Smart 3DS routing
ACS outages and issuer latency can stall authentication before authorisation begins. Cardflo supports 3DS routing orchestration for multi-acquirer merchants, using endpoint availability and response times to switch authentication traffic to a responsive acquirer partner.
- Category
- Security
- Capabilities
- 6
- Available on
- All plans
Multi-acquirer merchants frequently encounter degraded access control servers and issuer latency that stall the authentication phase of an online checkout. When an acquiring gateway routes all authenticated traffic down a single path, unexpected downtime at the issuer level prevents legitimate authorisation requests from proceeding to settlement.
Cardflo configures dynamic switching logic to direct authentication messages to the most responsive acquirer partner based on real-time endpoint latency. Operators can separate the authentication leg from the authorisation attempt, ensuring transactions bypass intermittent outages before executing the final financial request through the preferred clearing partner.
PCI scope is minimised through hosted fields and network tokens, and sensitive credentials never touch your servers. Strong Customer Authentication is applied intelligently to keep both regulators and conversion teams happy.
Smart 3DS routing overview
Multi-acquirer environments require precise control over the infrastructure that transmits authentication messages to issuing banks. When relying on a single connection, merchants risk losing transaction volume during access control server outages, even if the underlying card is valid.
Cardflo implements 3DS routing orchestration to evaluate endpoint availability and latency before directing the authentication payload to the most suitable acquirer partner in the network. This capability focuses exclusively on pathway availability rather than optimising the 3DS protocol itself, which merchants manage via 3DS-optimisation, or generating cross-acquirer tokens, covered under tokenised payments.
By splitting the authentication phase from the financial clearing phase, product managers can shift traffic away from degraded systems in real time. Transactions proceed via an auth-only routing framework, allowing the final settlement to occur on a separate acquirer partner if the commercial logic dictates a split flow.
How smart 3DS routing works
Evaluate endpoint latency
The orchestration layer analyses real-time ping data and historical latency from the available acquirer partners. Before dispatching the authentication message, the system determines which partner currently maintains the most stable connection to the issuing bank's access control server. This calculation ensures the payload avoids degraded pathways that might otherwise stall the initial transaction process.
Execute dynamic switching
Once the optimal pathway is identified, the system transmits the required data elements through the selected acquirer partner. By implementing multi-acquirer 3DS switching, the merchant directs the payload around regional outages or intermittent infrastructure failures. The transaction reaches the issuer via the most reliable route, allowing the authentication challenge or background verification to proceed normally.
Finalise auth-only routing
After the issuer successfully validates the cardholder, the system receives the authentication cryptogram. Because the merchant employs auth-only routing, this validated data can now be appended to a separate financial authorisation request. The final settlement leg then proceeds through a different acquirer partner chosen for commercial favourability or domestic settlement capabilities rather than authentication speed.
Why smart 3DS routing matters
Mitigate access server downtime
Issuing banks and acquiring gateways frequently suffer micro-outages that interrupt message transmission. Without dynamic 3D Secure routing, a single degraded endpoint blocks legitimate purchases from clearing. Rerouting the authentication leg through alternative pathways ensures technical failures at one acquirer partner do not translate into lost revenue for the merchant during high-volume trading periods.
Decouple authentication from settlement
Forcing authentication and settlement through the same acquiring connection restricts commercial flexibility. By decoupling these phases, finance teams can prioritise pathway reliability for the initial issuer challenge while reserving domestic processing rates for the actual financial clearing. This separation reduces technical declines without sacrificing the financial advantages of a multi-acquirer strategy.
Regulatory notes for smart 3DS routing
Cross-border authentication mandates
European payment services directives require strict authentication measures for electronic transactions, but the pathways used to verify the cardholder can vary significantly by region.
Regulatory frameworks do not dictate that the authentication provider must act as the final settlement entity, granting merchants flexibility in their routing decisions.
Implementing acs downtime mitigation ensures merchants meet these strict verification mandates even when domestic infrastructure fails.
By shifting the verification payload to an operational cross-border acquirer partner, operators maintain full compliance with regional authentication directives while holding on to the buyer's ability to complete the purchase.
Cryptogram portability and scheme rules
Major card networks like Visa and Mastercard permit the generation of an authentication cryptogram by one entity and the submission of that cryptogram by a different gateway.
This scheme rule enables multi-acquirer merchants to decouple the initial verification from the financial clearing process without violating network mandates.
When deploying 3DS routing orchestration, merchants must ensure the secondary acquirer partner can successfully ingest external authentication values. The orchestration platform automatically formats the passed cryptogram according to exacting scheme specifications, ensuring the final authorisation request contains the necessary proof to satisfy liability shift requirements.
Smart 3DS routing use cases
Ticketing traffic across acquirer partners
Stadium operators face concentrated card traffic when reserved seats go on sale, and an acquirer partner’s ACS path can slow or time out while inventory remains temporarily held. Cardflo monitors authentication response health and routes new 3DS requests through another acquirer partner without changing the operator’s ticket allocation workflow.
Issuer specific ACS failover
Multi-acquirer merchants can encounter an ACS outage affecting cards from a particular issuer range while other authentication routes remain available. Cardflo analyses timeout and error patterns by BIN and acquirer path, then switches subsequent 3DS authentication traffic to a responsive acquirer partner while retaining the transaction reference and authentication result.
Authentication before acquirer selection
Payment orchestrators may need to complete 3DS authentication before commercial routing rules select the acquirer partner that will receive the authorisation. Cardflo supports auth-only routing, retains the resulting cryptogram and electronic commerce indicators, and passes the authenticated payment data into the merchant’s separate authorisation routing workflow.
Regional acquirer maintenance windows
Merchants operating several regional MIDs may face planned acquirer maintenance that leaves a configured 3DS endpoint unavailable while checkout traffic continues. Cardflo applies scheduled routing rules and live endpoint checks to direct authentication requests through an available acquirer partner, then restores the preferred path after service health is confirmed.
Smart 3DS routing by the numbers
This range reflects typical industry improvements when moving from a static 3DS implementation to a dynamic routing model that accounts for issuer-specific technical preferences.
Merchants often observe this reduction in soft declines as smart routing ensures that transactions requiring SCA are correctly identified and authenticated before being sent for authorisation.
This represents the industry standard for transactions that can be authenticated without a manual challenge when sufficient data is passed through the most compatible 3DS2 pathway.
Methodology: these figures are illustrative ranges drawn from published industry data and observed merchant cohorts, not guarantees. Actual results depend on your risk profile, card mix, geography and acquiring setup, and are confirmed only in your own pricing and approval terms.
Related terms
Talk to our team about a live rollout across our acquirer partners' rails.
What you get with Smart 3DS routing
- Route authentication payloads across multiple acquirer partners based on regional availability and historical latency.
- Implement auth-only routing logic to separate the authentication phase from the final financial authorisation.
- Detect access control server outages and dynamically switch the authentication request to a secondary pathway.
- Centralise 3DS routing orchestration rules to govern traffic distribution across the entire acquirer partner network.
- Evaluate real-time issuer response times to determine the most reliable route for complex authentication payloads.
- Maintain checkout continuity during regional infrastructure degradation by diverting traffic to operational acquiring gateways.
A short scoping call, then a written plan for your MIDs.
Questions about Smart 3DS routing
How does dynamic 3D Secure routing detect an unavailable endpoint?
The orchestration layer continuously monitors the latency, timeout rates and error codes returned by each acquirer partner in the network.
When a specific pathway exhibits response times that exceed acceptable thresholds or returns systemic failure codes during the authentication phase, the system identifies the route as degraded.
The traffic control logic then automatically suppresses this pathway for subsequent requests, redirecting the payload to the next available acquirer partner that demonstrates a stable connection to the relevant access control server.
Can merchants separate the authentication and authorisation requests?
Yes, this separation forms the foundation of auth-only routing. The orchestration platform sends the initial authentication payload through an acquirer partner chosen specifically for its connectivity to the issuing bank.
Once the access control server returns a successful authentication value, the platform extracts this cryptogram.
The merchant can then append this proof of authentication to a subsequent financial authorisation message, routing the final settlement through a completely different acquirer partner based on processing fees or currency settlement preferences.
Does 3DS routing orchestration require multiple integrations?
Merchants integrate once with the Cardflo orchestration platform, which manages the onward connections to the acquirer partner network. Product managers configure the multi-acquirer 3DS switching logic within a central dashboard, defining how traffic should diverge during infrastructure degradation.
The platform translates the single initial request into the specific API formats required by the varying acquiring partners, eliminating the need for internal engineering teams to build and maintain separate routing logic for every endpoint in the payment stack.
What happens if an alternative route also fails?
If primary and secondary pathways both encounter systemic degradation at the access control server level, the platform exhausts the configured routing hierarchy based on the merchant's predefined rules. The system logs the specific error codes indicating latency or timeout failures at each hop.
To handle the subsequent response when a transaction cannot proceed, operators define separate workflows. They configure these secondary actions outside the routing logic, often relying on protocols detailed in 3DS-fallback to manage the technical decline.
Related features.
Related guides.
See how Cardflo compares.
Ready to improve your payments setup?
Tell us about your business. We'll match you with the right acquiring partners and the right route, typically inside a week.