Edited by Luca Bettinelli e Fabrizio Cascinelli
On June 17th, 2024, the Bank of Italy published a communication “on unauthorized payment transaction repudiation“, warning payment service providers (“PSPs”) to comply with regulations and act fairly towards customers.
In particular, the supervisory authority preliminarily recalled how in recent years, the payment services sector has undergone significant changes due to the implementation of European regulations, including the PSD2 Directive, and due to the spread of new technologies. These factors changed customer payment habits, promoting the digitalization of services and the expansion of e-commerce, also in response to the pandemic.
It is therefore crucial to ensure customers’ right to repudiate unauthorized transactions and obtain due refunds. In this regard, Legislative Decree no. 11/2010 establishes the criteria for refunding unauthorized transactions and the related timing and methods, with the aim of eliminating the negative effects for customers resulting from such charges.
The Bank of Italy has conducted in-depth analyses on the systems adopted by PSPs, through inspections and documentary supervisory initiatives, which have also considered disputes promoted to the Financial Banking Arbitrator (“ABF”), complaints to the Bank of Italy, and reports from consumer associations. The analyses have identified several critical issues, including unjustified refusal of refunds, deficiencies in refund execution timing and methods, shortcomings in customer information, and inadequacy in card tokenization mechanisms. Therefore, there is a need to provide guidance to ensure the consistency of operators’ practices and their alignment with regulations, as well as to promote practices that improve the quality of customer relationships.
For this reason, the Bank of Italy has asked PSPs to conduct a self-assessment on the consistency of their practices with the regulations and its expectations, expecting that:
- the unauthorized transaction management process is governed by an internal policy compliant with Legislative Decree no. 11/2010, including all categories of unauthorized transactions;
- the investigation into the repudiation request considers the liability criteria between PSP and customer, ensuring the right to a refund if strong customer authentication (SCA) is not used;
- procedural automatisms use granular grids to assess any customer fraud or gross negligence, ensuring evaluations even for non-typical cases;
- awareness initiatives are undertaken to improve the management of requests and complaints by staff;
- the repudiation management timing complies with the refund deadline of Legislative Decree no. 11/2010, avoiding requests for additional documentation or burdensome formalities;
- mechanisms are provided to restore the account to its state prior to the unauthorized transaction, without charging costs to the customer;
- transparency documentation provides clear information on customer rights and the communication methods for unauthorized transactions;
- transparency is strengthened regarding the PSP’s right to recover refunded amounts if the transaction authorization emerges, with clear indications in contracts and during the redress process;
- subsequent communications after repudiation are clear and understandable, explaining the reasons for rejecting refund requests and customer rights;
- card tokenization procedures comply with Delegated Regulation (EU) 2018/389;
- PSPs evaluate complaints also based on the Financial Banking Arbitrator’s (ABF) positions, resolving disputes following consolidated guidelines.
If the self-assessment reveals the need for corrective actions, the Bank of Italy expects a plan of interventions to be implemented within twelve months, with formalized assessments subject to verification. The assessments and analyses conducted by PSPs should be adequately formalized. The Bank of Italy will monitor the implementation of these measures through its ordinary supervisory action.