This they say 
.
.
After plenty of googling, it looks like this is their out for now
So they have 18 months before they get in trouble, but doesn’t non compliance break the Visa/MasterCard terms.
They only won’t get in trouble if
The FCA will not take enforcement action against firms if they do not meet the relevant requirements for SCA from 14 September 2019 in areas covered by the agreed plan, where there is evidence that they have taken the necessary steps to comply with the plan.
Pingits flow will have to be Auth in app, (unless they can implement online pin, is that a possibility?) But they’ll lose their USP if you have to take your phone with you.