.svg)
.svg)
.svg)
.svg)
.svg)
The unified orchestration layer for wallets and alternative payments
.svg)
The secure repository for all your payment methods
.svg)
Workflow-driven payments intelligence for smarter routing and higher auth rates
.svg)
A flexible fraud and authentication layer. Instantly add advanced fraud tools and 3DS
One integration to sell inside ChatGPT, Gemini, and every agentic platform
The visual workflow builder that ties fraud, identity, and payment routing together in one place
The unified orchestration layer for wallets and alternative payments
The secure repository for all your payment methods
Workflow-driven payments intelligence for smarter routing and higher auth rates
A flexible fraud and authentication layer. Instantly add advanced fraud tools and 3DS
One integration to sell inside ChatGPT, Gemini, and every agentic platform
The visual workflow builder that ties fraud, identity, and payment routing together in one place
Strong Customer Authentication (SCA)
Strong Customer Authentication (SCA) is a regulatory requirement introduced by PSD2 (Payment Services Directive 2) mandating that electronic payments above certain thresholds be authenticated using at least two independent factors from the categories of: something the customer knows (a password or PIN), something the customer has (a phone or hardware token), or something the customer is (a biometric). SCA applies to customer-initiated electronic payments within the European Economic Area (EEA) and the United Kingdom.
SCA enforcement began in earnest in 2021 following phased implementation periods across EEA member states, with the UK following its own timeline post-Brexit. For merchants operating in these markets, SCA compliance is not optional: issuers are entitled to decline transactions that lack proper authentication, and the card networks have progressively tightened enforcement.
The practical implementation of SCA for card payments is 3DS2 / EMV 3-D Secure. A properly implemented 3DS2 flow satisfies SCA requirements, the two required factors are typically the cardholder's device (something they have) and a biometric or PIN (something they are or know). SCA also applies to other payment methods: bank redirects, open banking payment initiation, and digital wallet payments each have their own SCA implementation paths.
SCA is not applied to every transaction. A well-structured payments strategy uses Exemption Management to apply SCA only where required and to request exemptions wherever available, keeping checkout friction minimal while remaining compliant. The most commonly used exemptions include low-value transactions (under €30), Transaction Risk Analysis (TRA) for low-risk transactions, recurring payments after the initial authenticated transaction, and trusted merchant listings.
Frequently Asked Questions
Does SCA apply to merchants outside the EEA and UK?
SCA as a regulatory requirement applies specifically to payment service providers regulated under PSD2, which means it directly governs transactions where either the merchant's payment service provider or the cardholder's bank is located in the EEA or UK. Purely domestic transactions entirely outside these regions are not subject to PSD2 SCA requirements.
What happens to conversion rates when SCA is applied?
SCA can reduce conversion if implemented without thought, every unnecessary authentication challenge introduces friction and increases abandonment risk. Well-implemented SCA strategies mitigate this through Exemption Management: transactions that qualify for exemptions (low-value, low-risk, recurring) are processed without SCA challenges. Only transactions that genuinely require authentication receive a challenge flow, and modern 3DS2 challenge flows (biometric, one-tap push notifications) are far less disruptive than legacy password-based authentication.
What is the SCA threshold for low-value exemptions?
Under PSD2, individual transactions under €30 qualify for a low-value exemption from SCA. However, cumulative limits apply: the exemption ceases to be available once five consecutive low-value transactions have been made without SCA, or once the cumulative value of consecutive unauthenticated transactions reaches €100. When these thresholds are reached, SCA is required for the next transaction.
Related Terms
