Payment services regulations and compliance

PSD2 Review – Open banking, SCA, TRA

Overview

We performed an audit of the client’s design, build and implementation of SCA and TRA for online banking and card payments. This included reviewing controls around the security and resilience of APIs and the SCA technologies deployed on both channels.

We reviewed the client’s TRA and fraud rate calculation processes and validated a set of calculated fraud rates based on payment types and exemption threshold values defined in the PSD2 directive.

• We used our knowledge of relevant requirements to baseline our review.
• The Payment Services Regulation 2017. 
• The EU directives on payment services and on regulatory technical standards for strong customer authentication, as well as common and secure open standards of communication.
• UK Finance SCA Implementation Roadmap.

Outcome

Our audit identified areas where the bank had made progress in achieving compliance with SCA and TRA requirements and validated project plans to ensure the achievement of approaching regulatory deadlines to implement SCA and TRA.

We can also provide the following assurance services to your business:

Faster Payments Scheme (pay.uk)

Faster Payments Scheme (FPS) self-certification over controls to protect the security and integrity of the FPS central infrastructure.

Bacs Scheme Trust Code of Conduct (pay.uk)

As a Bacs Direct Participant, you must have a Public Key Infrastructure (PKI) solution (Trust Service) that complies with the requirements set out in the Bacs Trust Service Code of Conduct (TSCoC). 

Image Clearing System (pay.uk)

Image Clearing System (ICS) participants need to ensure compliance with the technical and operational requirements as detailed in the ICS Specifications. 

CHAPS Payments Scheme (Bank of England)

Self-certification to attest security and resilience arrangements.

SWIFT Payments

Swift Customer Security Programme (CSP) – self-attestation over mandatory and advisory controls within the Customer Security Control Framework (CSCF).

PCI DSS Compliance 

Assessment of controls required for compliance with the PCI Data Security Standard (PCI-DSS) for card data processing and storage. 

LINK ATM Certification

LINK ATM self-certification over controls to protect the security and integrity of the LINK ATM network.

Confirmation of Payee (COP) Participation (PRA)

Assurance and advice on requirements to participate in the COP scheme.

LINK ATM self-certification attestation

Overview

We performed an independent assessment of the client’s self-attestation of its core controls within the scope of the LINK ATM assurance statement. 

We conducted detailed design and operating effectiveness testing of the controls in scope, following the operating rules and security and code of conduct prescribed by LINK. We assessed the completeness of the responses provided and the quality of the evidence to support the controls attested to. As part of the assessment, we also confirmed that the building society was compliant in most areas and had one non-compliance, with an action plan in place, to report. 

Additionally, we reviewed the effectiveness of the building society's certification process and provided recommendations to enhance the process for future certifications.

Outcome

We performed our work in a timely manner, allowing swift client responses and remediations to the findings we identified. Our robust validation and recommendations enabled the client’s management to sign off and submit the statement to LINK in a timely manner. This allowed the client to maintain participation in the scheme.

The client has also been given recommendations to improve its certification process to enable more effective completion of the certification in future years. 

Cloud Assurance self-certification attestation

Overview

We conducted an independent assessment of the client’s self-attestation of its cloud controls within the scope of the Pay UK assurance statement as a participant in the Faster Payments Service (FPS).

We carried out detailed design and operating effectiveness testing of the controls in scope, following the rules prescribed in the Pay UK Cloud Code of Conduct and Cloud risk policy. We assessed the completeness of the responses provided and the quality of the evidence to support the controls attested to and confirmed that the client was compliant in all areas and had no non-compliances to report. 

We used our extensive knowledge of the FPS requirements and cloud security and resiliency risks and controls to critically assess the controls in scope.

Outcome

Our timely work, robust validation and recommendations enabled the client’s management to sign off the statement, allowing for a timely submission to Pay UK. This ensured the client maintained its participation in the FPS scheme.

Faster Payments Services (FPS) self-certification assessment

Overview

We performed an independent assessment of the client’s self-attestation of its controls within the scope of the FPS self-assessment questionnaire. 

Detailed design and operating effectiveness testing of the controls in scope were conducted, following FPS rules and procedures. We assessed the completeness of the responses provided and the quality of the evidence to support the controls attested to. 

Areas of non-compliance were identified and effective, measurable and timely recommendations were provided for the client to address the gaps identified. 

We used our extensive knowledge of the FPS requirements gained through working with the larger banks and newer fintechs to critically assess the controls in scope.

Outcome

Our timely work, robust validation and recommendations enabled the client’s executive management to sign off the questionnaire, allowing for a timely submission to the FPS. This ensured the client maintained its participation in the scheme.