PM Quest · Practice cases · Learning resources

Stripe PSD3 SCA Compliance: 5-Month Effort vs. 10-Week Deadline

Project Management · advanced

As a PM at Stripe for platform compliance, your team estimates 5 months to develop and roll out a critical new module for upcoming PSD3 Strong Customer Authentication (SCA) requirements. However, the European Banking Authority (EBA) just announced a non-negotiable compliance deadline of 10 weeks. How do you approach this compression?

Write your approach on PM Quest

Community approaches

Pavlo’s approach

Since we have a strict deadline which is 50% less than the estimated effort, we need to work in both directions: decreasing the initial effort needed, expending the resources to speed up the development. The compliance is critically important in financial business, so there are no options not to meet it. The first step is to meet with the dev team, break down the requirements by the small chunks and discuss what isn't essential for the compliance. For instance, the UI can be simplified for the initial release or some parts of the feature might use 3rd party solutions temporary. The second step is to seek additional dev resources to speed up the implementation. We can involve the engineers from other teams or check if there are available options for a quick hiring. Not critical components can be developed by third parties (e.g. UI). Another important thing is to communicate the risks to all the stakeholders and mobilize the accountable team - some people might need to work overtime or cancel vacations and trips.

We also need to be prepared for the worst scenario - if the feature isn't ready on time. For that case we need to explore which option is less harmful for the company - pause the operations in the appropriate regions or not comply the regulation for a short period of time. There might be some other legal options how to push the implementation for a few days or even weeks without significant penalties.