{"id":6330,"date":"2016-12-09T10:04:55","date_gmt":"2016-12-09T10:04:55","guid":{"rendered":"http:\/\/progresomicrofinanzas.org\/en\/?p=6330"},"modified":"2017-11-17T12:59:31","modified_gmt":"2017-11-17T12:59:31","slug":"update-of-minimum-security-requirements-when-making-transactions","status":"publish","type":"post","link":"https:\/\/www.fundacionmicrofinanzasbbva.org\/revistaprogreso\/en\/update-of-minimum-security-requirements-when-making-transactions\/","title":{"rendered":"Update of minimum security requirements"},"content":{"rendered":"
\"image_pdf\"<\/a>\"image_print\"<\/a><\/div>

Colombia\u2019s Financial Authority, the SFC, has published draft regulations to update the minimum security and quality procedures required when making transactions, and also to incorporate the terms \u201cface-to-face sale\u201d, \u201cremote sale\u201d and \u201cpayment gateway and payment processor administrators\u201d.<\/span><\/p>\n

These new instructions set the minimum-security requirements that credit establishments and low-value payment system administrators must meet when carrying out remote sales that are linked to merchants\u2019 establishments or to payment gateways and payment processors.<\/span><\/p>\n

On the subject of these new definitions, this draft regulation indicates that \u201cface-to-face sale\u201d is understood to be one in which the financial consumer and the supplier of goods and\/or services are physically present during the commercial transaction. In this case, the transaction data are taken with a credit or debit card or by using the electronic device that hosts them.<\/span><\/p>\n

The term \u201cremote sale\u201d is defined as one in which the financial consumer and the supplier of goods and\/or services do not physically interact with one another during the commercial transaction.<\/span><\/p>\n

Finally, \u201cpayment gateway and payment processor administrators\u201d are defined as institutions that supply electronic trading application services to store, process and\/or transmit the corresponding payment to online sales transactions during a remote sale.<\/span><\/p>\n

The regulations lay down specific minimum-security requirements affecting: i) vulnerability analyses, ii) the communication system, and iii) authentication mechanisms.<\/span><\/p>\n

All three types of sale have to be carried out by regulated institutions enabling execution of online orders to transfer funds, buy, sell or transfer security titles or issue insurance policies by remote access systems, the internet or mobile devices for customers.<\/span><\/p>\n

Instant messaging or any other similar means of communication have been added to the list of permissible channels through which financial consumers can be sent confidential information.<\/span><\/p>\n

The draft regulation indicates that when ATMs and credit-card terminals are used, one of the authentication mechanisms specified in the regulation must be employed, except when using cards that are not required to comply with the EMV standard (chip), in which case a second authentication factor must be established. For transactions made online, strong authentication mechanisms must be applied. Finally, the regulation provides for the use of the Mobile Banking channel through mobile device applications.<\/span><\/p>\n

Lastly, this set of draft regulations requires contracts between credit establishments and trading outlets and payment gateway administrators, in which the merchants and administrators accept their responsibility to:<\/span><\/p>\n