Register today for this webinar that summarizes Aite Group’s PSD2 Research Report, commissioned by iovation, a TransUnion Company, providing an in-depth analysis of how those in the payment services and e-commerce market should prepare to handle the new strong customer authentication (SCA) requirements under the second Payment Services Directive (PSD2). Join Angie White, Product Marketing Manager and PSD2 expert at iovation, a TransUnion Company, and Ron Van Wezel, Senior Analyst at Aite Group's Retail Banking and Payments Practice, as they analyze the results of the actual market status in Europe regarding the main changes that PSD2 will bring to the online payments market. Learn what Aite Group concluded after interviewing 20 payments executives from European banks, other PSPs, merchants, payment networks and industry experts. Key takeaways: The impact of PSD2, highlighting the priorities that organizations have yet to manage in the transition to the new world after PSD2. How organizations seek to implement the requirements for secure customer authentication (SCA) and minimize the impact on customer experience. An analysis of the potential of payment innovation and open banking as a result of PSD2. If you haven’t already, register for this complimentary research report, PSD2: Advent of the New Payments Market in Europe. Read the overview of the implications of PSD2 for the payment space in relation to fraud prevention and authentication, including recommendations for banks and other players on how to comply while minimizing friction during the payment process.

1. ©2017 Aite Group LLC.Page 1
PSD2: Advent of the new payments
market in Europe
Webinar
14 March 2019

2. 2
RON VAN WEZEL
S E N I O R A N A L Y S T , A I T E G R O U P
ANGIE WHITE
P R O D U C T M A R K E T I N G M A N A G E R ,
I O V A T I O N

3. Contents
 Brief introduction to the PSD2
 The impact of SCA
 The arrival of open banking
 Maximize SCA exemptions and
reduce friction
 Conclusions

4. Maximize SCA exemptions, reduce friction

5. ©2017 Aite Group LLC.Page 5
Brief introduction to the revised Payment Services Directive
(PSD2)
• PSD2 strengthens consumer protection and security requirements for companies
providing payment services in the EU.
• PSD2 opens the EU payment market for innovation and competition, by giving
consumers control over the access to their account data.
• The legislation will affect every business operating on the European payments market,
but the most significant impact is expected for e-commerce payments.
• PSD2 will have both direct and indirect consequences for companies based outside the
EU.
• Direct, as any company providing payment services in the EU will require a payment license and
must comply with the directive.
• Indirect, as the stricter requirements for fraud prevention in the EU will drive fraud to other
regions such as the US.

6. ©2017 Aite Group LLC.Page 6
Two main areas of change that PSD2 brings
• Strong customer authentication (SCA): PSPs must apply multifactor
authentication for all electronic transactions unless such transactions
qualify as "low risk".
• Access to the account: banks and other account-holding PSPs must
provide third-party access to the payment account for the following
services:
• Account information services: PSPs can access (multi-bank) balance and
transaction information on behalf of their customers.
• Payment initiation services: PSPs can initiate payments directly from their
customer's bank account, even if the account is held with another PSP.
• Availability of funds check: PSPs that issue cards can check if there are sufficient
funds on the cardholder's bank account.

7. The impact of SCA

8. ©2017 Aite Group LLC.Page 8
The SCA requirements
• SCA requires banks to invoke multifactor authentication of their customer for
an electronic transaction.
• SCA must be based on at least two of the following independent factors that
identify the customer:
o Knowledge: This is something only the customer knows, such as a password or PIN.
o Possession: This is something the customer has—for example, a smartphone or hardware
token.
o Inherence: This is something the customer “is,” e.g., a biometric factor such as fingerprint
or facial recognition.
• The authentication must result in the generation of an authentication code
that is linked to the amount and the payee, and therefore binds the code
uniquely to the transaction ("dynamic linking“).

9. ©2017 Aite Group LLC.Page 9
Managing friction at the checkout: multi-layered approach
Offer non-regulated
payment methods
Apply transaction risk analysis to
filter out low risk transactions
Filter transactions that are
exempted from SCA
Optimize the user experience for
transactions that require SCA
Alternative e-payment
Methods
Transaction risk
analysis
Optimize user
experience
SCA
exemptions
e-commerce transactions

10. ©2017 Aite Group LLC.Page 10
Layer 1: offer non-regulated payment methods
• The SCA requirements only apply to electronic payments that are
initiated by the payer.
• This creates the opportunity for merchants to offer frictionless
payment methods that are initiated by the payee, such as direct
debits (e.g., for subscriptions, pay-as-you-go). Only when an
electronic direct debit mandate must be signed by the customer,
SCA is required.
• Merchant-initiated card payments are not yet exempted from SCA,
but the debate is ongoing.

11. ©2017 Aite Group LLC.Page 11
Layer 2: apply transaction risk analysis to filter out low-risk
transactions
• With TRA, the risk of a particular transaction is assessed in real-time to
spot abnormal spending or behavioral patterns, changes in the user's
device, suspect location of the payer and/or the payee, and other criteria.
• The application of the TRA exemption depends on the average fraud rate
of the PSP.
• Given the strategic relevance of a smooth customer experience for
merchants to drive conversion, PSPs that may apply the TRA exemption
for higher amount thresholds will be in demand.
• There are different strategies for PSPs to improve reported fraud rates
and stay competitive.

12. ©2017 Aite Group LLC.Page 12
Layer 3: filter transactions that are exempted from SCA
• PSPs can make use of the other exemptions (next to the TRA exemption)
offered by the RTS, such as the low value payment exemption, or the
exemption of recurring payments of a fixed amount.
• The exemption for trusted beneficiaries (whitelisting) exemption is
important for merchants that depend on card-on-file payments today.
Whitelisting is also an option for recurring card payments for a variable
amount.
• However, the whitelisting exemption can only be applied by the issuer.
Market reality is that whitelisting may not be supported by a majority of
issuers, at least not by September 2019.

13. ©2017 Aite Group LLC.Page 13
Layer 4: optimize the user experience for transactions that require SCA
When implemented badly, SCA can introduce friction in
the check-out process that impacts conversion in a
negative way. But merchants have several measures at
their disposal that will mitigate this risk.
• “Pay later” methods can contribute to higher client
satisfaction and increased conversion. SCA will still
be required when the customer initiates the
payment, but the control of the customer over
when, where and how to pay will make a SCA
challenge less intrusive for them.
• For remote card payments, the new version of the
3-D Secure (3DS) protocol developed by EMV (3DS
2.0) provides the framework for SCA compliance
and improved customer experience in a PSD2
world.
• 3DS 2.0 represents a major upgrade compared to
the earlier versions of the protocol. It enables
issuers to make more informed decisions based on
data provided by merchants and acquirers.
• 3DS 2.0 will provide a better balance between
security and a frictionless payment experience.

14. ©2017 Aite Group LLC.Page 14
Is the market ready for SCA?
• There is a lack of orchestration of the PSD2 implementation around Europe. Varying choices in the
implementation of the SCA requirements on a country and individual bank level, differences in
interpretation of the directive, and different timelines may create confusion that merchants have to
navigate.
• Another issue is market awareness of the SCA requirements. According to recent Mastercard research,
awareness among small merchants is low:
• Only 25% of European online merchants are aware of SCA requirements under PSD2. Awareness is twice as high among
merchants having more than 500 transactions per month (40%) compared to those with less than 500 transactions per
month (20%) – possibly a function of higher importance of cards in running their online business.
• Of those merchants that are aware of SCA requirements and PSD2, only 10% were informed about it by their acquirers. 44%
were informed by their PSP (payment gateway provider) and 37% via the Internet.
• Only 14% of European online merchants already support SCA, while another 28% mentioned SCA will be ready for
September 2019. 24% of European online merchants interviewed have no plans (yet) to support it.
• The majority of online merchants interviewed are not aware of the challenges the new European legislation may pose to
their business.
• European online merchants have a preference for receiving further information through their PSP (32%) and by email
(31%), less so via banks (18%). 13% of European online merchants consider that they don’t need any further information on
PSD2.
• This is a call to action for acquirers and PSPs to step up their communication and realize a smooth transition
to the SCA requirements.

15. 15
5.9 Billion Devices seen by our network
42
Billion
Transactions protected
26
Million
Transactions protected per day
35,000 Websites and Apps Protected
16 Million Daily logins protected
66
Million
Fraud reports placed by our cybercrime network

16. 16
Baymard estimates that 28% of carts
were abandoned because of a
checkout process that was too
long/complicated”

17. WHAT’S THE
SOLUTION?

18. 18
Lower Fraud Rates to Maximize Exemptions
Machine Learning
Predict Trustworthiness
of a Transaction
Authenticate
Use 2 or more
independent elements:
(1) Knowledge
(2) Possession
(3) Inherence
Authorize
Dynamic linking of
transaction to specific
payee and amount
with push
Authorization
Frictionless Strong Customer
Authentication
MEET SCA REQUIREMENTS OF PSD2

19. TRANSACTION RISK
ANALYSIS

20. 20
TRANSACTION RISK ANALYSIS
R E Q U I R E M E N T S
To be allowed the exemption based on transaction risk analysis, the solution
must be operating in real-time and must verify a transaction against anomalies
in user behavior. Check points shall include the following:
• Previous spending patterns of the payer
• Payment transaction history of the payer
• Location of the payer and the payee at the time of the payment
• Previous use of the access device or the software provided to the payment
service user for SCA

21. 21
TRANSACTION RISK ANALYSIS
R E M O T E C A R D - B A S E D P A Y M E N T S
Exemption
Threshold Value
Reference Fraud Rate %
Remote Card-based
Payments
€500 <0.01
€250 0.01 - 0.06
€100 0.06 - 0.13
0 - €30 Default

22. 22
 One click shopping: Being able to expedite payment processing for a
higher volume of transactions.
 Cost savings: Reduce the overall number of transactions subject to higher
cost SCA checks.
 Reduced friction: Only step-up transactions above the exemption
threshold or with risk signals to SCA.
COMPETITIVE ADVANTAGES
T R A N S A C T I O N R I S K A N A L Y S I S E X E M P T I O N S

23. SCA WITHOUT THE
FRICTION

24. 25
2 or more
independent factors
of:
• Knowledge
• Possession
• Inherence
Out-of-band
Element’s are
independent, so the
breach of one does
not compromise the
reliability of the
others
Dynamic linking
Tie the transaction to:
• specific amount
• specific payee
with a unique
authentication code
Strong Customer Authentication (SCA) Requires:

25. 26
v Or this much assurance?Do you need this much
assurance?
Σ Risk mitigation by authentication challenges = (Probability of compromise) x (impact)

26. Match
Grant
Access
No
Match
or Risk
Signals
Account-to-
Device Pairing &
Risk Evaluation
Persistent
Session
Token
Login
User
Access
Customer
Access
Login
Device
Registration SUCCESS
Step-Up
***
DEVICE-BASED AUTHENTICATION
***

27. 28
 Transparent
 Risk insights
 Possession factor
 Shut down ATO
DEVICE-BASED AUTHENTICATION
B E N E F I T S

28. MOBILE MFA
CAN WE MAKE THIS ALL EASIER ON OUR
CUSTOMER?

29. 30
Something you
KNOW
Something you
HAVE
Something you
ARE
LaunchKey
Unified, Simplified And Personalized MFA

30. 31
LaunchKey
Unified, Simplified, and Personalized Multifactor Authentication
“How can I provide strong, unified authentication for security-conscious customers?”
Through any channel, digital or physical

31. CLEARKEY
DEVICE-BASED AUTHENTICATION
FRAUDFORCE
DEVICE-BASED REPUTATION
LAUNCHKEY
MOBILE MULTIFACTOR
AUTHENTICATION
LOGIN CALL CENTER
PURCHASE
SUBJECT TO SCA
ACCOUNT SETUP
PURCHASE
FRAUDFORCE FRAUDFORCE
Solve For:
Fraudulent Accounts
Promotions Abuse
Solve For:
Account Takeover
Call Center Fraud
Shipping Fraud
Solve For:
Account Takeover
Customer Friction
Solve For:
SCA Requirements
Promotions Abuse
CNP Fraud
Shipping Fraud
Gift Card Fraud
Solve For:
Promotions Abuse
CNP Fraud
Shipping Fraud
Gift Card Fraud
FRAUDFORCE
Optimized E-Commerce Buyer’s
Journey

32. The arrival of open banking

33. ©2017 Aite Group LLC.Page 34
PSD2 enables payment innovation and open banking
Examples of open banking applications are the following:
• Personal financial management: TPPs can collect balance and transaction information
through account information services on a multi-bank basis.
• Credit scoring and lending: TPPs can use account information services to develop a
credit score on the customer that is based on actual, recent transactional data.
• Loyalty: retailers can use their customer's transaction data to make better offers.
• Decoupled debit: PSPs that issue cards can check the availability of funds on their
customer's account before executing the payment.
• New payment methods: TPPs can use payment initiation services to develop account-
based payment services that compete with cards.

34. ©2017 Aite Group LLC.Page 35
PSD2 payment initiation looks promising…
The payment initiation models that PSD2
enables hold a lot of promise for e-
commerce payments, in particular in
combination with real-time payment (RTP)
payment clearing rails that are rolled-out all
over Europe. PISPs would be able to offer
merchants a service that seems to beat
existing card solutions for reasons of
service and price.
The advantages of payment initiation
services are:
• Faster settlement of funds
• Irrevocable payments
• Lower fees
Live example: KLM Air France in the UK

35. ©2017 Aite Group LLC.Page 36
…but market reality is still challenging
• Local payment culture is an inhibitor to the
development of payment initiation services in
Europe. PISPs will face strong competition from
existing payment methods which can be cards,
online banking, or other methods.
• PISP offerings can be attractive to merchants but
they need to provide strong incentives to their
customers to make them change their payment
preferences.
• There is no centrally governed program to
implement the PSD2 requirements across Europe.
This lack of governance will lead to fragmentation
and a lack of standardization that will hinder the
development of new payment services in Europe.
Bank transfer
Card payment
Other
Dominant Online Payment Cultures in
the EEA (source: Aite Group, Central
Banks, PSP websites)

36. Conclusions

37. ©2017 Aite Group LLC.Page 38
Conclusions
• PSD2 changes the rules of the game for the European payments industry. By September 2019, payment service providers have to comply with
the directive's requirements for strong customer authentication (SCA) and third party access to bank accounts.
• There are sufficient tools available in the market to mitigate the risk of a deterioration of the consumer experience in e-commerce due to the
PSD2 SCA requirements. However, the issue is a lack of orchestration of the PSD2 implementation around Europe. Varying choices in the
implementation of the SCA requirements on a country and individual bank level, differences in interpretation of the directive, and different
timelines may create confusion that merchants have to navigate.
• Another issue is market awareness of the SCA requirements. Only 25% of European online merchants are aware of the SCA requirements
under PSD2. This is a call to action for acquirers and PSPs to step up their communication and realize a smooth transition to the SCA
requirements.
• The new account-based payment models that PSD2 enables hold a lot of promise for e-commerce payments, in particular in combination with
real-time payment clearing rails that are rolled-out all over Europe. Such payment models could offer merchants a service that seems to beat
existing card solutions for reasons of service and price.
• Still there are a number of factors that will hinder the adoption of these new payment models from both the demand and supply side. The
main challenges are how to change established consumer payment preferences; and how to develop a consistent payment offering in a
fragmented European market. The conclusion is that PSD2 will not form a threat to card-based payments on the short to medium term, say
within the next five years. It is not clear how a consistent, user-friendly offering can be developed for the European market that is attractive
enough for consumers to change their payment preferences.

38. Q&A

39. ©2017 Aite Group LLC.Page 40
About Aite Group
Aite Group delivers research and guidance
to leading institutions and technology
providers across the global financial
services industry. With expertise in
banking, payments, insurance, wealth
management, and the capital markets, we
guide financial institutions, technology
providers, and consulting firms worldwide.
We are dedicated to helping our clients
make smarter decisions, faster, to
strengthen and grow their business.

40. 41© iovation. All Rights Reserved
About iovation
iovation, a TransUnion Company, was founded with
a simple guiding mission: to make the Internet a
safer place for people to conduct business. Since
2004, the company has been delivering against that
goal, helping brands protect and engage their
customers, and keeping them secure in the complex
digital world. Armed with the world’s largest and
most precise database of reputation insights and
cryptographically secure multifactor authentication
methods, iovation safeguards tens of millions of
digital transactions each day.