PSD2: Strong Customer Authentication for Travel Agency Payments
Just in time for the holiday season in Germany, the Federal Financial Supervisory Authority (BaFin) publishes a guidance letter on the regulatory classification of certain payment transactions in stationary travel sales.
The guidance letter deals with the question of whether strong customer authentication (SCA or also two-factor authentication) is necessary for the usual booking processes in travel agencies. BaFin points out that the guidance letter only refers to stationary travel sales and cannot be transferred to online travel platforms. BaFin describes that the usual reservation in a travel agency, when the travel agency is not the beneficiary, is carried out in such a way that the employee of the travel agency receives the credit card data manually in the travel agency or by telephone or e-mail and forwards it to the tour operator. The tour operator then charges the credit card via their payment service provider (acquirer) by transmitting the credit card details.
BaFin clarifies that according to its administrative practice, strong customer authentication is not required for this payment. Unlike other card payments, for example at a terminal, the payment is not initiated by the cardholder (payer) via the merchant (payee). However, there is no direct contact between the cardholder and the tour operator, but the data is transmitted via an intermediary (the travel agency). The cardholder therefore does not initiate the payment himself.
The process will be assessed differently if the traveler initiates the payment directly to the travel agency, for example via a payment terminal.
BaFin’s clarification for the travel industry is welcome. This clarifies the law of surveillance. However, BaFin reserves the right to change its administrative practice if a different decision is taken at European level or if the courts rule differently. However, it then wishes to give the payment service providers concerned a reasonable period of time to implement a new administrative practice, at least from a supervisory point of view. However, the civil law consequences remain unaffected.