On 5 May 2015 BaFin published its eagerly awaited circular regarding the minimum requirements for the security of internet payments ("Mindestanforderungen an die Sicherheit von Internetzahlungen"). The circular reflects the official translation of the EBA Guidelines on the security of internet payments. The purpose of the circular is to bridge the time gap until the Payments Services Directive ("PSD 2") will come into effect. PSD 2 will contain a lot of requirements for the security of internet payments which the Member States are required to implement into harmonised binding national law.  

The circular of BaFin came into effect with its publication on the BaFin website. However within a period of six months BaFin will refrain from imposing supervisory sanctions. The circular covers substantial security aspects in retail payment transactions, especially governance and risk management and also supervision, examination and documentation of internet payment transactions. Its purpose is also to protect data and the customers themselves. The circular introduces strong customer authentication requirements, the protection of sensitive payment data and the improvement of customer protection.

Strong authentication of the customer

The need for strong authentication of the customer is satisfied if the customer uses at least two criteria out of the following three categories:

  • something, which only the customer knows (e. g. password, PIN)
  • something, the customer possesses (e.g. smartcard, device) or
  • something, which the customer is (biometric feature).

Two of these features are mutually independent and it must not be possible for at least one feature to be replicated, re-used or stolen via the internet.

Sensitive payment data must be subject to enhanced protection during storage, processing and transfer. Sensitive payment data means all data that can be used to identify and/or authenticate a customer, in particular for login and for the execution, amendment or deletion of e-mandates. The customer-web-interface must also be protected adequately against theft, unauthorized access and modification.

Improvement of customer protection

The circular stipulates certain provisions for the improvement of customer protection, such as customer training and communication requirements, the setting of limits and customer access to information regarding the status of the payment transactions.

Further provisions

The circular stipulates that security incidents have to be notified to BaFin and, where required, to the national law enforcement authority as well as to the data protection officer. It should be assumed that security incidents are critical when the availability, integrity, privacy and authenticity of IT-systems, application or data with high protection requirements are injured or affected.

Conclusion

The relatively short implementation period of six months means that institutions have little time to familiarise themselves with the new requirements and adapt their processes. Payment institutions should bear in mind that under PSD 2, whose adoption is expected shortly, they may face further changes and additional regulatory requirements.