acquirer.
  

• Generic summary: information for all customers and potential customers on acquirer websites to enable merchants to quickly assess pricing and service options across a range of acquirers. 

Boosting digital comparison tools (DCT) for merchants 

DCTs are simply online intermediary services used to compare and potentially to switch or purchase products from a range of providers. DCTs are not as well established in the acquiring market as they are in markets for consumer services such as loans, insurance and utilities. The PSR found that merchants tend to land on ISO ‘lead-generation’ web sites when looking for an acquirer. 

To work effectively, experience from consumer markets shows that DCTs for card acquiring should cover both pricing and non-price service elements of card-acquiring services. This would involve: 

1. acquirers publishing and updating their pricing and other service data regularly in formats which are consistent and easily usable, so DCTs could collate comparative pricing and other service data; and 
2. merchants being able to share their acquirer transaction data, so that DCTs and other third parties could: 

• determine the key service parameters, such as brand and category of card, types of transaction (e.g. card-present/not-present, MOTO), frequency of each transaction type; and 
• use the merchant’s specific transaction data to calculate whether the merchant would be better off with a different acquirer. 

It would also likely improve merchant trust in DCTs if the PSR were to audit DCTs’ comparison methodologies and tools (as Ofcom does, for example). The PSR plans a feasibility study in this respect. 

Trigger messages 

A ‘trigger message’ would be a standardised message sent by acquirers to merchants ahead of say, the expiry of the initial contract term, to prompt a search of the market and switching. 

 The PSR is considering fixed term contracts, so that the expiry acts as a trigger for comparing switching options; but also trigger messages such as a cheaper tariff becoming available. 

Information items in the messages could include how much the contract price has increased, how much would be saved by switching to the lowest tariff and how to switch to new POS terminals. 

The PSR also notes that the FCA’s work on current account and home insurance switching suggests that SMEs will respond better to personalised information on the financial impact of switching, as well as non-price benefits. Ofcom’s experience also suggests that such messages should be kept short and simple, action focussed, personalised, designed to remind customers and give them a deadline, designed to help customers plan, and be tested with a target audience. Visual presentation of information was helpful where complete, precise, specific and jargon free. 

Trigger information is best presented when customers log-in to their account, whereas calls and text messages are not as effective for communicating this type of information.

POS Terminals as Technical Barriers to Switching Acquirers 

Point of Sale (POS) terminals are the devices used by merchants to capture card details from customers when a transaction is made. 

POS terminals may be offered by or through an acquirer or separately by an ISO, but they typically operate with only one acquirer. So a merchant wishing to switch acquirer will also need to terminate both the ‘merchant service’ contract for card-acquiring as well as a lease for their POS terminal. But card-acquiring contracts are usually for a term of 12 months while POS terminal leases last up to five years and renew automatically for up to 18 months, and may involve termination charges. 

In addition, merchants and their staff may be used to a certain POS terminal, so may be reluctant to switch to a different unit offered by a different acquirer. 

The PSR is looking at both the contractual and technical barriers to switching POS terminals and contracts, but has a preference for removing technical barriers first. 

The technical barriers include physical reconfiguration that may be required to make a POS terminal work with a new acquirer’s systems; certification required by each new card-acquirer and for each payment scheme; and the fact that the new acquirer’s terminal manager may not support terminals from a previous acquirer (changing terminal manager will require unlocking and resetting cryptographic keys). 

Technical remedies could involve requiring a new acquirer to replace the merchant’s POS terminals, but the PSR would prefer to focus initially on trying to ensure that POS terminals are portable between acquirers. 

Conclusion

Merchants don't need to wait for the PSR remedies to switch acquirers, but the problems and remedies do show the kind of effort required to search for the right acquiring service and organise a switch. I've advised merchants of all sizes and card acquirers, ISOs and payment facilitators. Even large merchants struggle with the challenge of switching, and they retain experienced consultants to help determine the service/features required; the most efficient way to meet those needs; and to evaluate which acquirers can genuinely deliver and at what price. 

But that process is time-consuming and frustrating for acquirers as well. And even at the smaller end of the market there is plenty of scope for both the merchant and the acquirer to misunderstand the merchant's requirements and the acquirer's ability to deliver.

The kind of remedies that the PSR is recommending therefore seem likely to improve the experience of acquirers, payment facilitators, ISOs and merchants alike. 

What Is A "Payment Service"?

I'm often approached by senior managers in businesses who've been asked this question - usually by their credit card acquirer, a financial regulator or a potential customer doing its due diligence. There's often no simple answer, but I've explained the main issues below. Please get in touch if you would like to discuss any of them.

Which types of businesses need to think about this?

This question tends to arises where your business:

• receives cash from one set of customers and makes payments to other customers. Examples range from e-commerce marketplaces, to law firms, to fully regulated payment service providers (including banks, e-money institutions and payment institutions);

• issues vouchers or other forms of value that can be exchanged for goods or services, either from the same business or some other participating retailers or suppliers;

• enables customers to send transaction data to their card acquirer, initiate a payment from their bank account or share bank statements or other financial information with third parties.

Depending on the circumstances any of these activities could mean that you are either:

• offering an "e-money" service and/or a "payment service", in which case you would and need some form of regulatory authorisation or registration; or

• your activities might be outside the scope of regulation, or in scope but specifically excluded from some or all of the authorisation or registration requirements.

How are payment services regulated?

Activities involving e-money and payments are mainly regulated throughout the EEA under national regulations that implement the second Electronic Money Directive (EMD) and the second EU Payment Services Directive (PSD).

These two directives are 'maximum harmonisation' directives, which means each EEA member state is supposed to apply them the same way (subject to a few permitted options). However, the interpretation by one country’s regulator that a service is either out of scope of the EMD and PSD, or in scope but expressly excluded, cannot be ‘passported’ to other EEA countries. So it is prudent to check the interpretation with local counsel in each significant EEA market in which you intend to operate.

If your activities are in scope, and not excluded, then you would need to be authorised as an E-money Institution (EMI) or payment institution (PI), or registered as small EMI or PI or as the agent of an EMI or PI. If you offer 'account information services' then you only need a registration; and some types of exclusion also require you to register with the local regulator.

A fully authorised firm may “passport” its services into other EEA countries (or rely on its principal’s passports if it is a registered agent).  Because of Brexit, however, UK-based institutions would need to set up an entity based in one of the remaining EU27 countries, or an EEA member state, from which to passport services around the EEA; and EEA-based firms can either register for a temporary permission (by 30 January 2020) or set up a UK subsidiary and apply for the relevant authorisation or registration locally.

What is a payment service?

Unless you enable the collection and withdrawal of physical cash, the “payment services” you are most likely to be concerned with involve:

• the 'execution' (processing etc) of payment transactions involving card-based payments, bank/credit transfers, direct debits, either with or without credit;

• money remittance: where funds are received from a payer, without any payment accounts being created in the name of the payer or the payee, for the sole purpose of transferring a corresponding amount to a payee or to another payment service provider acting on behalf of the payee, and/or where such funds are received on behalf of and made available to the payee;

• issuing payment instruments: contracting to provide a payer with a payment instrument to initiate and process the payer’s payment transactions (a payment instrument is any personalised device(s) and/or set of procedures agreed between the user and the service provider that is used to initiate a payment order);

• aquiring payment transactions: contracting with a payee to accept and process payment transactions, which results in a transfer of funds to the payee (e.g. debit/credit card acquiring or 'merchant acquiring');

• payment initiation services: a service to initiate a payment order at the request of the user with respect to a payment account held at another payment service provider; or

• account information services: an online service to provide consolidated information on one or more payment accounts held by the user with on or more other payment service provider(s).

There are many related definitions, but the central one to understand is that a "payment transaction" means "an act initiated by the payer or payee, or on behalf of the payer, of placing, transferring or withdrawing funds [i.e. money, including "e-money"], irrespective of any underlying obligations between the payer and payee." This definition can involve some degree of legal fiction, such as when applied to card acquiring, which actually involves multiple payment transactions.

What is e-money?

The term “electronic money” or "e-money" means monetary value that is:

• electronically stored; 
• represented by a claim on the electronic money issuer, 
• issued on receipt of funds, 
• for the purpose of making “payment transactions”; 
• accepted by a person other than the electronic money issuer; and 
• not a “limited network” service.

"Limited networks" are services based on specific payment instruments that can be used only in a limited way and meet any one or more of the following conditions:

• allow the holder to acquire goods or services only in the issuer's premises;

• are issued by a professional issuer and allow the holder to acquire goods or services only within a limited network of service providers which have direct commercial agreements with the issuer;

• may be used only to acquire a very limited range of goods or services; or

• are valid only in a single EEA State, are provided at the request of an undertaking or a public sector entity, and are regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers which have a commercial agreement with the issuer.

The exclusion for limited networks also applies to payment services generally. This can include loyalty schemes, fuel card schemes and so on. Some regulators may consider gift cards as falling within this exclusion, while others may not see them as within scope of the PSD at all.

Is the service offered by way of business?

This is where a lot of uncertainty can arise because, in some countries (like the UK), the regulator is only concerned about payments activity that is operated or offered as a business separately or distinctly from any other activity. In other countries, however, this may not be a factor that the regulator considers to be very important, if at all.

So it's worth considering that if you are receiving money and paying it out or holding it on a customer's behalf only as a small part of a much wider service - like, say, a law firm - then it is possible that the local regulator might not consider your payments-related activity to be a "payment service" in its own right (but of course other laws and/or professional rules may apply to those scenarios anyway).

It is also worth exploring any opportunities to re-position or integrate the payments activity so that it is not offered by way of business in its own right.

Even if your activity is in scope, could an exclusion apply?

Some activities that initially meet the test of being a "payment service" might actually benefit from a specific exclusion under the EMD or PSD.  There is quite a long list of possible exclusions. Some reflect day-to-day activies, like paying another person directly, paying by paper cheque etc., or physically transporting cash. Others are quite specialised and/or involve a lot of explanation and the possibility for regulators to interpret them differently, as with the scope of the EMD or PSD.  Exclusions that are likely to involve considerable legal analysis are:

• the commercial agent's exclusion: covers payment transactions from the payer to the payee through a commercial agent authorised via an agreement to negotiate or conclude the sale or purchase of goods or services on behalf of only the payer or only the payee;

• the technical service providers exclusion: covers services which support the provision of payment services, without the service provider entering into possession of the funds to be transferred - like 'payment gateway' services or anti-fraud services, for example. These services include processing and storage of data, trust and privacy protection services, data and entity authentication, information technology (IT) and communication network provision, provision and maintenance of terminals and devices used for payment services, but exclude payment initiation services and account information services;

• the limited network exclusion, which I've already mentioned above in relation to e-money.

Conclusion:
Again, there is often no simple answer as to whether your activities constitute a regulated e-money or payment service, but I've explained the main issues above. Please get in touch if you would like to discuss any of them.

#PSD2: Are Merchant Checkouts "Payment Instruments"?

The Treasury is consulting on its proposed regulations to implement the new Payment Services Directive (PSD2) in the UK.  The consultation ends on 16 March 2017 and the regulations must take effect on 13 January 2018. The FCA will consult on the guidance related to its supervisory role in Q2 2017. Time is tight and there are still plenty of unanswered questions, which I've been covering in a series of posts. In this one, I'm exploring whether online merchants' checkout process/pages could be "payment instruments", so that merchants who host their own process might be engaging in the regulated activity of "issuing payment instruments" (and possibly even offering a "payment initiation service"). There is now precious little time for retailers to consider the issue,  decide whether their activities are caught and, if so, whether to outsource the hosting of the checkout process to a duly authorised firm or its agent, restructure the checkout process or the entity/ies that operates it, or become authorised or the agent of an authorised firm.

Everyone is familiar with the e-commerce 'checkout' page or process, with its list of ways to pay for the items selected or in the 'shopping basket'. Sometimes these are hosted by a regulated payment service provider, an exempt 'technical service provider' or 'gateway', and sometimes by the merchant itself (in which case the merchant has to comply with certain security requirements in relation to card transaction data, for example). 

Whether technical service providers who are currently exempt will remain so under PSD2 is already an open issue, since to remain so they cannot also provide either a payment initiation service or an account information service, even though they still would not be handling the funds to be transferred.

The big question is whether merchants themselves fall into the regulated scope, especially as they ultimately receive funds, so might not qualify as technical service providers.

First, a few (of the many) relevant definitions:

“issuing of payment instruments” means a payment service by a payment service provider contracting to provide a payer with a payment instrument to initiate and process the payer’s payment transactions;

“payment instrument” means any— (a) personalised device; or (b) personalised set of procedures agreed between the payment service user and the payment service provider, used by the payment service user in order to initiate a payment order;

“co-badged”, in relation to a payment instrument, refers to an instrument on which is included two or more payment brands, or two or more payment applications of the same payment brand;

Note that the references to 'payment service' and 'payment service provider' are redundant or circular - essentially, they mean anyone who is, or should be, authorised to provide a regulated payment service. The reference to 'co-badging' is important as certain information could have to be provided under the Merchant Interchange Fee Regulations.

I think the primary questions are as follows, but the answers would vary considerably according to the payment method and other facts and circumstances:

• which payment transaction is involved in the relevant scenario, and who is the relevant 'payer'?

• is the checkout process/page a "personalised device"; or "personalised set of procedures agreed between" the customer and the merchant?

• if so, is the checkout process/page "used by the payment service user" (again, see here)?

• if so, is the payment service user using the checkout process/page "in order to initiate a payment order"... as explained previously...or 'payment transactions'?

• finally, how much processing would a merchant have to do to fall within the meaning of "initiate and process the payer's payment transactions": so, when does that processing begin and end; what steps/participants are involved; what is the nature of the processing (e.g. does it send transaction data to a payment gateway, acquirer or other type of payment service provider?); is the merchant acting as principal, agent or payee?

Hopefully, the Treasury and FCA will explain their interpretation soon!

How Card-based Merchant Acquiring Works

The requirement for the European Commission to review the operation of the Payment Services Directive provides a great opportunity to consider, amongst other things, how card-based merchant acquiring works. I've explained my take on it in an article for SCL, complete with a you-beaut, funky graphic: 

How card acquiring works

View more documents from Simon Deane-Johns