The UK Financial Conduct Authority has issued a statement confirming that it will comply with the Guidelines published by the European Banking Authority on December 12, 2017 on security measures for operational and security risks of payments services under the revised Payment Services Directive.

PSD2 takes effect on January 13, 2018. All Payment Services Providers will be expected to comply with the EBA Guidelines. The FCA reminds businesses wishing to apply for authorization or registration under PSD2, and any PSPs that are re-applying, that applications must contain a statement of the applicant’s security policy, taking into account the Guidelines. The statement of the applicant's security policy must also contain a description of the applicant's measures to comply with the provisions of the Payment Services Regulations 2017 that relate to the management of operational and security risks.

The FCA states that it intends to consult in 2018 on its approach to applying the Guidelines and on its expectations on PSPs’ future reporting requirements.

View the FCA statement.

View the EBA Guidelines.