Payment Services Directive (PSD)

PSD2 replaces PSD1. It reflects the significant changes to the payments market since the passing of PSD1.

Significant changes include:

• extended scope of coverage of the Directive to include 'One Leg Out transactions' (meaning where one of the Payment Service Providers is outside of the EEA). Expansion of the scope to include all payment transactions in all currencies within the EEA (not just EEA currency payments)
• consideration of new PSPs: PSD2 introduces two new forms of Payment Service Provider. The first being "'ccount Information Services Providers' ('AISPs') who are engaged by Payment Service Users and provide account aggregation type services. The second are Payment Initiation Services Providers ('PISPs') (see below for definition). Banks such as HSBC will be classified as 'Account Servicing Payment Services Providers' ('ASPSP's') who allow AISP and PISP access to the customer's payment accounts
• in case of a dispute, PSD2 provides guidance on the respective liabilities of the ASPSP and the AISPs / PISPs. Increased consumer protection is required when using payment instruments (eg. Cards) including strong authentication being required when accessing online banking systems even for read only purpose, limitation on charges and obligations for the ASPSPs in case of loss/theft
  

The new classification of Payment Initiation Service Provider ('PISP') will include third parties who contract with customers to initiate payments from the customer's account with a bank on behalf of the customer. The relationship between the PISP, the Payment Service User ('PSU') and the ASPSP is governed under the PSD2. Under PSD2, a PISP has the following rights and obligations:

• they should not retain possession of the payer's funds for any length of time, but only initiate payments in connection with the provision of the payment initiation service
• they should ensure that the personalised security credentials of the payment service user, are not accessible to any other parties (except the user and the issuer of the personalised credentials), and that they are transmitted by the payment initiation service provider through safe and efficient channels
• they should ensure that any other information about the payment service user, obtained when providing payment initiation services, is only provided to the payee and only with the payment service user's explicit consent
• to identify itself towards the ASPSP of the customer and communicate with the ASPSP, the customer and the beneficiary in a secure way every time a payment is initiated
• not to store sensitive payment data of the PSU
• not to request from the payment service user any data other than that which is necessary to provide the payment initiation service
• not to use, access and store any data for purposes other than for the provision of the payment initiation service as explicitly requested by the payer, and
• not modify the amount, the recipient or any other feature of the transaction

As an example, a customer purchasing some goods on an e-merchant website can use a PISP service as an alternative to a debit / credit card. The customer will have to share his bank credentials with this PISP and give his consent as the PISP will access his bank accounts details to initiate the payment.

An Account Information Service Provider ('AISP') means a provider pursuing business activities in the form of accessing account information with the consent of the PSU in order to provide services like aggregation of accounts across different banks within different countries and regions.

Under PSD2, an AISP has the following rights and obligations:

• the right for the AISP to provide its services to a PSU shall not apply where the payment account is not accessible online

The AISP must:

• provide services only based on the payment service user's explicit consent
• ensure that the personalized security credentials of the payment service user are not accessible to other parties (with the exception of the user and the issuer of the personalized credentials), and that when they are transmitted by the account information service provider, this is done through safe and efficient channels
• at each session identify itself towards the ASPSP of the customer and securely communicate with the ASPSP(s) and the customer
• access only the information from designated payment accounts and associated payment transactions
• not request sensitive payment data linked to the payment accounts
• not to use, access and store any data for purposes other than for performing the account information service explicitly requested by the payment service user, in accordance with data protection rules

As an example, a customer holding accounts in different banks across different countries and regions can use the service of an AISP to get consolidated reports of these accounts. These reports can provide various charts like analysis of the expenses and the revenues, like total balances status.

You can use the service of an AISP and/or a PISP (i.e. a Third Party Provider - 'TPP') to get a consolidated view of your accounts across various banks (including HSBC accounts) or make payments. Again, you will have to share your credentials with a TPP in a safe manner for this type of service. HSBC will have to transmit to the TPP the payment accounts data as required under PSD2.

If you use the service of such TPPs, it is important to know that by giving them your consent to access your data that is kept with our Bank for the provision of payment services, such TPPs may be able to view not only the data related to payment services but also other data (e.g. a term deposit) that is available in your online banking space. 

The definition within the PSD2 classifies strong customer authentication as meaning an authentication based on the use of two or more elements categorized as:

• Knowledge (something only the user knows), e.g. a secret code
• Possession (something only the user possesses) e.g. a debit card, and
• Inherence (something the user is) e.g. a finger print

These need to be independent, meaning that the breach of one does not compromise the reliability of the others and is designed in such a way as to protect the confidentiality of the authentication data.

When accessing HSBC online banking service, you will have to systematically use your Security Device (token). Moreover, to move money to another account you will be required to input in such token the last five digits of the receiver's IBAN as well as the payment amount.

These increased security requirements are mandated within the PSD2 but are also a consequence of HSBC needing to engage with third party providers (PISPs / AISPs) and their ability to access customer accounts to initiate a payment transaction or request account information. In this new environment, it is increasingly important to ensure these accesses are either done by the customer itself or by parties having received consents from the customer. 

Be ready for the changes by making sure your contact details are correct and up to date. If you use online banking, you may be able to update your phone number and other details there. If not, visit one of our branches or give us a call.

Please be reminded that a genuine bank or organization will never contact you out of the blue to ask for your PIN, full password or to move money to another account. Only give out your personal or financial details to use service that you have given your consent to, that you trust and that you are expecting to be contacted by. 

Whilst the biggest changes you’re likely to see are online SCA will also apply in a face to face environment. As Chip & PIN is a familiar way of proving your identity, for most purchases you won’t have to do anything different.

The changes relate exclusively to the Strong Customer Authentication (SCA) process. Online shopping with HSBC debit and credit cards will be principally carried out under Strong Customer Authentication at the time of purchase.

The Strong Customer Authentication during online purchases will be applied with the use of:

1. A One-Time Password (OTP) which you will be receiving in your mobile phone number declared to the Bank and
2. The personal identification number (PIN) of the card.

The input of the One Time Password and your personal PIN code is made in a secure environment of the Bank to which you are redirected by the webpage of each merchant. The management and process of the data inserted is compliant to the international PCI Data Security Standards applied for secure card based transactions.

According to the above, in order to make online purchases and be ready for these changes, you must ensure that your mobile phone number declared to the Bank is correct and up-to-date and that you know the personal identification number (PIN) of your card, which is strictly personal.

In order to update your mobile phone number and request, if necessary, reissuance of your card PIN, you may log in HSBC Online Banking, call the Bank directly or through Phone Banking or visit your branch.

• The 16-digit number of your card
• Your mobile phone
• The PIN of your card

No. For online purchases up to €30 and not exceeding the cumulative amount of €100, it is likely, depending also on the e-shop, that a strong customer authentication is required. When these amounts are exceeded, Strong Customer Authentication applies. Each time a transaction that requires Strong Customer Authentication is carried out, the cumulative limit of €100 is reset to zero. 

No, there is no limit as to the number of such transactions. However, there is a cumulative limit up to the amount of €100.

Please note that the Bank shall be refreshing the information provided to you with regard to the transition to the SCA for card based e-commerce transactions.