Strong Customer Authentication

How European Regulation impacts your business

What is Strong Customer Authentication?

Strong Customer Authentication (SCA) is a new requirement of the second Payment Services Directive (PSD2), which aims to add extra layers of security to electronic payments.

SCA will apply to the European Economic Area (EEA) and the United Kingdom, and is likely to continue to apply in the UK after the Brexit transition period. It will require banks to perform additional checks when consumers make payments to confirm their identity. To do this, banks may ask for a combination of two forms of identification at checkout. Examples include:

Icon depicting knowledge

Knowledge:
Something they know
(such as a password or PIN).

Icon depicting possession

Possession:
Something they have
(such as a mobile phone, card reader or other device evidenced by a one-time passcode).

Icon depicting inherence

Inherence:
Something they are
(such as a fingerprint).

The requirement for SCA for e-commerce will be enforced in the UK from September 15th 2021, and across most of the EEA from January 1st 2021. It is already being enforced for other electronic transactions.

What does this mean for Businesses?

Your customers may need to provide two forms of identification to their bank when shopping from you. This applies now for face-to-face payments and applies from September 15th 2021 in the UK, and from January 1st 2021 in most of the EEA for e-commerce. If your customer cannot be identified using two factors, their payments to you might be considered non-compliant and be declined.

Your business bank, or the company that provides the checkout service for your website, will be able to “switch on” the technology required to perform the checks required by the regulation. Please contact them to ensure you are ready to meet the new requirements for online payments from September 15th 2021.

Face-to-face payments:

SCA applies to most face-to-face transactions. Chip & PIN transactions are compliant, but sometimes your customers may be prompted to enter their PIN when making contactless payments.

In order to support these requirements, you might need to update your payment terminal. Please speak to your business bank for more information.

Online payments:

Your customers may be asked to verify their identity with two factors during the checkout process.

A technology called 3D Secure can help you meet this requirement. The latest version of this technology (called EMV 3DS) will provide your customers with the most convenient experience as they go through this process, reducing the likelihood that any additional steps will be required by your customer and removing friction from the purchase process. This version of the technology is also more suited for use on mobile devices.

There are also some e-commerce transactions which are out of scope of the regulation, and others that may be exempt. Your bank/checkout provider may also be able to help you “flag” the payments that don’t require SCA – this adds a certain code so that some payments can pass through without the need for extra checks. Please see our Infographic on Out of Scope and Exempt Transactions for more details.

Please access relevant resources in our Resource Library.

What does this mean for Issuers and Acquirers?

Issuers and acquirers have a key role to play in ensuring the success of SCA by adopting compliant solutions and creating an optimal user experience.

Visa is actively monitoring the SCA performance of the ecosystem and engaging with participants where needed to help them to find solutions that allow customers to continue to make seamless payments.

How is Visa helping?

Throughout the lead-up to SCA enforcement, Visa has led the European payments ecosystem through the extensive publication of guides and best practices to provide clarity on what is required to comply with the regulation and provide an optimal experience for cardholders.

Visa will use its overview of the payments ecosystem to support local regulators with information around ongoing progress with SCA implementation and the impact on European payments.

Visa has also developed a ramp-up plan to help guide you through the activities and requirements for SCA readiness. For more information, please see this video.