Setting the Scene: Challenges for Payment Service Providers in the Middle East

COVID-19 pandemic has triggered an acceleration of digital adoption and a flight from cash, as it has in other regions. The number of consumer digital payments transactions in the United Arab Emirates (UAE) grew at an annual rate of more than 9 percent between 2014 and 2019, compared with Europe’s average annual growth of 4 to 5 percent. Even more starkly, Saudi Arabia observed astronomical growth in card payments: over 70 percent between February 2019 and January 2020. (Source: Mckinsey)

The payments industry got a boost with the introduction of the second Payment Services Directive (PSD2) and many new players are entering the market. At the same time, payment service providers (PSP) face a broad spectrum of challenges.

Due to pressure from regulatory entities – including FinCEN in the US, FCA in the UK, Comisión – CNBV in Mexico, etc. – anti-money laundering (AML) regulations are being pushed downstream from the acquiring and sponsoring banks to their PSPs. This increases the importance of understanding who is on the other side of the transaction using technologies, processes, and services to perform KYB (Know Your Business), KYC (Know Your Customers) and KYCC (Know Your Customer’s Customers).

Companies that scale and succeed are those that dedicate time and effort to implement and tune their risk models and processes for fraud prevention and money laundering. For any type of business, but specifically for Payment Service Providers (PSPs), adopting technologies that can help automate many of the onboarding, fraud prevention, and money laundering processes, can become a competitive advantage.

General Data Protection Regulation (GDPR)

As part of their activities, payment service providers process (sensitive) client data. Payment service providers need to ensure that the processing activities occur in line with GDPR requirements, guaranteeing that there are sufficient grounds for the processing activities.

Strong Customer Authentication (SCA)

SCA is a requirement of PSD2 on payment service providers within the European Economic Area (EEA). The requirement ensures that electronic payments are performed with multifactor authentication (inherence, possession or knowledge elements of SCA), to increase the security of electronic payments.

Anti – money laundering (AML) / counter terrorism financing (CTF)

The AML/CTF requirements remain high on the agenda of the Belgian supervisory authorities. As entities subject to the preventive AML – law, smaller PSPs also need to be compliant with the requirements in the field of AML/CTF, which are under increased supervisory scrutiny. Smaller PSPs also need to be able to comply with the very large number of requirements, which are not always straightforward and clear.

Cybersecurity

PSD2 requires payment service providers to grant third party access to their most critical systems. The business need for interconnection renders the traditional perimeter defence strategy unmanageable, effectively putting identity and data at the center.

Fraud

The accelerated digitalisation of payments stemming from recent COVID-19 responses exposes payment service providers to higher and more complex fraud risks. As such, these trends lead to higher costs to cover for fraud losses as well as to more important investments in technology, such as realtime fraud management capabilities.

Outsourcing

Institutions remain responsible for the fulfilment of all their obligations of outsourced functions, activities or operational tasks. In particular, outsourcing may not lead to the quality of internal control being compromised, nor to any unnecessary increase in operational risk.

Restricted Activities

Pure payments players must form business models that create value beyond payments transactions alone. Regulations for payments entities restrict players’ activities to payments-related activities, which prevents them from capitalizing on potentially more lucrative financial services revenue streams such as lending. Thus, players will be forced to form strategies and partnerships allowing them to create additional value.

Originally published on LinkedIn, 21 November 2021.