PSD2: Strong customer authentication for travel agency payments
Written By
Jonathan Stoldt
Associate
Germany
As an associate in our German Finance & Financial Regulation Group based in Frankfurt, I advise national and international clients on finance and regulatory matters.
Johannes Wirtz, LL.M. (London)
Partner
Germany
As partner in our Finance & Financial Regulation Group in Frankfurt, I advise our national and international clients on banking regulatory issues and finance law.
Just in time for the holiday season in Germany, the Federal Financial Supervisory Authority (BaFin) publishes a guidance letter on the regulatory classification of certain payment transactions in stationary travel sales.
The guidance letter deals with the question of whether strong customer authentication (SCA or also two factor authentication) is necessary for the usual booking processes in travel agencies. BaFin points out that the guidance letter only refers to stationary travel sales and cannot be transferred to online travel platforms. BaFin describes that the usual booking in a travel agency, where the travel agency is not the payee, is made in such a way that the employee of the travel agency receives the credit card data manually in the travel agency or by telephone or e-mail and forwards it to the tour operator. The tour operator then charges the credit card via its payment service provider (acquirer) by forwarding the credit card details.
BaFin clarifies that according to its administrative practice, strong customer authentication is not required for this payment. Unlike other card payments, for example at a terminal, the payment is not initiated by the cardholder (payer) via the merchant (payee). However, there is no direct contact between the cardholder and the tour operator, but the data is forwarded via an intermediary (the travel agency). The cardholder thus does not initiate the payment himself.
The process will be assessed differently if the traveller initiates the payment directly at the travel agency, for example via a payment terminal.
BaFin's clarification for the travel industry is to be welcomed. This provides clarity under supervisory law. However, BaFin reserves the right to change its administrative practice if a different decision is reached at European level or if the courts rule differently. However, it then wants to give the payment service providers involved a reasonable period of time to implement a new administrative practice, at least from a supervisory point of view. Civil law consequences, however, remain unaffected.
BaFin clarifies that according to its administrative practice, strong customer authentication is not required for this payment. Unlike other card payments, for example at a terminal, the payment is not initiated by the cardholder (payer) via the merchant (payee). However, there is no direct contact between the cardholder and the tour operator, but the data is forwarded via an intermediary (the travel agency). The cardholder thus does not initiate the payment himself.
The process will be assessed differently if the traveller initiates the payment directly at the travel agency, for example via a payment terminal.
BaFin's clarification for the travel industry is to be welcomed. This provides clarity under supervisory law. However, BaFin reserves the right to change its administrative practice if a different decision is reached at European level or if the courts rule differently. However, it then wants to give the payment service providers involved a reasonable period of time to implement a new administrative practice, at least from a supervisory point of view. Civil law consequences, however, remain unaffected.
