EBA · 2024_7150 Question under review

Transactions executed via electronic mail (email)

Regulation
Directive 2015/2366/EU (PSD2)
Article
97, para. 1
Topic
Strong customer authentication and common and secure communication (incl. access)
Submitted by
Individual
Submitted
2024-07-22
Answer provided by
ESAs (EBA, ESMA, EIOPA)

Question

Do transactions ordered by email and executed by an employee of the payment service provider, e.g., credit transfers orders sent from the e-mail address of the payer to the e-mail address of the payment service provider and executed accordingly qualify as transactions executed through a remote channel, at-distance channel or a payment instrument which may imply a risk of payment fraud or other abuses, pursuant to Article 69, Article 70, Article 72 and Article 97(1)(c) PSD2?

Background

In accordance with recital 95 of PSD2, “payment transactions ... executed with modalities other than the use of electronic platforms or devices, such as paper-based payment transactions, mail orders or telephone orders, do not seem to necessitate the same level of protection regarding safe authentication as electronic payments ... Payment services offered via internet or via other at-distance channels, the functioning of which does not depend on where the device used to initiate the payment transaction or the payment instrument used are physically located, should therefore include the authentication of transactions through dynamic codes, in order to make the user aware, at all times, of the amount and the payee of the transaction that the user is authorizing”. In the Final report on the draft RTS on SCA and CSC the EBA was already asked if "payments via e-mail" are considered within the scope of the SCA under PSD2 (EBA/RTS/2017/02, 23 February 2017, Question 90 page 94).  However, the matter of transactions ordered by email was not explicitly addressed in the answer (“[…] anything initiated via paper or telephone is out of the scope”). On the other hand, answering question 2021_6315 of the Single Rulebook Q&A EBA only clarified that the payer is not initiating the electronic payment itself in the situation where he orders a transaction by email, and therefore, does not qualify as “where the payer initiates an electronic transaction” as per Article 97(1)(b) of Directive (EU) 2366/2015 (PSD2). The question is therefore whether transactions executed through a remote channel, at-distance channel or a payment instrument necessarily implies a process in which a payment order issued electronically by the payer is processed automatically in the payment system. The affirmative answer to this question seems to imply that for the purposes of PSD2, namely for the purposes of: the obligations of the payment service user in relation to payment instruments [Article 69], the obligations of the payment service provider in relation to payment instruments [Article 70], evidence on authentication and execution of payment transactions [Article 72], and strong customer authentication [Article 97(1)(c)],  the email, although it operates across computer networks, primarily the Internet, does not qualify as a remote channel, at distance channel or a payment instrument. Because typically a transaction ordered by electronic mail (email) is not processed automatically in the payment system, but rather executed by an employee of the payment service provider. For this reason, it seems that transactions ordered by electronic mail (email) do not qualify as transactions processed by a remote channel, at distance channel or a payment instrument and, therefore do not fall within the provisions and obligations of Article 69, Article 70, Article 72 and Article 97(1)(c) PSD2.
No answer published yet.

Original source: European Banking Authority, Q&A ID 2024_7150

This Q&A is published by European Banking Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.

Similar Q&As

More Q&As on this topic

📋 Track EU financial regulation continuously

Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.

14-day free trial. No credit card required.