PSD2’s future in the game industry

PSD2 will change Europe in 2019 forever. But get the AAA publishers more power and will it help the indies to sell the items direct to the players. What about the privacy from the players? Who is responsible for that. All question that need answers.

Micha van der Meer, Blogger

May 16, 2017

7 Min Read

Payment solutions in the game industry are driven by technology and platforms. Globalization and the need for cybersecurity (CyberSec) result that payment technologies become tremendously complex. Collecting payments players is even more complicated, because every country in Europe developed its own preferred payment method. In the last four years European Union worked on a solution called the Payment Services Directive Two (PSD2).

The current situation for indie game developers.

Let's assume that an American developer will sell their game in a small country, such as the Netherlands to increase their market share. To cover all registered Dutch banks, the developer would need to deal with 32 different finance institutions.[1] The good news is that the big-three banks are responsible for 93% of the market share (ING 40%, ABN-AMRO 19%, and Rabobank 34%).[2] 55% of the payment from the big three of the payments are done with IDeal (a digital payment method only used in the Netherlands). Implement only Ideal only covers 51% of all payments in the Netherlands. Credit Card (23%), Direct Debt (15%) and Paypal (7%) covers are covering the other payments in the Netherlands.

A different strategy would be to start with credit cards and implement other payments later. In the UK (77%) and France (82%), credit cards have this strategy significant impact.[3] In Germany, however, credit cards are only responsible for 25% of all payments in Germany.

The first conclusion suggested by these figures is that it would be an exceedingly difficult job for our single developer to handle all of these payments on his own. Second, credit cards are dominating the market and are responsible for the lion’s share of the European payment market. At the same time, credit card companies charge a higher margin for their services than do traditional banks, and payouts are delayed for many weeks. In return, they protect consumers against the illegal use of their cards.

Most developers are now using payment service providers. Payment service providers take away the headache for developers and offer the ability to connect with the full range of payment methods available globally.

Payment service providers that cover every country charge higher setup fees. The reason for this is, that for every payment solution, developers must screen and sign separate contracts on paper. Most banks do not yet have the technology to allow developers to accept their general terms with a single click.

The prices charged by payment service providers are based on transaction volumes and on the amount of each transaction. Strangely enough, every payment method ends or begins with a consumer’s regular bank account, although there are some exceptions to this rule. For example, some countries in Africa allow consumers to use prepaid mobile credit like a currency and initiatives like Bitcoin are also trying to conquer the world.

Every activity in the value chain takes its share of the turnover for the service it provides and the risk it bears. Wouldn’t it be wonderful if there were a solution like a standardized application programming interface (API) to connect to European banks?

The Open Banking Workgroup (OBWG)[4] has recommended that an open banking standard API be created to make it easier to share bank data. The OBGW’s objective is to develop a “minimum viable” open banking API based on open data. The API must be launched towards the end of 2017, with personal consumer transaction data included on a read-only basis starting in early 2018. The full open banking standard API, including both business and consumer transactional data, is expected to be released by 2019.[5]

What could PSD2 do for indie developers?

PSD2 authorize in a secure way through which the indie developers (preferred third-party providers) can directly connect with players (consumer) and their banks. In 2013, the European Commission decided to begin implementing PSD2 and if everything goes according to plan, it will be operational in January 2018. The below schedule illustrates the steps that have already been taken, as well as those that are still to come.

Abstract technical work

What is more important for game developers to understand is how PSD2 works on an abstract technical level. The below flow chart provides a brief overview of communication when using PSD2. This simple flowchart does not take any other security breaches like encrypting method, if the lines are secure and if the device is jailbroken etc. into account.

The player makes an in-app purchases (IAP) in the game. The game enters the backend API from the game server [1].
The server from the developer gives the player a secret key [2]. The same key is also supplied to the bank server through a virtual private network (VPN) or the bank’s own API [5].
The game makes a call to the bank’s API to authorize the request to transfer money to the game developer [3].
The bank conducts an internal security check, in which it assesses whether the secret key from the server from the developer is the same as received from the game.
The bank server makes an internal request as to whether there is enough money in the bank for the player. It then sends a confirmation to the server from the developer [5] and to the game [4] that the money has been transferred.
The server from the developer adds the purchased item to the player’s inventory on the database.
The game makes a request to update that inventory from the server from the developer [1].
The server from the developer reflects the updated inventory in the game [2].

When writing this article, I spoke with different banks in the Netherlands. All of them are busy experimenting with PSD2. Until now, nothing like a universal API or standardized dataset has existed. To implement PSD2, developers must create a data access layer (DAL). The DAL handles all of the different types of data before processing it and storing it within the local database.

Will Brexit have an impact on PSD2? What about a Frexit or Gexit”?

Many experts are talking about the impact of Brexit. What would happen if Germany or France were to leave the EU? There is no clear answer to this question. There is no exit scenario for PSD2. The good news is that the Brexit settlement will take at least two years. In the meantime, British banks have to follow the rules imposed by the European Union.

Conclusion

PSD2 is a fact, and it is not clear where it will end. Subjects such as security and questions of who is responsible for data remain significant discussion topics within PSD2 panels. PSD2 is disruptive and will definitely change part of the value chain. However, ethical questions remain. Unlike traditional banks, startups do not risk a brand reputation. Moreover, in contrast to traditional financial institutions, they are not subject to central bank supervision. If something goes wrong, who is liable? The bank forced by the EU law, which has to give access to the consumer data, or the startup, which does not have any deposit liabilities? As I understand it, the Authority of Financial Markets[6] (the Dutch supervisory authority in the financial markets) is watching very closely to see what will happen.

[1] http://www.dnb.nl [jan, 2017]

[2] http://www.banken.nl/bankensector/bankensector-nederland [jan, 2017]

[3] http://merchantaccounts.expertmarket.co.uk/online-payment-methods-around-the-world [jan, 2017]

[4] https://www.openbankproject.com/ [Jan 2017]

[5] CapGemni , World Payments Report WPR 2016

[6] https://www.afm.nl/en