PSD II in Dutch law introduces new payment services

Recently, the Dutch legislator introduced a number of amendments to the Dutch financial regulatory environment. One of the changes being effective as from 19 February 2019 onwards: the implementation of the second Payment Services Directive (Directive 2015/2366, PSD II) [1] into the Dutch Act on the financial supervision (Wet op het financieel toezicht, AFS).

What is PSD II?
PSD II is the replacement of the first Payment Services Directive (Directive 2007/64 EC) and regulates payment services (being inter alia execution of payment transactions, enabling cash withdrawals and issue of payment instruments) and payment service providers throughout the European Union and the European Economic Area (EEA). The primary goal of the payment services directives is to enhance competition within the EEA and to facilitate participation in the financial sector, also for non-banking institutions. Furthermore, there is a focus on the creation of a level playing field in respect of consumer protection and the rights and obligations of payment services providers and their customers/users.

Changes in PSD II
Below, a brief overview is given of two major changes imposed by PSD II, being payment initiation services and account information services. Recently most has been published and been discussed about account information services, which clearly (if consumers wish so) may create opportunities in respect of financial services, costs savings and marketing but which, on the other hand, are considered extremely sensitive in terms of protection of personal data and consumers’ financial information.

Payment initiation services
Payment initiation services are made for use by holders of an account that is manageable online. Banks shall create the possibility for third parties (holding a license under PSD II) to obtain access to their customers’ payment accounts, in order to initiate payments. Payment initiation service providers may, subject to approval of the account holder, ask the bank to execute a payment order on behalf of the account holder, and the bank will process such payment order. Payment initiation services are a new manner of making online payments and offer an alternative for e.g. credit card payments or payments through PayPal. Though the consumer may withhold approval, there is a chance that webshops will offer this method as the only means by which their customers can pay for the products.

Account information services
Under PSD II, banks shall create the possibility for third parties (holding a license under PSD II) to obtain access to payment accounts of their customers, in order to get access to payment data of the account holder. Such third parties will then be in the position to collect payment data and to e.g. compose specific overviews and payment profiles for their customers or to be in the position to assess a request for a mortgage. Fintech companies could combine the reports in an app and make a digital budget planner. Or a consumer receives marketing, specifically tailored for his or her situation, all on the basis of the payment profile.

Personal data protection matters
With the newly created possibilities to access account data, privacy issues under PSD II are of the utmost importance. Clearly, the gathering of payment data and personal data is a sensitive matter. Therefore, one of the most important provisions in PSD II is that without explicit consent of the customer, no payment service provider may obtain access to such customer’s personal data. Customers shall at all times be in the opportunity to easily withdraw consent. Consent should be given explicitly; though there is no specific form in which consent is sought. Consent must be given free, unambiguous and well-informed and it should be specific. Tacit consent or pre-ticked boxes will not qualify as explicit consent. Consent shall be given for each payment service and if consent is given for a specific purpose, such consent will not be deemed given in respect of other parts of the contractual relationship between the payment service provider and the consumer. As an example, if a consumer has given his or her explicit consent to a payment initiation service provider, this will effectively lead to a payment order to the bank. This consent cannot be revoked. However, if a consumer has given his or her consent for repeated payments to the same beneficiary, the consumer must contact the payment initiation service provider to withdraw that consent. Though consumers are not obliged to make use of payment initiation services it must be noted that there is a chance that those services will constitute the only manner of payment in webshops.

Supervision
In terms of supervisory authorities, with this broadened scope, PSD II matters are not only supervised by the financial regulatory authorities the Dutch Central Bank (prudential (financial) supervision) and the Authority for the Financial Markets (market conduct supervision) but also by the Dutch Data Protection Authority and the Dutch Authority for Consumers and Markets.

If you would like to receive more information or if you have any questions regarding the above please do not hesitate to contact us.

[1] Directive (EU) 2015/2366  of the European Parliament and of the Council of 25 November 2015 on payment  services  in the internal market, amending Directives 2002/65/EC, 2009/110/EC and  2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC.