PSD3 & PSR OUTCOME

Michael Salmony 0:12

Hello, my name is Michael Salmony and Ralf and Javier and I would like to Welcome you to another episode where we look at the legal side of payments and we have one of my favorite legal companies and legal people here and that's Bird & Bird and Scott who is always very lucid on these topics. So welcome Scott, maybe just tell us a little bit about yourself and maybe kick off with what you find interesting in payments at the moment on the legal side.

Scott McInnes (Bird & Bird LLP (00:40) Sure. well, good morning or good afternoon, everybody. Thank you very much for having me on the show. First of all, I'm a big fan of the podcast. I've been watching it for many months and years now. So thank you very much for having me. so I'm Scott. I'm a lawyer, as you mentioned, in an international law firm called Bird & Bird, where I specialize in financial services regulations and in particular payment services regulations. what is interesting in payments at the moment? Well, broad questions, I guess.

Everything's interesting in payments if you're a payments nerd, if you like the industry like I do, if you if you fell into that bath at some point and are looking at new regulations coming our way, which is obviously something we'll talk about. PSD3, PSD, PSR, about to be formally adopted by the EU legislator in the coming months, I guess. all the changes it will bring about to players that are currently regulated under PSD2, players that are

Not currently regulated under PSD2, but might get impacted by PSD2 or PS PSD3, PSR, and might potentially get regulated in the future under PSD3, PSR. The Commission obviously being in in at various conferences and events saying that PSD3 and PSR is not a revolution, unlike PSD2, that arguably was, PSD3 being PSD3 and PSR being an evolution.

I don't know if that's entirely true, to be quite honest. I mean, yes, there are things that were revolutions, like open banking, SCA, where arguably we will see an evolution under PSD3 PSR. But there are things under PSD3 PSR that are that I think might deserve the label of a revolution. I'm thinking of things like the exchange of of information that will now be allowed under PSD3 PSR between regulated payment service providers, PSPs.

But also between regulated PSPs and non regulated PSPs, like large online platforms, to allow those parties to exchange information for the purpose of fighting fraud, which I think is quite quite revolutionary, I would argue. and as I mentioned before, some companies in particular platforms that today operate on an unregulated basis under PSD2, but might need to get regulated under PSD3 and PSR, and that is obviously also quite

quite impactful I would think. So so yeah, l lots of exciting things happening.

Michael Salmony 3:05

So just for completeness sake, one could also add the digital euro law, is coming. MiCAR, which has already happened, but happy to focus on PSD3 and PSR if that's the main interest. You mentioned that some people are now going to be licensed who weren't before and vice versa. Maybe you could drill a little bit into that. And also this fraud topic where you said there's some provisions which allow participants

to share.

It's not mandated, as I understand, but it's allowed, which is an interesting thing because you would think banks should, must now exchange data to fight fraud and also with other industries. And also that will be effective and also just making the banks liable, right? I mean, there's quite a lot of shifts happening. Maybe you could just comment on a few of those.

Scott McInnes (Bird & Bird LLP (03:53) Sure. So on on the first topic, there are large online platforms today that basically intermediate the the sale or the provision of services or goods. where arguably those la those those large online platforms do provide a payment service today. Some of them do operate on a regular on a regulated basis. I'm thinking of well.

Just to mention one example, Airbnb is an example, I believe is an is regulated payment service provider. I believe in Luxembourg. That means that when a guest wants to rent a room or an apartment, typically that guest will pay Airbnb, and Airbnb will then pay the host. And that means that Airbnb is in receipts of the funds, in receipts of the money, therefore providing a payment service to one of these two parties, either the guest or the host, in practice, typically the host.

And therefore, Airbnb decided to seek an authorization under PSD2 for the provision of that payment service to the host. However, there are other platforms today that perform a similar type of activity, but that are not regulated. I.e. do not hold the payments a PSD2 license. typically because they rely on on one of the exemptions or the exclusions in PSD2, and one of them is is quite well known. It's called the commercial agent exemption.

So that allows an online platform to say, hey, yes, I might be in receipt of funds from essentially the buyer to the seller, but I receive those funds undercover of the commercial agent exemption, the PSD2, and therefore I can provide those payment services without the need of a PSD2 license and therefore without having to comply with any of the requirements of PSD2. The commercial agent exemption has always been a problem because we know that different national regulators in the EU interpret the scope of that exemption differently.

Some national regulators are more generous in terms of allowing platforms to use that exemption. And other national regulators, and France and Germany are typically the countries mentioned, are not very generous, actually very strict in terms of the conditions to be met to use that exemption. And therefore, we are now in situation where a lot of platforms use that exemption, but quite confidently in some countries where they know the regulator is pretty relaxed about it. But in other countries, do know that they are potentially taking a risk.

Because if they were ever challenged by a national regulator such as maybe France or Germany, maybe the regulator would say, Well, I I I'm not sure you qualify for that exemption at all. That exemption had moved already between PSD1 and PSD2, although it was meant to be stricter, although frankly the intentions in the recital of making it stricter were not necessarily implemented very strictly in the actual wording of the exemption itself. So in other words, the intention was to make it clear that less

Less platforms, less marketplaces could use it, but unfortunately the the changes to the actual text didn't really make the exemption narrower, if you like. Now the wording is again changing with PSD3 and PSR. So the wording is going to be well, the so the wording today is in order to use it, is to say, look, I'm either working for the payer or for the payee, and I'm I'm appointed, typically by the payee, to negotiate or conclude. That th those are the keywords today to.

To use the exemption to PSD2. The wording is changing under PSD3 and PSR. The wording is now going to be I've got and I can't I I can never exactly remember the wording, but it's it's I've got a real margin to negotiate or conclude. So that's going to be great for lawyers like me, because what the hell does a real margin to negotiate or conclude mean? not obvious at all. The intention I think is clear, is is to make it less more difficult.

To use the exemption, but what does a real margin to negotiate or conclude mean? that's gonna have to be tested. The European Banking Authority is given a mandate to publish some level two guidance on what that means, this real margin to negotiate or conclude. And we will then see how that guidance gets interpreted by the national regulators in the EU and see who today relies on the exemption and will continue to be allowed to use it in the future.

or not. And if they can't use it in the future, things are going to have to change. So they will have to to either well to either get a PSD3 license, but not not really attractive for a lot of you know of online platforms whose you know whose business is not to be regulated as a payment service provider and to have to comply with all the PSD3 obligations. Or more likely to to basically to essentially get out of the payments chain, to stop touching the money and to let somebody else do it.

So so to to essentially let a regulated PSP onboard all the sellers on the platform and to provide those payment services to those companies. And there are obviously a few regulated players like Adyen, like Stripe, who are essentially in the business of trying to make that happen and to onboard the sellers on those platforms precisely to get the platform out of the payments chain completely so that the platform does not have to argue whether or not it does qualify for the commercial agent exemption or not.

But if you do that, you obviously inject a new player in that chain. That new player needs to to to essentially earn a living and therefore charge fees for the services it's provided. and and those fees will have to get passed on to the users. So potentially making the payments chain a little bit more expensive. And and we know for years now that in in Europe we like payments to be fast, efficient, secure, but we like them to be cheap or not too expensive. So so

So there might be a bit of a tension there between between those two objectives, if you like, of making the commercial agent exemption more difficult to to rely on, but at the same time keeping the fees not too high for the recipients of payment services.

Javier 9:53

I think, Scott, that you are being very polite in terming the PSR and PSD3 as evolution. I think it's more about fine-tuning and amending what got missed in previous trials, like in PSD1 and PSD2. I think the regulator then missed many things, and now I think they are late. And they are trying to correct.

to amend what didn't work. But still they are failing in the same aspect that you have underlined, which is issuing rules that are interpretable. And that was the big, big, big mistake in PSD2. And what I see and from what you are saying, it's more or less the same with PSD3. So still we will be bound to interpretation first by EBA, then by whoever.

needs to land this secondary legislation. So again, I think we are missing an opportunity to clarify the environment and really to understand the market. And I fear that in a very short time, new legislation will be obsolete again. What do you think about it?

Scott McInnes (Bird & Bird LLP (11:13) I I agree with you. it's it's there are a lot of things in in legal text that are not even yet adopted that frankly are not clear and are already raising questions from clients. And we're already trying to solve those questions before we then get EBA guidance that may muddy the waters even further or clarify things even further if you're being a bit more optimistic than maybe I am sometimes. but it's it's true that we we are we are already debating about

legal interpretations of a text that has not even yet been adopted. So it is not ideal. On the other hand, it's very difficult to legislate. So I'm not trying to be too critical, because frankly, drafting something that that in in beautiful legal language that will be interpreted in the exact same way by everybody who reads the text is probably one of the most difficult tasks in life, I would argue. So I'm not trying to say that the EU legislator is doing a bad job. I'm just saying it's an awfully difficult thing to do.

But does that mean they've succeeded everywhere? Absolutely not. Commercial agent exemption is just one example. Frankly, there are many others already where I've got a lot of questions. What does that mean? And we've tested with colleagues internally to see who's got the same interpretations as me, and we could already see disagreements. So it is awfully difficult. so that's one, the lack of clarity on occasions, absolutely, maybe due to the process and how the process being implemented. I a lot of people throwing in amendments and then compromises having to be found. And you know, if you

If you let me win on this amendment, I'll let you win on the other amendment. And then you always end up with some weird compromises on occasions that might not be entirely clear. Frankly, it's the same thing with case law as well. I mean, in in the last couple of months we've had quite a few opinions from advocate generals in the Court of Justice in Luxembourg and just ten days ago a judgment from the Court of Justice in Luxembourg that deal with payments stuff. And frankly, some of those opinions and the judgment from ten years.

10 days ago in the so-called Batal Garant Nevillance case, or extremely obscure. That case is is related to what I was talking about. It's an intermediary that is touching the money, and the court decided that that intermediary is not providing a payment service in the first place. Therefore, it would not need to rely on the commercial agent exemption that I just talked about, because the court said that intermediary is not even providing a payment service at all, was what that party was doing. It was

It was it's a business where if I hire a contractor to do works in my house, for example, I would basically transfer the money to that intermediary. And once I give green light to that intermediary that the works were done in the correct way, that intermediary would then pass on my money to the contractor. And a lot of people would have thought until ten days ago, I guess, that that party was arguably providing a payment service, very similar to the example of Airbnb I mentioned before.

But the court decided that the intermediary is not providing a payment service in the first place. And there are some decent arguments in that judgment, but there are at least one or two arguments in that judgment that I'm not sure I would agree with. So even case law is creating sometimes more questions than answers. and then lastly, Javier, you mentioned essentially the timing, which is it takes an awful long time before a commission draft to regulate something and then the final text. So in the case of PSD3 PSR, it would have taken more than

three years essentially to move from f you know, the the initial commission's draft of June, I think, 2023 and and the final version of PSD3 PSR, which might be

October, November, December 26th, I guess. but by the time the text gets approved, by the time the text becomes applicable, which is 21 months later, and by the time people have to comply with it, a lot of things could have changed, from a business point of view, a technology point of view, new things coming to life, which means that by the time you have to comply with the text, the text is already, you know, essentially old law, if you like. So it's it's difficult to legislate.

It's difficult to legislate quickly, very clearly. so what do we do as an alternative?

Ralf Ohlhausen 15:25

Yeah,

well talking about quick. So I think Most of my blood, sweat and tears went into this PSD3 PSR for the last five years, if not longer. first two years in trying to persuade the commission to learn all the lessons and to come out with a good proposal, which mm I guess was sort of halfway right, but fifty percent of what we believed

Sh

was necessary, was missing. And then we spend the la the next two three years here talking to the well parliament and council and and getting those improvements still in, which well actually let me ask you Who do you think has achieved more on lobbying the open banking side of PSR, the banks or the fintechs?

Scott McInnes (Bird & Bird LLP (16:26) Good question. Slightly provocative, of course. I think I know what you would answer to that question, by the way, Ralf. But I would well, I would argue there are improvements for both. Right? So both the TPPs on the one hand got some things that I think they wanted that are new, that are better. But obviously the account servicing payment service providers, the ASPSPs, banks for short.

also got some interesting changes in there. So I'll risk a few examples on on the TPP side. Obviously it's good that you continue to get access to the payment account to provide PIS and AIS free of charge, no fee to be paid. That's obviously good. That was the position under PSD2. It could have changed, I guess, under PSD3 and PSR. In particular if you look at the you know the FIDA open finance proposal that had some component of the, you know,

the the the the data accessor, like the party seeking to get access to the open finance data would have to pay a fee to the company that maintained the infrastructure from which that data would be pulled. So that that that that is not something that has been imported obviously in PSD3 PSR. The the basic access to the basic stuff is still free of charge. So I guess that's that's probably a victory for the TPPs. on on on the ASPSP slash the bank side

Potentially one victory that one can think of is the is there's no longer a requirement to maintain a fallback or so-called contingency mechanism, i.e., if you decide to, well, you now have to expose a so-called dedicated interface to the TPP, but and and there's more requirements for that interface to be of good quality, good standing, as good as the interface that the ASPSP makes available to the user, et cetera, et cetera. and if it goes down, a process for fast recovery.

But there's no fallback anymore, which from the point of view of TPP is probably a negative move, if you like.

Ralf Ohlhausen 18:27

Well, c

could I i come in right there? Because d do you think there is life after the fallback? So

Scott McInnes (Bird & Bird LLP (18:35) Meaning?

Ralf Ohlhausen 18:36

is there is there I mean the idea is to have now everything more enforced, et cetera, so everything will come back. And but you know it's not only the fallback is not only about availability of APIs, it's about the functionality or missing functionality of the API. That's actually the the the by far bigger problem.

And so do you think that this will work in all the member states?

Scott McInnes (Bird & Bird LLP (19:04) Look, in i i in law, including payment services law, there's obviously two things. There's one the what the law says on the one hand, and then there's the reality of what isn't happening in in the reality in the market. I mentioned commercial agent exemption before. I think there's clearly a mismatch there between what the law says on the one hand and what we see happening in practice. I think for open banking, let's not be foolish, let's not be over you know, too positive. I think there will be also a disconnect.

in in some places, in some countries, sometimes for some functionalities between what the law requires on the one hand and what we will see in practice. And yes, will we see more enforcement by national regulators against banks that do not provide good quality APIs or not good enough quality APIs, some services that might be lacking, some data that might not be transferred. Sure, I think we will see more enforcement, because I think, you know, a clear signal is being sent by the EU legislator now. And

And and the Commission and the EBA to the national regulators that you need to be essentially better equipped, you need to pay more attention to those things, you need to be faster, you need to threaten more, and you need to have more powers than maybe you had in some countries to actually sanction people or to threaten to sanction people. So that's that's the legal theory. In practice, is it going to be perfect everywhere? Will the APIs work everywhere? Will all regulators immediately jump on the ball when a TPP makes a complaint and investigates and within

Two weeks or a month, will all the issues be solved? Of course not. Of course not. Because it's it's a complex area. First, the regulator would have to understand what's going on to dissect it. They're not tech experts who can go into an API and start dissecting it, see how it works, what is actually being provided. And frankly, there are also you know l legal processes that need to

be followed. There are things such as rights of defense. The bank will have a right to expose its argument to say why it believes the API is compliant, potentially take the matter to court, and for a court at some point to to potentially come up with a judgment. And that might take a very long time, that could be referred to as forever for for the business of a TPP. So I'm I'm I'm reasonably optimistic that things are going to improve, but by how much of a delta is it going to be

A twenty percent delta, are you twenty percent improvement? Or is it gonna be a fifty, sixty percent improvement? I think it's difficult to say at this stage. So we will see an improvement, but is it gonna be a a big bang improvement and all the APIs are gonna be absolutely perfect for threat of enforcement by national regulators? I'm I would not be that optimistic to be honest.

Javier 21:43

Scott, my concern is not whether banks will be better off or TPPs will gain a victory against the rest of the world in their efforts. It's whether the citizens will benefit from this legislation. That's what I really am hesitant about. What I see is that it will make things more complex, more costly, even in that part of the legislation which is

so paternalistic and populist to say to protect the consumer, which really will not protect anybody. Even in that sense, I think it's useless. But will really this have an impact on the citizen making his or her life easier, cheaper, faster, or will be just adding complexity to the world of payment?

Scott McInnes (Bird & Bird LLP (22:40) Do you want my views on that? because frankly the answer is I I I don't know. I mean, you're absolutely right. Of of course, this is all meant to be for the better good of the consumer, more choice, cheaper fees potentially, although I mean

I'm not sure that actually payers do any fees pay any fees today for payment initiation services typically pay by the other side by the merchant side by the payee side but it's got to be cheaper faster reliable more choice and that's obviously also when the digital euro project that you mentioned Michael comes in it's for me to have more choice i.e I I go to a point of sale whether in a brick and mortar shop or online instead of using my classic card or potentially a PIS or potentially some kind of wallet

I will now be able to use the digital euro. And that's also meant to be, you know, more choice, cheaper, safer, greater, more European.

Javier 23:33

But at what cost? But at what cost?

Scott McInnes (Bird & Bird LLP (23:35) But at what cost? Absolutely. Because let's face it, I mean, our consumers, I mean, does a consumer know always in practice whether he's using his card to pay or using a payment initiation service? I mean, I'm not too sure. I think all the people on this call would know, but I'm not sure the consumer will always know in the future when the consumer will be told, hey, in addition to

to paying me via a wallet, for example, PayPal or Apple Pay or your regular MasterCard card or Visa card outside the Apple Pay wallet, or potentially a PIS. There's also the digital euro options. When does it get really con I mean really confusing for the consumer who will say, I have no idea which you know which button I'm supposed to press on? This is all very consuming. it's all the

Very complex. There's too much choice out there. Which one is better? Which one protects me better, actually? As a consumer, as the payer, am I better protected if I click on Visa or MasterCard? Am I better protected if I click on PIS? Am I better protected if I use my digital euros? And by the way, what's the difference between digital Euros and a PIS or MasterCard Visa? Very confusing, I think, for consumers who will have to be to get educated. but I I'm I'm I'm with you. I think at some point giving too much choice to consumers is

is confusing. and and consumers will not know which which solution to use, which one is better. they might continue to use the one they used to, frankly, because that's the one that they know how to use. They know how to do SCA for that particular payment method in particular, so the payment doesn't fail. So it's going to be really costly, absolutely all those projects

that we teak you know that we talked about. Is it really going to improve life of European consumers? I'm I'm quite skeptical. And I think you're too Javier.

Michael Salmony 25:20

Can I just ask you some more, maybe a fundamental question or... I mean, Javier, think, put his finger on it. Surely the whole goal of this should be to make consumers and businesses' lives better. And another goal is surely the European integration, that we want to get a pan-European approach to things. Now, when I hear what you said about the CAA, it sounds awful.

It sounds like everybody is going to do their own interpretation and lots of lawyers and every country doing its own thing. Another example is the responsibility for enforcing the APIs is left to national, the NCA's. So again, we have the fragmentation and we already know that there's huge divergence in how these NCA's enforce. So that's asking for trouble. That's not going to provide the European convergence. And I thought, now that we have PSR,

a regulation, which by definition is pan-European, we should have actually used this step to actually make things more harmonized. Just to give a counterexample, in the stablecoin world, MiCAR2, they are now thinking about harmonizing all the controls in one place precisely because they know doing it in 27 different ways across Europe ain't working.

Are we losing sight, or is the regulator losing sight of this pan-European vision, mission that we should all be on?

Scott McInnes (Bird & Bird LLP (26:50) Don't think they're losing sight of it, but I think if you entrust one regulator to enforce it throughout the EU, I mean how large does that regulator need to be? that regulator would need budget. I if you've got one authority to enforce, let's say, all open banking APIs throughout EU 27, I think it is now member states. How large does that regulator need to be? how much budget does it need? How much money does it need? And frankly, does it it also ensure

Absolute consistency 'cause that regulator will get quite large. Different people may be looking at different countries, so they may have team looking after a cluster of country, a second team looking at another cust and

Michael Salmony 27:26

Sorry, can I just push back

on that? Because I'm not convinced it can't work because there are plenty of examples in the European regulatory space, in securities and others where there is a single regulator. And also I'm not convinced that one big regulator is going to cost more than 27 small ones.

Scott McInnes (Bird & Bird LLP (27:45) No maybe not. but but but it that that new regulator to be created will need budget. That budget will need to come from somewhere. So does that mean that essentially national regulators will basically get rid of people and that frees a budget for them to then contribute to the budget of the new regulator enforcing PSD2 or or PSD3 APIs going forward? also I I I suspect that's on on I mean

That central regulator based in you know a member state, I mean they will need to basically well to first decide in which member state they're gonna put that regulator, which is always you know a source of debate. second, the budgets will need to come from somewhere. Third, I think a lot of member states will push back against it, saying, How come that you know more and more things are being centralized?

We know that under some regulations, the fact that enforcement is being centralized is now being is actually now being criticized. I'm thinking of one regulation in particular, which is called the Digital Markets Act, the DMA, that essentially is is a regulation that essentially forces the large big tech companies to do stuff, basically. And the enforcement is centralized with the European Commission. A lot of people are now saying, well, that because it's centralized with the European Commission, things are taking forever.

Because the Commission is not staffed enough to do those things, that enforcement should be actually transferred to the national member states. we've seen the same process in other areas, quite frankly. I'm thinking of competition law in particular, which used to be enforced essentially by the European Commission. And since 2003, more and more the Commission has said, look, we can't enforce all those big cartels, all those abuse of common of a dominant position. That can't be all enforced by the European Commission. so it needs to be sent back to the member states for the member states to enforce it.

And the way to do it is allegedly to talk to each other, to make sure it's been interpreted the same way and forced the same way, but it needs to go down to the Member States for enforcement. Otherwise, we in Brussels are too slow enforcing it, too slow doing it, it's too costly. And we need to ask Member States for even more money to the EU, which might not be an easy ask, frankly, to ask Member States to to pay even more money to the EU. So I think in theory it sounds nice, I think, to have one regulator potentially with, I don't know, three hundred, four hundred, five hundred.

Yeah.

Four, five hundred people enforcing, for example, open banking. in practice, I just think it's unlikely to happen because again, it's gonna be costly, it might be really slow to enforce, it will not factor in the you know the the natural market nuances if there are any to take into account. It will be a central view taken by somebody, I don't know, in Frankfurt for the whole of the EU or in Milan for the whole of the EU. So

I think there were pros and cons essentially, that's what I'm saying. So it sounds it sounds good on one head, it ensures consistency, et cetera. But I I can see also a lot of drawbacks in having everything centralized with one regulator. So and in any event, I think it's unlikely to happen. and that's obviously the case in many, many areas. I'm thinking of anti-money laundering, it's the same thing, obviously, is being enforced by national regulators. Yes, we do have a pan European regulator now. that is that will try to make sure that the enforcement

across the different countries by national regulators is consistent that they read the regulation because there too they move from a directive to a regulation, same trend, that the regulation will be read in the same way by national regulators, the enforcement will be consistent, etc. That's the intention. Is it going to be perfect? Of course not, but that's clearly the model y you know they're following with PSR here. It's it's national enforcement, no pan-European authority with any powers as such.

accept the power to try and make sure that those national regulators talk to each other, read the text in the same way, enforce them in the same way. But it's not gonna be perfect. So

Javier 31:45

Yeah, I think Scott, what you have been describing is what I call sloth, legislative sloth. Because they do not do things because they are better or worse, because they abort doing something. So you said about this authority being staffed with 500 people. I don't know if that's good or bad. How many people are now devoted to the same mission? Maybe even more, maybe even 1000 or 2000. Nobody knows. And that's the problem that we don't know.

And the reason why, as Michael was suggesting, we don't have this single authority, it is not because it has been analyzed and compared and decided that it is better to do otherwise. It is that they fear doing something because of the potential obstacles or reactions from member states in this case. But it is not that they have analyzed it is better doing this or doing that. It's that...

they follow this law path. It's easier to do what they are doing. And the same, I fully agree with you and I don't know what's, I agree with your comment. I don't know either what's better or what's worse. But for instance, when you said that legislating is difficult, yes it is. Nobody denies that. But how much effort has been put in these two pieces of legislation? How many man days have been devoted to that? We don't know. We don't know how many hundreds of people

working for weeks have been doing this and we don't know, we can't assess whether the effort was worthwhile or not. That's what I regret and complain about, that we are kept in a pool of ignorance because we, perhaps we are not enough smart to understand these nuances. That's what I complain about. Sorry for this contribution.

Scott McInnes (Bird & Bird LLP (33:40) I know. Makes sense. Makes sense. it is i it it's taken a lot of efforts. A lot of people have been lobbying on it. Absolutely. A few a few people were holding the plan you know you know, the pen in the European Commission, in the Parliament, in the Council. they on occasion land where they land for good reasons sometimes, arguably bad reasons sometimes when it's a compromise on the text that doesn't make

much sense, but sometimes they get something else in return. That's actually a political agreement, which is not ideal. Unfortunately that's how you know that's actually how the kitchen operates. I so on occasion you you you you don't know how many chefs are in the kitchen actually cooking stuff. and and at some point the sausages come out of the kitchen and you don't really know what the sausages were made of, why the sausage looks that way, what was injected in the sausage or not injected in the sausage, what's missing.

You discover that later when the sausage is on is on your plate and you eat it. Absolutely.

Ralf Ohlhausen 34:37

Yeah, one of

the biggest one of the biggest sausages being discussed was that fraud, how to improve on the fraud side, in particular, you know, the authorized push payment and reimbursements and all that and the liability onto the

PSP. And there was this big discussion about moving to or the intent

So basically judging by the intent of the payer, which the banks of course didn't like, what was the outcome now on on that topic?

Scott McInnes (Bird & Bird LLP (35:16) So I would argue that's another topic where I think the ultimate outcome is not really satisfactory. you're absolutely right. There were basically two positions that were being pushed for here. One was based on the the subjective element, i.e., what did the payer try to do? And the other one was more objective. So it's all linked to the concept of consent. What did the payer consent to do?

Was he if if the payer performed an SCA, surely he was happy for that payment to go through? Therefore, he consented to that payment. Bad luck, that money just landed into the wrong hands and the money's gone and the fraudsters run with it, etc. But he consented to that payment, and we can prove that in particular because he performed SCA, right? So so that was the objective your were saying, Well, look, very sorry, but you consent to that payment, you authorize that payment. but the other view was

very protective of the consumer is to say, look, surely, yes, he did the payment, surely he did SCA. We know it's him who was behind his computer or his mobile phone when the payment was made, but surely he never meant to pay somebody who ran away with his money. He was trying to pay for that pair of shoes or or or that new phone or whatever it might be. and I I think we're still somewhere, somewhere in the middle, i.e, the text now says again, it's all back to consent. What did he consent to do?

And what is what they mentioned in there is say, well, look, in particular, you cannot draw consent, i.e., my authorization to payment, just because I've done SCA. That's one of the factors to be looked at, but there are a number of factors to be looked at to see whether I authorize that payment. But it's not just the subjective element. I it's not going to be good enough for me to s to say, look, I didn't mean to pay a fraudster, therefore you, my PSP, need to refund me. That's not enough for me to get the money back. On the other hand,

It's it's not enough for my PSP to tell me you did SCA, therefore I'm not giving you your money back. The position is somewhere in the middle because there are a number of factors the PSP will have to assess to see whether or not I did generally authorize that payment. I consented to that payment. And my PSP will no doubt hold against me the fact that I performed SCA, but that's not enough. He needs to come up with more arguments as to why in that particular scenario I did authorise that payment. I did consent to that payment, yes or no. He needs to look at

fraud patterns, fraud trends, other tricks that have been used, other consumers that fell into the same trap, or other payers more generally that fell into the same trap, and then perform his analysis and ultimately decide, well actually did he authorize that payment yes or not? Looking at all these factors, all these elements. So I think it's going to be really messy there too, quite frankly. I think a lot of PSPs will will take different views on if and when they need to refund the consumer. so that one I mean I

I also think that again, different PSPs will take different views. We will have, of course, a lot of court cases, I believe, on this where the PSP will refuse to to refund the payer immediately. You know, some payers will go to court, in particular depending on the amount that we're talking about. We'll go to court and we'll get case law as to what it means. But will a judge in Madrid say the same thing as a judge in Germany or in Belgium? I don't I mean, I don't think so based on the text. so I

Michael Salmony 38:34

I mean,

on that topic, one of the big changes for me in the PSD3 PSR game was putting the liability for fraud on the banks, to put it sort of simply. Do you think that's a good idea? Will that help or will that just make lots of cover-your-ass ticks appear on my mobile banking where I have to say, yes, I really know what I'm doing and just make the whole system more expensive or was that a good move?

Scott McInnes (Bird & Bird LLP (39:03) I think it's probably going to be the latter, Michael. I think it's going to be indeed a lot of cover, your bud, tick boxes, et cetera, so that the bank can basically build the case that if and when there's fraud, that you've ticked all the boxes, that means that potentially the bank will not have to refund you. In any event, I mean, even even if my PSP is is required to refund me, in the end it's always the consumer who pays. So if ev so so even if I'm not paying directly because I get the refund on that particular transaction.

somehow somewhere I'll be paying for that fraud as a consumer. And I don't know if through is through you know less interest on my savings account, is it gonna be a higher interest rate on my mortgage? Is it gonna be more taxes? I don't know, but somehow somewhere I think I will pay for it anyway.

Michael Salmony 39:47

You

can even sharpen that argument and say it rewards those who are sloppy because they know they're going to be reimbursed and it punishes those who are careful because they have to bear the collective load.

Scott McInnes (Bird & Bird LLP (39:58) Sure, sure. So I think fundamentally it is essentially a political move, I think, frankly, to be seen as being pro European consumer, protective of the consumer, of payers more generally, but consumers in particular. so it's it's i it's a little bit of a political provision, I think, quite frankly, for the EU to be seen to be doing stuff for the European consumer to improve his financial position.

Javier 40:23

but populistic politics. It's not

Scott McInnes (Bird & Bird LLP (40:25) I think so.

Javier 40:25

real politics. It's paternalistic and populist politics. I fully

Scott McInnes (Bird & Bird LLP (40:30) I would think so.

Javier 40:31

agree.

Scott McInnes (Bird & Bird LLP (40:31) And you could

Ralf Ohlhausen 40:32

Yeah.

Scott McInnes (Bird & Bird LLP (40:32) frankly argue a little bit the same in relation to to a digital euro that we talked about before.

Ralf Ohlhausen 40:41

I have before we run out of time, I have one big question actually about agentic AI. And well we have spent quite some years now on this and you mentioned it will take another two years or what to to get this now implemented and live. there are other parts of the world which are moving a little bit faster than we do here. And

Well, Agentic AI for me is a a very big topic that may make much of what has been agreed here redundant or just be irrelevant. And so one of the biggest questions is to what extent do you think that Agentic AI falls into scope of PSD2 and PSR if at all?

Scott McInnes (Bird & Bird LLP (41:37) Right. Yeah, so I think there's there's a big elephant in the EU. There's a big elephant in the agentic AI room, and that big elephant is called SCA, strong customer authentication. Because the position of the PSD2, and it's the same position going forward under PSD3 and PSR at the moment, is that every time the payer pushes a payment, that payment normally needs to be subject to an SCA. So the payer's PSP normally on each push payment.

Needs to perform an SCA on the payer unless he can find an exemption so as to avoid SCA on that particular payment. But normally there should always be an SCA. And that's how we see to make payments more secure, fight fraud, et cetera. And it has worked as we know in practice. agentic AI, I mean fully agentic AI, which is basically I tell an agent, look, I need a new pair of shoes to play tennis, whatever it might be. My budget is maximum 200 euros, go find.

And make the payment, and that payment should be invisible to me, that that cannot happen, to put it simply in the EU, because it's okay for me to entrust an agent to do my shopping for me. But when comes the moment of that agent actually performing the payment, well, the my PSP needs to perform SCA on me for that payment, unless in the rare occasions where an exemption is available, but accept those exemptions, my PSP needs to perform SCA on me, not on the agent.

So it's not okay for my PSP to contact the agent to say, you have a mandate of Scott to buy pair of shoes for him. Why don't you do the SCA while he's asleep or doing something else, maybe playing tennis actually with the, you know, the the older pair of shoes that cannot happen. And it's quite it's a bit sad, frankly, in a way that we've been talking about agentic commerce a lot. I mean, every single day you see press articles about it, et cetera, new launches, et cetera, for I don't know, eighteen months, twenty four months.

But There's nothing on agentic AI in PSD3 PSR. So we talked before about the fact that the legal texts are sometimes late. I think in this case it's been done on purpose. I mean, clearly they've decided to ignore the topic of agentic AI, not to mention, you know, the words one time, not even in a recital anywhere. They just ignored it completely. so how do we fix it then? Because if we want agentic commerce in Europe, if we think it's great, because I can give a mandate and that agent goes and buys a pair of shoes and

makes that invisible payment to me with no SCA. Either somebody needs to fix PSD3 and PSR now, which is a bit strange because we've don't even have the, you know, the, you know, the finally approved text yet. But now we should consider reopening it and maybe give it the same name or maybe already call it PSD4. I don't know. Or in the level two text, somebody clever at the European Banking Authority, I guess, will have to come up with some creative exemption for

Some agentic AI flows in order to allow some of those flows to operate without an SCA. But the EBA internal has always been in the business of saying, well, we can we cannot fix the level one text, we can't touch it, we can't change it. That's the EU legislator. All we can do is provide more granularity, we can create the exemptions, but that's all us being essentially slave to the level one text. We can't you know change the scope of the level one text. So in relation to SCA.

That was the case very early on under PSD2, where some some people were saying, Well, surely this whole SCA thing in PSD2, it's only for when a consumer pushes a payment, not when a corporate pushes a payment. And very quickly the EBA said, Okay, I see the point, but the text talks about the payer. So any payer has to be subject to SCA. I can't create a carve out for corporate payments. I think here it it might be the same answer we get from the EBA, maybe, who will say, Well, look, sorry, but if if the payer initiates a payment and it's not the payer actually doing the shopping,

But it's definitely him who wants to pay for the pair of shoes. somehow the PSP will need to find a way to bring the payer back into a a session of some sort to perform SCA. Or they will create an exemption for some agentic AI flows based maybe on some kind of mandate that I could have given to the AI agent and say, Well, look, I I I I give you a mandate not only to buy the pair of shoes for a maximum amount of X and you know, but also I hereby

give to whichever merchant you will identify as being the right merchant for me to buy the pair of shoes from, I'm here by giving you a mandate, or I'm here by giving that merchant unidentified yet, but that merchant a mandate to pull the amount of the transaction from my card, maybe. And maybe do a a one of SCA at the time I give that mandate to the agent. And he will essentially pass on that that mandate to whichever merchant he will actually buy the pair of shoes from. And and and that merchant will somehow receive that mandate and we'll be allowed

pull from my card later on w w when the payment transaction will actually take place. That could be some kind of creative idea so as to to allow, you know, a form of quasi-invisible payment in Europe. But

Michael Salmony 46:43

Oh, fantastic. And I think things

like that are afoot, right? There are protocols being developed by Google and Stripe and others to, I think they call it intent, right? What was actually the intent of the user and that's then, or to give an agent its own funds, which he can then spend. And of course an agent can now simulate an SCA, right? That's that has happened now as well. But that's, that's takes us quite a way away. I think it's time for us to close the episode, unless there are any last minute.

topics and really thank you Scott for going into the witness stand and standing up to cross-examination.

Scott McInnes (Bird & Bird LLP (47:17) Thank you. Thanks for having me.

Michael Salmony 47:19

You held up fantastically well. Thank you very much for your lucidity and your insights. was super interesting. So thank you, Ralf, Javier and

Javier 47:26

Thank you. Thank you very much.

Michael Salmony 47:27

Scott.

Ralf Ohlhausen 47:28

Thank you.

Scott McInnes (Bird & Bird LLP (47:28) Thank you very much for having me.

Michael Salmony 47:29

thanks to everybody watching. See you next time.