SCA compliance guide
Last updated: March 20, 2024
The EU's second Payment Services Directive (PSD2) contains requirements for authenticating online payments. These requirements, known as Strong Customer Authentication (SCA), apply to customer-initiated online payments and online banking transactions made within Europe.
On this page, find out:
- how you can comply with SCA requirements
- what transactions are out of scope for SCA
- what exemptions you can use to offer your customers a frictionless checkout experience
- the impact of strong authentication on different business scenarios
- how you can implement 3D Secure (3DS) with our Payments API
SCA is a sort of multi-factor authentication, verifying the identity of the cardholder and increasing the security of online payments. The customer has to provide at least two of the following three elements to satisfy it:
- Something the customers knows (like a password or PIN)
- Something the customer has (like a mobile phone or wearable device)
- Something the customer is (like their fingerprint or facial recognition)
Strong authentication is required for customer-initiated online payments within Europe. For online card payments, SCA applies only to transactions where both your business's bank and the cardholder's bank are located in the European Economic Area (EEA) or the United Kingdom (UK).
- SCA applies if your business's bank and your customer's bank are in the EEA or the UK.
- SCA does not apply if your business's bank and/or your customer's bank is outside the EEA or the UK.
To comply with SCA for your online card payments, use 3DS authentication, an authentication protocol supported by the major card schemes.
3DS adds an extra layer of security for online card payments, the cardholder being prompted by their bank to verify their identity (typically a password, SMS code, or fingerprint check) before the payment can be completed.
The latest version of 3DS is the best way to authenticate online card payments and comply with the SCA requirements. It offers flexible authentication flows and the ability to request exemptions from SCA, meaning a smoother checkout flow for your customers.
Digital wallets and some local European payment methods should also support SCA:
- Card-based digital wallets like Apple Pay and Google Pay have multi-factor authentication built in to their payment flows, offering a frictionless checkout experience that supports SCA.
- Many common European payment methods, like Bancontact, iDEAL, and Multibanco, should also follow the SCA requirements.
Some transactions fall outside the scope of SCA, meaning they do not require strong authentication.
A merchant-initiated transaction (MIT) is one where you make the payment with a customer's previously saved card. Scheduled and unscheduled MITs of a fixed or variable amount (for example, subscriptions and automatic account top-ups) are out of scope.
However, you will need to perform SCA when the card is saved or when the first payment in a series is made by the cardholder. You also need to get an agreement from the customer to charge their card at a later date.
In addition, you must include additional parameters in your payment request to clearly identify such transactions as merchant-initiated. Learn more in our stored card details guide.
MOTO payments fall outside the scope of SCA.
One leg out (OLO) payments – transactions where you and/or the customer's bank are based outside the EEA or the UK – are out of scope.
If a customer uses an anonymous prepaid card, like a gift card, they do not need to go through SCA.
For transactions that are in scope of SCA, you can request exemptions from strong authentication if the transactions meet certain criteria.
However, the customer's bank has the final say on whether the requested exemption applies. They will assess the risk of the payment and decide whether to accept the exemption, or reject it and request strong authentication for the transaction.
- Bank accepts exemption. If the customer’s bank accepts the requested exemption, the transaction can be completed without strong authentication.
- Bank rejects exemption. If the customer’s bank does not allow the exemption, you will receive a
20154response code, meaning you will need to apply 3DS authentication to the transaction to meet SCA requirements.
The 3DS 2.1 and 2.2 protocols support exemptions. Aside from allowing you to remain SCA-compliant in PSD2-mandated regions, exemptions can also help to provide customers with a seamless experience. This is because more transactions can be approved through frictionless authentication.
Additionally, if an issuer declines an exemption, the customer will have to go through the challenge flow instead of having their transaction declined, resulting in a higher acceptance rate.
You can request exemptions during authentication with "3ds.enabled": true, or during authorization with "3ds.enabled": false.
If the bank accepts the exemption, whether it was requested during authentication or authorization, then the transaction can be completed without SCA.
If the bank rejects an exemption requested during authentication, the transaction is not declined, but the customer will have to go through SCA.
If the bank rejects an exemption requested during authorization, you will receive a 20154 response code. To meet SCA requirements, the payment will need to be retried with 3DS authentication applied and the "3ds.challenge_indicator" field set to "challenge_requested" or "challenge_requested_mandate".
Information
If you request an exemption, and the customer’s bank approves it, you do not benefit from the liability shift. This means you would be liable if the transaction turned out to be fraudulent.
If you're using exemptions via our standalone Authentication product or a third-party provider, you'll also need to flag successful authentication exemptions in the authorization message. To do this, set 3ds.enabled to true and add the applied exemption that was performed during authentication.
| Scheme | Low-value payment | Transaction risk assessment | Secure corporate payment | Trusted merchant list |
|---|---|---|---|---|
Visa | ||||
Mastercard | ||||
American Express | ||||
Diners Club (DCI) |
| Scheme | Low-value payment | Transaction risk assessment | Secure corporate payment | Trusted merchant list |
|---|---|---|---|---|
Visa | ||||
Mastercard | ||||
American Express | ||||
Diners Club (DCI) |
Information
American Express handles the trusted merchant list exemption itself, so you do not need to request this exemption for Amex cards.
Payments below €30 are considered low-value and may be exempt. However, the customer’s bank may still trigger strong authentication if:
- within a 24-hour period, this exemption has been used five times since the customer's last successful authentication
- the total value spent on the card without SCA exceeds €100
The transaction risk assessment (TRA) exemption allows for certain transactions to be exempted from SCA, provided that a robust risk analysis is performed and the payment service providers (PSPs) meet specific fraud thresholds. TRA is key to delivering frictionless payment experiences for low-risk transactions.
The customer may add a merchant to a trusted list after the initial strong authentication, meaning all subsequent payments to that business will be exempt.
To request to be added to a trusted list, the first transaction must have the trusted_listing_prompt exemption. Subsequent authentication requests can then be sent with the exemption set to trusted_listing.
Corporate payments made with virtual and lodge cards (typically used for business travel expenses), or from central travel accounts, are exempt.
To show the impact of strong authentication, the following tables outline how it affects different business models and transactions.
| Business scenario | Transaction type | SCA required? | Payment request parameters |
|---|---|---|---|
Ecommerce | Customer enters card details at checkout for one-off online payment. | Yes, unless exemptions apply. |
|
Customer uses previously stored card details to make a one-off online payment. | Yes, unless exemptions apply. |
And, if using our Full card API:
| |
Customer enters card details at checkout, which are stored for later use. | Yes |
| |
Subscriptions | The first transaction that starts the subscription. This could be a zero-dollar authorization/card verification. | Yes |
|
Subsequent payments of the subscription. | No. These qualify as merchant-initiated transactions (MITs) which fall outside the scope of SCA. |
And, if using our Full card API:
| |
Unscheduled MITs, like automatic account top-ups | The first transaction where the customer agrees to the terms and conditions of subsequent payments. This could be a zero-dollar authorization/card verification. | Yes |
|
Subsequent payments as agreed in the initial terms and conditions. | No. These qualify as MITs, which are out of scope. |
| |
MOTO payments | Payments made by mail order or over the phone. | No. MOTO payments are out of scope. |
|
Incremental authorizations | The first transaction, where the customer agrees to later merchant-initiated authorizations. | Yes, unless exemptions apply. |
|
Subsequent merchant-initiated incremental authorizations. | No. These qualify as MITs, which are out of scope. |
| |
Travel and hospitality indirect sales | Transactions processed by the supplier of the travel/hospitality service. | Yes. However, you can flag such transactions as MOTO payments to identify them as out of scope. |
|
Information
For more details about the additional parameters required for payments using saved cards, see our stored card details guide.
To implement 3DS and comply with SCA, you need to add the following fields to your payment requests. Read our guide on authenticating payments for more details.
| Field name | Description | Possible values |
|---|---|---|
boolean | Choose whether or not you want 3DS authentication to be performed for the payment. |
|
string | Indicate your preference for whether or not a 3DS challenge should be performed. The customer’s bank has the final say on whether the customer is challenged. If both values are provided, |
|
string | Request an SCA exemption for the transaction. The customer’s bank has the final say on whether or not it applies. If the requested |
|
Information
If you requested an exemption during authorization and the customer's bank denies your exemption request, you'll receive a soft decline code (20154) in the response. This means SCA authentication is required for the transaction. You’ll need to resubmit the payment with the 3ds.enabled field set to true and, optionally, the 3ds.challenge_indicator field set to challenge_requested_mandate.