{"id":21561,"date":"2023-12-11T10:57:49","date_gmt":"2023-12-11T09:57:49","guid":{"rendered":"https:\/\/www.in-diem.com\/regulations-on-payment-platforms-in-electronic-transactions\/"},"modified":"2026-08-12T14:41:13","modified_gmt":"2026-08-12T12:41:13","slug":"regulations-on-payment-platforms-in-electronic-transactions","status":"publish","type":"post","link":"https:\/\/www.in-diem.com\/en\/regulations-on-payment-platforms-in-electronic-transactions\/","title":{"rendered":"Regulations on payment platforms in electronic transactions"},"content":{"rendered":"
\n

IMPORTANT:<\/strong> This post analyzes the regulation of online payment platforms in accordance with the European and Spanish regulatory frameworks in effect at the time of publication. Currently, any implementation of payment gateways, e-commerce, marketplaces, strong customer authentication, personal data processing, fraud prevention, PCI DSS compliance, or the provision of payment services must be reviewed on a case-by-case basis, the GDPR, PSD2, Royal Decree-Law 19\/2018, the LOPDGDD, applicable technical standards, and developments in the upcoming European PSD3\/PSR package on payment services<\/em>.<\/p>\n\n

In today\u2019s commercial landscape, the use of online payment platforms has become essential to carry out transactions between marketplaces<\/strong> or e-commerce<\/strong> sites and customers. <\/p>\n\n

The role of these payment platforms is to approve the transactions carried out, as well as to secure the information provided by the customer.<\/p>\n\n

However, in this article we will examine the regulation of payment platforms from both an EU and Spanish perspective.<\/p>\n\n

1.- Regulation (EU) 2016\/679<\/strong><\/h2>\n\n

The economic integration of the internal market drives cross-border flows of personal data, which requires a robust and effective European regulatory framework on data protection to ensure security in those data exchanges and thereby foster the development of the digital economy.<\/p>\n\n

These ideas underpin Regulation (EU) 2016\/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data<\/a>. This European regulation sets out how individuals\u2019 data must be processed, recognising the right of access to such data, the right to rectification, and the right to have it erased. In addition, it is the rule that underpins the creation of the regulation known as PCI DSS, an acronym for Payment Card Industry Data Security Standard<\/em>. <\/p>\n\n

2<\/strong>.- Directive (EU) 2015\/2366<\/strong> <\/h2>\n\n

In December 2022, the latest amendment to Directive (EU) 2015\/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market<\/a> was made, introducing a neutral definition of a payment transaction in order to include other methods that were not previously contemplated, thus going beyond conventional forms of electronic payment such as credit and debit cards. <\/p>\n\n

This directive considers that as more technical advances emerge, there are greater security risks in electronic payments due to their complexity. This is why, following Directive 2015\/2366, commonly known as PSD2, the way users could identify themselves when making an electronic payment was changed. <\/p>\n\n

Up to this point, the payment data verification process was carried out using the payment card information and a verification code or SMS and, after the introduction of this rule, e-commerce businesses are required to implement so-called two-step authentication, in which the user must identify themselves using at least two of the three available methods.<\/p>\n\n

With PSD2, the payment process is also simplified, so that payment platforms cease to be external and are integrated into the merchant\u2019s own website. With this type of payment platform, the user completes the purchase process more quickly and, by not changing pages, it gives them a greater sense of security. <\/p>\n\n

3.- Royal Decree-Law 19\/2018 (Spain)<\/strong> <\/h2>\n\n

At national level, Royal Decree-Law 19\/2018 of 23 November on payment services and other urgent measures in financial matters<\/a> classifies certain key concepts for the correct understanding of EU rules.<\/p>\n\n

Its purpose is payment services and the measures related to them, such as how such payment services are provided, the legal regime of payment institutions, and their transparency regime. It also sets out the rights and obligations of payment users and of the providers of those services. <\/p>\n\n

Likewise, its provisions include the definitions of certain concepts such as payment institution, payment account, payment instrument, payment transaction, payment system, and so on.<\/p>\n\n

4.- Organic Law 3\/2018 (Spain)<\/strong><\/h2>\n\n

In order to align EU data protection legislation with the Spanish legal system, Organic Law 3\/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights<\/a> was approved. It should be noted that another of the aims of this law is to guarantee Article 18.4 of the Spanish Constitution. <\/p>\n\n

In short, since the matter to be regulated arises from economic relationships between different states, the pioneering regulations that provide security to those relationships are those of the European Union. States simply adopt that legislation aimed at regulating the operation and content of payment platforms. <\/p>\n\n

5.- How can we help you?<\/strong><\/h2>\n\n

The Banking and Finance Department and the New Technologies Department at In Diem Abogados work jointly to provide legal advice and guidance when interpreting Spanish and EU regulations for the implementation of online payment gateways. Our team specialises<\/strong> in payment platforms for electronic transactions. <\/p>\n\n

The Banking and Finance Department and the New Technologies Department at In Diem Abogados work closely with Cryptoveritas 360<\/a>, an international company specialising in consulting and development of blockchain<\/a> projects, smart contracts<\/a>, crypto payment method integration<\/a>, among many other solutions, ensuring that their operations meet all the necessary requirements.<\/p>\n\n

Contact IN DIEM Abogados 24 hours a day, any day of the week, without obligation.<\/p>\n\n

We guarantee the best possible outcome, whatever your case.<\/p>\n\n