Secure corporate payment processes and protocols and inactivity time period

Article 17 of the Delegated Regulation (EU) 2018/389 prescribes that ‘payment service providers (PSPs) shall be allowed not to apply strong customer authentication (SCA), in respect of legal persons initiating electronic payment transactions through the use of dedicated payment processes or protocols that are only made available to payers who are not consumers, where the competent authorities are satisfied that those processes or protocols guarantee at least equivalent levels of security to those provided for by Directive (EU) 2015/2366.’ Article 4(3)(d) of the Delegated Regulation provides that PSPs shall ensure that the ‘authentication by means of generating an authentication code includes … the maximum time without activity by the payer after being authenticated for accessing its payment account online shall not exceed 5 minutes.’ Article 4(3)(d) of the Delegated Regulation introduces a security requirement related to the application of SCA and Article 17 of the Delegated Regulation allows competent authorities to exempt dedicated payment processes or protocols from the application of SCA if these offer equivalent levels of security. Accordingly, where a PSP intends introducing a longer period of inactivity during the authentication to that provided in Article 4(3)(d) of the Delegated Regulation, the PSP should introduce additional or alternative security measures to ensure that the level of security of the payment process or protocol is equivalent to that provided by PSD2. Where no additional or alternative security measures are in place, the time without activity shall not exceed 5 minutes.