The PSD2, a new directive on payment services

The main change since PSD1 is that banks and non-bank entities can now offer you more efficient payment services thanks to technology.
PSD2 sets clear rules that promote innovation and competition in the field of payments. This precise legal framework allows banking data to be exchanged more easily and creates new services that meet your needs. On one condition, however: that you give your explicit consent.
In fact, you’re already benefiting from these kinds of services, which are the result of synergies between your bank and third parties. Think of Apple Pay or Payconiq... And that's just the beginning!

Today, as a consumer, you can grant certain rights to three types of payment service providers. You can authorise them to:

• consult your account
• make a payment
• ask your bank to confirm that the available balance in your account is sufficient to make the transaction you requested. The third party does not have access to your account balance, and can’t block any money in your account.

As regards the security of your payments and personal data, all payment service providers must prove that they’ve taken adequate measures in this regard. Moreover, all must be registered with their national supervisory authority and placed under its supervision: in Belgium’s case, this is the National Bank of Belgium.

You decide which third parties can access your payment and account data, and for which services. How do you give formal consent? By following a secure validation procedure using strong customer authentication (SCA). This is the validation you carry out when you use your payment card and card reader. So it’s impossible to access your data or send it without your explicit consent, because your data is protected. If you no longer want a third party to be able to check your account or make a transaction, you can withdraw their authorisation at any time, by informing the service provider directly. Also, if you don’t use the service regularly, you’ll have to give your formal consent again after 180 days. If you no longer want a third party to be able to check if your account balance is sufficient, simply contact your bank.

When we buy or order goods, making bookings etc., we’re doing so more and more online. You may be wondering if your payments are secure enough? PSD2 regulates European online payments and their security, and makes strong customer authentication mandatory. Today, in general, your card number and the three-digit CVV code on the back of your Bancontact-Visa debit card or your credit card are sufficient to make payments, especially on foreign websites. With PSD2, this will gradually change, at least in Europe. When you pay with your debit card, credit card or smartphone, you will have to prove your identity. How? Depending on the situation, you will use two of the following identification methods:

• Something you know, like your PIN
• Something you possess, like your card reader or smartphone
• Something that’s unique to you, like your fingerprint

As a bank customer, you’re already familiar with this procedure: when you log in to Easy Banking Web or Easy Banking App, you’re already using it. With PSD2, it will become the norm for all European payments, such as the hotel room you booked on a Dutch travel website or the nice gift for your children you found in a French online store. For non-European websites and in a few exceptional cases – such as small-value transactions and monthly subscriptions – this rule will not apply and you’ll still be able to pay with your card number and CVV code.

If you want to manage all your current and savings accounts with BNP Paribas Fortis, and those you hold with other banks, in Easy Banking App on an Android device, you can! No need to switch from one app to another to have a comprehensive view of your financial situation.

No more extra fees when you pay with your card online or in-store. This means no more additional charges when you pay by Bancontact or when you use a credit card in certain stores and online.

Have you lost your debit card or credit card? Has it been stolen? And has it been used to make a payment without your knowledge? Your excess (the amount not covered by insurance for the period until the loss or theft of the card is notified) is now €50 euros as opposed to €150 euros, provided there has been no fraud or gross negligence on your part.

Under PSD2, BNP Paribas Fortis provides statistics on its PSD2 APIs used by third-party providers.

All PSD2 APIs from BNP Paribas Fortis and their documentation are available via the API catalogue on the BNP Paribas Fortis Developers Portal.

To consult the information concerning the PSD2 APIs of Connexis Cash, please refer to the API catalogue of BNP Paribas Corporate and Institutional Banking (CIB) available on the BNP Paribas CIB Developers portal.

PSD2 statistics

PSD2 brochure

• French
• Dutch
• English
• German