Our previous newsletter covered the EBA guidelines on Secure Internet Payment. With this one let's get insight into the bible of how you do business in Europe in the payment space, namely:  Payment Service Directive V2 and more specifically on the security requirements for payment institutions and payment service providers.

Responsibilities: They  are responsible for taking all reasonable steps to protect the interests of their users and to ensure continuity and reliability in the performance of payment services. "Reasonable" meaning here: that security measures must be proportionate to the security risks concerned.

Security framework: They should establish a framework with appropriate mitigation measures and control mechanisms to manage the operational and security risks, relating to the payment services provided. 

Security Policy: They must establish and document a security policy,

Incident management: They must maintain effective incident management procedures  including for the detection and classification of major operational and security incidents.

Breach/Incident Notification: In the case of a “major" operational or security incident, payment service providers shall, without undue delay, notify the competent authority in the home Member State of the payment service providers. 
Where the incident has or may have an impact on the financial interests of their payment service users, the payment service providers shall, without undue delay, inform their payment service users of the incident and of all measures that they can take to mitigate the adverse effects of the incident. 

Note: There is no clarification of what a major incident could be...

Communication with competent authorities: They must  provide the competent authorities of the home Member State with:

1. A description of the procedure in place to monitor, handle and follow up a security incident and security related customer complaints, including an incidents reporting mechanism;
2. Their security policy, detailed risk assessment and description of security control and mitigation measures. Those measures shall take into account EBA’s guidelines on secure Internet payment (See PCI #42)
3. Regular (on an annual basis, or at shorter intervals as determined by the competent authority) updated assessment of their security risks and the measures that they have taken in response to those risks.
4. A description of their audit arrangements 
5. The secure procedure for notification of the payment service users in the event of suspected or actual fraud or security threats
6. Report any major security incident.

Strong authentication: They must apply strong customer authentication where the payer: accesses its payment account online; initiates an electronic payment transaction; carries out any action through a remote channel which may imply a risk of payment fraud or other abuses. 

Protection of user credentials: They shall ensure that the personalised security credentials of the payment service user are not, with the exception of the user and the issuer of the personalised security credentials, accessible to other parties and that they are transmitted by the payment initiation service provider through safe and efficient channels;

Handling of Personal data - Where personal data is processed, the precise purpose should be specified, the relevant legal basis referred to, the relevant security requirements laid down in Directive 95/46/EC complied with, and the principles of necessity, proportionality, purpose limitation and proportionate data retention period respected.

Cliquez ici pour modifier.

Why is it that US gets so many breaches and Europe doesn’t? That’s not the right question. The right question is why is that US is reporting their breaches and Europe isn’t? Because Europe gets them. When European organisation will start to report their  breaches we will probably see a spike in the number of breaches and wonder ourselves Where are all these breaches coming from so suddenly? They have always been there hidden under the carpet. The majority of the European regulation impose to report “significant” breaches. But what is the definition of a “Significant” breach? and there isn’t… so there is no significant breaches reported… 

The next newsletters will address major E​uropean Guidelines and regulations in the field of data protection. This first issue covers  the EBA Guidelines on Secure Internet Payment. 

Effective since August 2015 the EBA Guidelines on Security Internet Payment sets the minimum security requirements in the field of the security of internet payment to help protect European Consumers against payment fraud on the Internet. 

The European Banking Authority (EBA) is an independent EU Authority which works to ensure effective and consistent prudential regulation and supervision across the European banking sector. Its overall objectives are to maintain financial stability in the EU and to safeguard the integrity, efficiency and orderly functioning of the banking sector.The Authority also plays an important role in promoting convergence of supervisory practices and is mandated to assess risks and vulnerabilities in the EU banking sector.

It applies to financial institutions operating within European Central region and offering payment services through the internet including the execution of card payment and electronic money transfer. Also concerned by these guidelines are  national authorities  in each EU Member State that are competent for the protection of consumers' rights when dealing with credit or financial institutions. 

EBA expects all competent authorities and financial institutions to whom guidelines are addressed to comply with guidelines. Competent national authorities to whom guidelines apply should comply by incorporating them into their supervisory practices as appropriate and should ensure the application of these guidelines by the financial institutions under their supervision. Furthermore competent authorities must notify the EBA as to whether they comply or intend to comply with these guidelines.

It is not a coincidence that implementation of the above aspects are covered in details in PCI DSS as it was the main source of inspiration of EBA. So financial institutions applying PCI DSS have the assurance to meet the EBA data security guidelines. 

Whenever a financial institution outsource functions related to the internet payment to service providers, the contract should include provisions requiring compliance with the principles set in these guidelines.