--- title: Why US companies are studying European regulatory changes date: 2019-08-22T16:29:00+01:00 author: Gerry Carr canonical_url: "https://www.ravelin.com/blog/why-us-companies-are-studying-european-regulatory-changes" section: Blog --- Blog /[3DS & SCA](/resources?search=&category%5B0%5D=134550#resourceContainer "Go to 3DS & SCA") # Why US companies are studying European regulatory changes Ravelin hosted discussions at a recent series of roundtable dinners in New York, Los Angeles and San Francisco. The conversations revealed an unexpected interest in PSD2 and GDPR. ![Why US companies are studying European regulatory changes](https://storage.googleapis.com/ravelin-website-assets-production/assets/images/_blogSmall/3574/SFroundtable.webp) Ravelin hosted discussions at a recent series of roundtable dinners in New York, Los Angeles and San Francisco. The conversations revealed an unexpected interest in[ PSD2](https://ec.europa.eu/info/law/payment-services-psd-2-directive-eu-2015-2366_en) and[ GDPR](https://gdpr-info.eu/). On the surface this is a little surprising. We know both these regulations are firmly European in origin. Why then, so far from home were they of such interest in the US? ## Global Trading and PSD2 For businesses operating internationally there are compelling reasons to be aware of both these initiatives. Let’s look at PSD2 first. The directive requires both legs of a transaction to be in Europe. That’s to say the issuer and the acquirer both need to be in Europe for PSD2 to apply. So a US consumer buying in Europe would be exempt. Likewise, a European consumer buying from a US company with a US acquirer. This in fact could offer an out to US businesses operating in Europe. They could route payments through to their US acquirer and so escape the purview of PSD2. In fact some businesses are considering this as a back-up. The Secure Customer Authentication (SCA) element of PSD2 implies friction in the customer journey. Many companies are keen to avoid but doing so is not without costs. Cross-border acquiring is two to three times more expensive than local acquiring. It has its own acceptance risk too. Some issuers reject transactions as their international routing can look unusual. One study showing them[ 69% more likely to be rejected](https://www.threatmetrix.com/digital-identity-blog/payment-fraud/online-payment-fraud-trends-8-predictions-2019/). So the good news is a US company with limited European exposure can continue to route transactions through their US acquirer and will see no change. This accepts of course that the higher cost and lower acquisition rates are already priced in to their payments strategy. A global business is likely to have both legs inside the EU for European customers and needs to be aware of the implications of the changes. This is true for any business looking to expand globally as well. ![New York Roundtable](https://storage.googleapis.com/ravelin-website-assets-production/assets/images/_1408xAUTO_crop_center-center_100_line_ns/3575/Image-from-iOS.webp)## 3DS 2.0 is a global protocol and coming to America 3DS 2 is a prominent element of PSD2. It is the de facto authentication protocol for the directive. It is not a European standard however. In fact it is an[ EMVCo protocol](https://www.emvco.com/emv-technologies/3d-secure/) - as global as can be. If the attendees at our dinners were typical, many US e-commerce businesses expect to adopt 3DS2.0 in a way that not true of 3DS 1.0. The only difference is the urgency with which it will be adopted. The European Banking Authority has confirmed that 3DS 2.x is PSD2 compliant. SCA is mandatory on most transactions. The world is watching Europe with anticipation to see how the consumer adapts to this new way of purchasing. Thus Europe is a laboratory for US payments professionals to observe and adapt to what happens there. It should present some big lessons for smart businesses to learn. ## GDPR and Privacy. Is this European initiative the new standard in privacy? GDPR is a European regulation with global reach. GDPR covers a user of a US service who accesses that service from Europe. So even US-centred businesses need to be aware of the implication of the service. It is easy to see this as a threat but it doesn't need to be. At the dinners we hosted there was a consensus that the best way to think about GDPR is that is a blueprint for[ `privacy by design’.](https://en.wikipedia.org/wiki/Privacy_by_design) The regulation is not perfect but it does act as a useful standard for companies. Good privacy practices should be baked in for customers and users and the world's regulators are starting to agree. The[ California Privacy Ac](https://en.wikipedia.org/wiki/California_Consumer_Privacy_Act)t shows the direction of travel in terms of privacy compliance. While not identical it is very similar to GDPR. Companies are now faced with the difficult options of either some applying this Act only on their Californian customers. The alternative is to simply adapt that higher bar for operations across all states and globally. And it makes increasing sense. [Japan](https://www.skadden.com/insights/publications/2018/09/quarterly-insights/data-protection-in-japan-to-align-with-gdpr) and[ Brazil](https://iapp.org/news/a/gdpr-matchup-brazils-general-data-protection-law/) are planning their own regulations that map to GDPR. Smart businesses need to start challenging their development teams to bake privacy in. Consumers are likely to start favouring companies that respect their data privacy and can prove that they do. ## Leading US companies will use Europe’s example to get ahead of future changes It’s a global economy. Big changes in one part of the world will always impact others. It is still too early to tell how the European changes will roll out fully. We have seen limited [use of the fines](https://www.theguardian.com/business/2019/jul/10/gdpr-fines-ba-british-airways-marriott-data-watchdog) in Europe so far. And PSD2 is being staggered in its rollout. However both represent a rare opportunity for US companies to observe the real world outcomes of needed changes in consumer and business behaviours as the e-commerce world evolves. In GDPR perhaps we are seeing privacy by design won out. For PSD2 we will have to wait and see. I would like to thank all our guests across the three dinners. It’s a real privilege to be able to hear from businesses first hand about how they are adapting to the ever-changing challenges of payments and fraud. Please do join us at future events in US and Europe. ## Author ![Gerry Carr](https://storage.googleapis.com/ravelin-website-assets-production/assets/images/_avatarSmall/2005/Screen-Shot-2018-11-30-at-16.25.38.webp) Gerry CarrCMO (Ravelin alumnus) Gerry Carr has previously served as the Chief Marketing Officer of Ravelin. [More from this author](https://www.ravelin.com/author/gerry-carr) ## Related content [Blog / Payments & payment fraud ### Card payment liability shift – everything you need to know to reduce chargeback burden The knowledge you need to make the most of liability shifts and reap the benefits for your company – including saving money on chargebacks. ![Freddie burgess](https://storage.googleapis.com/ravelin-website-assets-production/assets/images/_33x33_crop_center-center_none_ns/281707/freddie-burgess.webp)Freddie Burgess,Senior Product Support Analyst](https://www.ravelin.com/blog/card-payment-liability-shift-for-chargebacks) [Blog / Fraud analytics ### Refund abuse KPIs: How to measure and reduce refund fraud rates What you need to know to assess and quantify refund abuse – as well as to measure whether your refund abuse solution and strategy are delivering results. ![Can](https://storage.googleapis.com/ravelin-website-assets-production/assets/images/_33x33_crop_center-center_none_ns/280078/can.webp)Can Colak,Senior Product Manager](https://www.ravelin.com/blog/how-to-measure-refund-abuse-kpis) [Blog / Press release ### Driven by AI, customers now rival criminals for ecommerce fraud, say merchants Global ecommerce fraud enters a new phase as losses continue to climb. Merchants now view criminals and their own customers as presenting a comparable risk, and there's a gap in AI adoption. ![Ravelin Symbol Blue 1](https://storage.googleapis.com/ravelin-website-assets-production/assets/images/_33x33_crop_center-center_none_ns/187712/Ravelin-Symbol-Blue-1.webp)Ravelin Technology](https://www.ravelin.com/blog/ravelin-fraud-survey-2026-press-release)