Regulation
Strong Customer Authentication
Also: SCA
PSD2 requirement that customer-initiated electronic payments in the EEA and UK be authenticated with two of: knowledge, possession, inherence.
Strong Customer Authentication, often abbreviated to SCA, is a regulatory requirement introduced under the Second Payment Services Directive (PSD2) to reduce fraud for electronic payments within the European Economic Area and the United Kingdom. It mandates that most electronic payments initiated by the payer be authenticated using at least two independent elements categorised as knowledge, such as a password; possession, such as a mobile device; and inherence, such as biometric data. The primary technical standard used to achieve compliance is 3D Secure, which facilitates the exchange of data between the merchant, the acquirer, and the issuer. Issuers may decline transactions that do not meet these criteria, although specific exemptions exist for low-value payments, recurring subscriptions, and transactions deemed low risk via Transaction Risk Analysis (TRA). Compliance is monitored by national regulators like the Financial Conduct Authority in the UK, ensuring that payment service providers maintain security without creating undue friction at checkout.
Frequently asked
How do merchants apply for SCA exemptions to reduce friction?
Merchants can request exemptions via their payment gateway or acquirer by flagging specific transactions in the payment authorisation request. Common exemptions include Low Value Transactions under thirty euros and Transaction Risk Analysis, though the final decision to honour an exemption rests with the issuing bank.
What happens if a transaction requires SCA but 3D Secure is not used?
If a transaction falls within the scope of PSD2 and no valid exemption is applied, the issuing bank is likely to return a soft decline code. The merchant must then restart the payment flow using 3D Secure to prompt the customer for the necessary two-factor authentication before the payment can be successfully processed.
Related terms
A card-network authentication protocol that shifts fraud liability from the merchant to the issuer when a cardholder is verified.
The EU's Payment Services Directive 2, which mandates SCA, opens banking APIs, and reshapes payment liability.
A charge initiated by the merchant against a previously stored credential, without the cardholder present.
Ready for velocity?
Tell us about your business. We'll match you with the right acquiring partners and the right route, typically inside a week.