Simplifying strong customer authentication
Martin Lycka, director of regulatory affairs, GVC Holdings/Ladbrokes Coral, on what gaming operators can expect during the strong customer authentication (SCA) regulation’s early stages and how to can prepare
Strong customer authentication (SCA) is a requirement of PSD2; basically, the rules that those who offer payment services need to follow if they’re operating in Europe. In short, the rulings ensure that online payments are performed with several layers of authentication in order to improve security. So, consumers will need to offer up two out of the three methods of authentication: something they know (e.g. password), something they have (e.g. phone), and something they are (e.g. fingerprint).
As is often the case with new regulatory frameworks that comes onto the scene, SCA has endured its fair share of scepticism. Along with fears that extra friction would leave customers unable to pay, many merchants didn’t feel they were able to meet the requirements in time – the Financial Conduct Authority (FCA) even had to step in to push back the official deadline, giving businesses more time to comply.
Even with all the concern, we want the gaming industry to see that SCA is ultimately a positive change. SCA enables us to offer an even safer environment for our customers, which will help us in our quest to supply entertainment, without compromising consumers’ security.
It gives the industry an opportunity to further shore up the protection tools it offers to its customers, in this case in terms of data protection and IT security. In general, PSD2 will have widened the scope of payment methods available to the industry and ultimately the customers, including very modern unique payment methods.
Ahead of the game
Unlike many other merchants, the gaming industry has also benefitted from a head-start. The gambling industry started implementing SCA strategies some time ago, and the process will have further sped up with the implementation of PSD2.
For those that still have adjustments to make, businesses need to really get to grip with what the compliance change requires, then find the most efficient way to implement the changes without disrupting the existing customer experience. By working alongside a relevant third-party supplier, you can ensure the systems are put in place seamlessly and effectively.
And what about the future? As the industry has already been going down the SCA route, there may not be too many visible changes. Having said that, in compliance with GDPR and PSD2, SCA should have the ability to provide us with additional insight into customer behaviour in certain situations.
Indeed, there is the possibility for behavioural data to subsequently be reflected, on an anonymised basis, in responsible gambling-related research or the RG research we support, and ultimately in our products with a view to further enhancing the seamlessness of our RG processes.
One speculation surrounding SCA has been whether bets will decline, as customers’ ability to act impulsively is inhibited due to payments friction. However, we’re yet to see any evidence of this, but the important thing to remember is that anything contributing towards safer betting is most welcome by GVC and the industry.
Martin Lycka, solicitor, is director of regulatory affairs at GVC Holdings. He has been an in-house legal and regulatory counsel to global online gambling operators for over nine years. Prior to working with GVC, Lycka worked with Inter Alia Salans Europe LLP and the Ministry of Foreign Affairs of the Czech Republic.