Red Alert: European Court Is Told That The Contactless Feature of a Payment Card is a Separate Payment Instrument!

Fans of the adage "A hard case makes bad law" will wince as the regulatory and contractual treatment for contactless credit cards and debit cards is at risk owing to the misadventures of a single Austrian bank. I would hope that the industry is alive to the problem and is finding a way to improve the bank's arguments and save the day. Let me know if I can help!

Briefly stated, a series of questions has been referred by the Austrian Supreme Court to the European Court of Justice and, alarmingly, the Advocate General has given his opinion to the effect that:

1. The contactless feature of a credit or debit card is a separate payment instrument in its own right.
2. Making low-value contactless payments with a multi-functional card means the cardholder is using the card "anonymously" (and this means contactless payments are not subject to the obligation of strong customer authentication in the relevant PSD2 regulatory technical standard).
3. The issuer of the contactless feature can only use the low-value exclusions from liability for unauthorised transactions in PSD2 if the issuer can show that it is not technically feasible to block the card or prevent further use of the payment instrument if it is lost, stolen, misappropriated or used without authorisation.
4. The unilateral change mechanism for amending payment services 'framework' contracts cannot be applied to "the essential elements" of the contract, such as those used to add contactless functionality to a payment card (i.e. another payment instrument).

I have briefly set out the facts of the case below, and will post my thoughts on each of these issues in turn over the coming days, but in summary I do not see how the first two points could be right, for reasons I will explain.

The third issue is a question of fact. In this particluarly case the issuer appears to have created a problem for itself by inserting factually inaccurate provisions in its card terms, so that "according to the framework contract" it was not technically feasible to block contactless use, even though it really is possible to decline the transactions on a stolen card.

The fourth is a really awkward twist in the tale, since it introduces huge practical challenges - and costs - for all payment service providers seeking to update their contracts to introduce new products and features, as well as aggravation for their customers.

The Facts

When it began issuing cards with NFC/contactless functionality, the bank in this case decided to also amend its payment card terms to avoid liability for unauthorised payments when the cards were used in contactless mode (i.e. using 'near-field communication' or NFC functionality).

The bank's new terms said the bank (a) did not "have to prove" that a contactless payment was authorised; (b) it was unable to do so; and (c) that it was "technically impossible" for the card to be blocked when used for low-value transactions, even if blocked for other types of transactions. On this basis the bank concluded that it was not liable for any unauthorised low-value contactless payments.

Like all payment service providers, to introduce these changes to its terms the bank relied on the 'unilateral change' mechanism under PSD2, so that customers would be deemed to have accepted the changes unless they notified the bank within two months that changes were not accepted, and terminated the contract.

Whether the bank could do this depended on whether the use of the contactless feature was itself a "payment instrument" independent of the use of the card in, say, Chip-and-PIN mode, mail-order/telephone order (MOTO) or indeed online. 

Two Austrian courts held that the contactless mode is not a payment instrument in its own right, so the bank can't escape liability in this way. So far, so good, because many card issuers would otherwise need to review their terms to figure out if they had properly addressed the contactless as a distinct payment instrument - and maybe many would be tempted to pull the same stunt.

However, both the Austrian consumer body who brought the original proceedings (the VKI) and the bank then appealed to the Austrian Supreme Court, which in turn referred to the European Court of Justice the issues of whether the contactless payment feature could be considered a payment instrument in its own right, and whether the bank could use the 'unilateral change' mechanism to introduce the exclusion of liability for contactless payments. The case actually goes back to before the implementation of PSD2, but the provisions under the PSD and PSD2 are essentially the same, so the ECJ's ruling will determine the position under PSD2 as well.

The preliminary step in ECJ proceedings is the filing of an Opinion of the Advocate General, with whom the court very often agrees.

FCA Guidance on Consumer Credit Lending Authorisation

A key supporting document for applications to the Financial Conduct Authority for authorisation and permission to carry on a regulated activity is the 'regulatory business plan'. 

The requirements for what the plan must cover are usually summarised in various guidance, depending on the type of authorisation or permission being sought, but there's a lot of variation as most advisers have developed their own templates. 

Helpfully, however, the FCA has published a sample regulatory business plan for use by firms seeking authorisation/permission that is also useful for consumer credit lending, with a web page that also contains link to other relevant guidance for prospective lenders.

What is consumer credit lending?

This is a huge topic, but very broadly...

Permissions required for consumer credit lending activity will include entering into regulated credit agreements as the initial lender (under article 60B(1) of The Financial Services and Markets Act 2000 (Regulated Activities) Order 2001 (RAO) and/or buying or exercising the rights under pre-existing regulated credit agreements (under 60B(2)), subject to exemption under article 55 of The Financial Services and Markets Act 2000 (Exemption) Order 2001, for example). That deserves a post of its own.

A similar regime applies to regulated consumer hire agreements (under article 60N of the RAO), while hire purchase and conditional sale agreements are treated as regulated credit agreements.

There are also various related permissions that will likely be required to deal with credit agreements and consumer hire agreements, including credit broking (article 36A, RAO), operating a peer-to-peer lending platform (article 36H), as well as debt adusting (39D), debt counselling (39E), debt collecting (39F) and debt administration (39G). These activities and various exemptions also deserve their own post.

Regulated credit agreements do not generally include "exempt agreements" (based on many exemptions in articles 60C-60K of the RAO that would require yet another post), but carrying out credit broking in relation to exempt agreements is still a regulated activity, and facilitating entry into exempt agreements can also still constitute peer-to-peer lending.

There are also specific exemptions for consumer hire agreements (articles 60O-60R, RAO).

Regulated credit agreements and consumer hire agreements and so on are also subject to the Consumer Credit Act 1974 and related regulations, though some provisions (including those relating to the 'form and content' of agreements) will not apply to "non-commercial agreements" or exempt agreements (though some exemptions require certain declarations in the paperwork). The CCA also deals with pawn receipts, revolving credit (e.g. credit cards), small loans and so on - yet another whole post in itself.

Finally, the FCA's 'Handbook' of rules generally apply to authorised firms who conduct consumer credit/hire activity, as well as specific rules on consumer credit (CONC) which distinguish between different types of consumer credit (e.g. pawnbroking, high cost short term (payday lending) and P2P agreements) for certain purposes.

Please get in touch if any you need advice on any of this.

FCA Delays SCA... Again

The UK's Financial Conduct Authority has again delayed its deadline for enforcing the implementation of 'strong customer authentication' in e-commerce transactions, until 14 September 2021. 

The FCA had already turned a blind eye to the threshold for applying SCA to contactless card transactions, in light of the role that contactless cards play in social distancing.

The FCA still expects firms to follow the industry implementation plan agreed with UK Finance, though that can now be extended to the new deadline.

FCA Turns Blind Eye To SCA For Contactless Card Payments

The introduction of 'strong customer authentication' (SCA) - also known as 'two factor authentication' or 'multi-factor authentication' for remote and electronic payment transactions has had a checkered history. Payment service providers should have been challenging customers to provide extra authentication details from 14 September 2019. But lack of industry preparation led the FCA (in line with the European Banking Authority and other EU national regulators) to state that it will not enforce the requirement until 14 March 2021, so long as PSPs are following an agreed industry plan to introduce the checks. In light of the COVID19 crisis, the FCA has now added:

"...we are very unlikely to take enforcement action if a firm does not apply strong customer authentication when the cumulative amount of transaction values has exceeded EUR 150 or five contactless transactions in a row. But this is only as long as the firm sufficiently mitigates the risk of unauthorised transactions and fraud, by having the necessary fraud monitoring tools and systems in place and taking swift action where appropriate."

Further time may also be allowed for introducing SCA for e-commerce payments generally, beyond 14 March 2021.

Meanwhile, the date for applying regulatory standards to secure communications amongst PSPs was also deferred from 19 September 2019 to 14 March 2020, yet some PSPs have not complied. The FCA is also letting them off the hook, where they are "facing further delays due to coronavirus:

"...we will consider on a case-by-case basis the appropriate further measures. In doing so, we will in particular consider:

• firms’ security around authentication to access their online banking and when making payments;

• their controls and processes to reduce fraud;

• whether that impact is likely to be exacerbated given the current circumstances."

 

FCA Recognises Industry Lending Standards For Business Customers

Small businesses need all the leverage they can get when it comes to dealing with UK banks, so it's worth noting that the Financial Conduct Authority has ‘recognised’ the Lending Standards Board Standards of Lending Practice for Business Customers for the purposes of the FCA's Senior Managers and Certification Regime.

The Standards apply to overdrafts, loans (excluding trade loans), commercial mortgages, credit cards and chargecard products.

FCA recognition is significant because the five conduct rules that Senior Managers of all FCA authorised firms have to abide by (in COCON 2.1) include the obligation to "observe proper standards of market conduct". The Standards should also help demonstrate that an individual satisfied the obligation to "pay due regard to the interests of customers and treat them fairly".

The FCA's individual conduct rules apply to all activities carried out by the individual in the course of their employment, even if the activities are regulated.  

Accordingly, the FCA has established a framework to formally recognise industry codes covering certain unregulated activities. 

Behaviour in line with an FCA recognised industry code will tend to indicate a person subject to the SMCR rules is meeting his or her obligation to observe ‘proper standards of market conduct’ in relation to unregulated activities. 

But industry codes are not mandatory and are not the only way of observing proper standards of market conduct, and "it may equally be possible to observe proper standards of market conduct in other ways." 

The FCA does not want industry codes to become prescriptive rules or have the same status as the FCA rules that govern regulated markets. They will be just one factor taken into account when the FCA makes decisions about the use of its enforcement powers.

Equivalence Is No Solution For Most UK Financial Services Accessing The EEA

At the end of 2020, any UK financial firms operating in the EEA under a 'passport' will lose that right. They must either get a new subsidiary authorised in an EU/EEA country and passport from there, or get the subsidiary registered as an agent etc of a local firm with the right passports. Meanwhile, there are calls for the UK government to ask the EU to declare that UK financial regulation is "equivalent" to standards under EU law, so UK firms can continue to access the single market under UK rules. Here's why nobody should wait for that.

The UK has no 'right' to equivalence, even if it can demonstrate a basis for it.

Equivalence is at the discretion of the European Commission, so political considerations can affect the outcome and timing.

Equivalence can be withdraw at any time without any right of appeal (ask the Swiss).

Only two areas of EU financial regulation allow for equivalence - MiFID (2,250 firms as at August 2016) and AIFMD (212 firms).  In particular, an equivalence finding is not available for deposit-taking (102 banks), insurance (220 firms), insurance distribution (2,758 firms), e-money issuers (66) or other payment services providers (284).

While there have been calls within the EU for a broader framework, the European Commission has considered it and explained that this would be "extremely difficult".

Relying on equivalence would also require the UK to align with EU regulation in the relevant area, with no say in shaping the rules. The UK government is sending mixed messages on this point, having repeatedly said that it is against alignment while repeatedly claiming that it wants future trade arrangements (e.g. a 'Canada deal') that would require it. Johnson is probably hoping that his voters won't understand the magic trick, but everybody else does. Either way, the government is along way from being able to help the Commission work through an "extremely difficult" equivalence process.

You're on your own. The only viable option is to set up a subsidiary in the EU27 and passport from there. 

 

Let me know if I can help, either in the UK or in Ireland/EEA - particularly on e-money and payment services.

What Is A "Payment Service"?

I'm often approached by senior managers in businesses who've been asked this question - usually by their credit card acquirer, a financial regulator or a potential customer doing its due diligence. There's often no simple answer, but I've explained the main issues below. Please get in touch if you would like to discuss any of them.

Which types of businesses need to think about this?

This question tends to arises where your business:

• receives cash from one set of customers and makes payments to other customers. Examples range from e-commerce marketplaces, to law firms, to fully regulated payment service providers (including banks, e-money institutions and payment institutions);

• issues vouchers or other forms of value that can be exchanged for goods or services, either from the same business or some other participating retailers or suppliers;

• enables customers to send transaction data to their card acquirer, initiate a payment from their bank account or share bank statements or other financial information with third parties.

Depending on the circumstances any of these activities could mean that you are either:

• offering an "e-money" service and/or a "payment service", in which case you would and need some form of regulatory authorisation or registration; or

• your activities might be outside the scope of regulation, or in scope but specifically excluded from some or all of the authorisation or registration requirements.

How are payment services regulated?

Activities involving e-money and payments are mainly regulated throughout the EEA under national regulations that implement the second Electronic Money Directive (EMD) and the second EU Payment Services Directive (PSD).

These two directives are 'maximum harmonisation' directives, which means each EEA member state is supposed to apply them the same way (subject to a few permitted options). However, the interpretation by one country’s regulator that a service is either out of scope of the EMD and PSD, or in scope but expressly excluded, cannot be ‘passported’ to other EEA countries. So it is prudent to check the interpretation with local counsel in each significant EEA market in which you intend to operate.

If your activities are in scope, and not excluded, then you would need to be authorised as an E-money Institution (EMI) or payment institution (PI), or registered as small EMI or PI or as the agent of an EMI or PI. If you offer 'account information services' then you only need a registration; and some types of exclusion also require you to register with the local regulator.

A fully authorised firm may “passport” its services into other EEA countries (or rely on its principal’s passports if it is a registered agent).  Because of Brexit, however, UK-based institutions would need to set up an entity based in one of the remaining EU27 countries, or an EEA member state, from which to passport services around the EEA; and EEA-based firms can either register for a temporary permission (by 30 January 2020) or set up a UK subsidiary and apply for the relevant authorisation or registration locally.

What is a payment service?

Unless you enable the collection and withdrawal of physical cash, the “payment services” you are most likely to be concerned with involve:

• the 'execution' (processing etc) of payment transactions involving card-based payments, bank/credit transfers, direct debits, either with or without credit;

• money remittance: where funds are received from a payer, without any payment accounts being created in the name of the payer or the payee, for the sole purpose of transferring a corresponding amount to a payee or to another payment service provider acting on behalf of the payee, and/or where such funds are received on behalf of and made available to the payee;

• issuing payment instruments: contracting to provide a payer with a payment instrument to initiate and process the payer’s payment transactions (a payment instrument is any personalised device(s) and/or set of procedures agreed between the user and the service provider that is used to initiate a payment order);

• aquiring payment transactions: contracting with a payee to accept and process payment transactions, which results in a transfer of funds to the payee (e.g. debit/credit card acquiring or 'merchant acquiring');

• payment initiation services: a service to initiate a payment order at the request of the user with respect to a payment account held at another payment service provider; or

• account information services: an online service to provide consolidated information on one or more payment accounts held by the user with on or more other payment service provider(s).

There are many related definitions, but the central one to understand is that a "payment transaction" means "an act initiated by the payer or payee, or on behalf of the payer, of placing, transferring or withdrawing funds [i.e. money, including "e-money"], irrespective of any underlying obligations between the payer and payee." This definition can involve some degree of legal fiction, such as when applied to card acquiring, which actually involves multiple payment transactions.

What is e-money?

The term “electronic money” or "e-money" means monetary value that is:

• electronically stored; 
• represented by a claim on the electronic money issuer, 
• issued on receipt of funds, 
• for the purpose of making “payment transactions”; 
• accepted by a person other than the electronic money issuer; and 
• not a “limited network” service.

"Limited networks" are services based on specific payment instruments that can be used only in a limited way and meet any one or more of the following conditions:

• allow the holder to acquire goods or services only in the issuer's premises;

• are issued by a professional issuer and allow the holder to acquire goods or services only within a limited network of service providers which have direct commercial agreements with the issuer;

• may be used only to acquire a very limited range of goods or services; or

• are valid only in a single EEA State, are provided at the request of an undertaking or a public sector entity, and are regulated by a national or regional public authority for specific social or tax purposes to acquire specific goods or services from suppliers which have a commercial agreement with the issuer.

The exclusion for limited networks also applies to payment services generally. This can include loyalty schemes, fuel card schemes and so on. Some regulators may consider gift cards as falling within this exclusion, while others may not see them as within scope of the PSD at all.

Is the service offered by way of business?

This is where a lot of uncertainty can arise because, in some countries (like the UK), the regulator is only concerned about payments activity that is operated or offered as a business separately or distinctly from any other activity. In other countries, however, this may not be a factor that the regulator considers to be very important, if at all.

So it's worth considering that if you are receiving money and paying it out or holding it on a customer's behalf only as a small part of a much wider service - like, say, a law firm - then it is possible that the local regulator might not consider your payments-related activity to be a "payment service" in its own right (but of course other laws and/or professional rules may apply to those scenarios anyway).

It is also worth exploring any opportunities to re-position or integrate the payments activity so that it is not offered by way of business in its own right.

Even if your activity is in scope, could an exclusion apply?

Some activities that initially meet the test of being a "payment service" might actually benefit from a specific exclusion under the EMD or PSD.  There is quite a long list of possible exclusions. Some reflect day-to-day activies, like paying another person directly, paying by paper cheque etc., or physically transporting cash. Others are quite specialised and/or involve a lot of explanation and the possibility for regulators to interpret them differently, as with the scope of the EMD or PSD.  Exclusions that are likely to involve considerable legal analysis are:

• the commercial agent's exclusion: covers payment transactions from the payer to the payee through a commercial agent authorised via an agreement to negotiate or conclude the sale or purchase of goods or services on behalf of only the payer or only the payee;

• the technical service providers exclusion: covers services which support the provision of payment services, without the service provider entering into possession of the funds to be transferred - like 'payment gateway' services or anti-fraud services, for example. These services include processing and storage of data, trust and privacy protection services, data and entity authentication, information technology (IT) and communication network provision, provision and maintenance of terminals and devices used for payment services, but exclude payment initiation services and account information services;

• the limited network exclusion, which I've already mentioned above in relation to e-money.

Conclusion:
Again, there is often no simple answer as to whether your activities constitute a regulated e-money or payment service, but I've explained the main issues above. Please get in touch if you would like to discuss any of them.