Strong Customer Authentication (SCA)
SCA is the PSD2 rule that an electronic payment, or online access to a payment account, must be authenticated with two independent factors — and, for remote payments, bound to the exact amount and payee. This guide covers the whole rule set across channels: the factors and dynamic linking, what is out of scope and every exemption with its thresholds, how SCA runs for cards online and in store and for online and open banking, the UK regime, what PSD3 / PSR change, and similar mandates elsewhere.
Online and mobile banking
For a bank, SCA is not only about payments. All three triggers of Art. 97(1) apply to its own channels:
- Login — SCA at first access; read-only access to balance and the last 90 days of transactions can then run on the Art. 10 exemption for up to 180 days.
- Payments — every credit transfer, with dynamic linking: the authentication screen or message shows the amount and payee, and the signature or OTP is bound to them. Own-account transfers (Art. 15), trusted beneficiaries (Art. 13), fixed standing orders (Art. 14) and TRA under the credit-transfer reference rates (Art. 18) can be exempt.
- Sensitive actions — adding or editing payees, changing limits, enrolling a new device for the banking app, changing the phone number or e-mail that receives codes, viewing full card details. These are where account-takeover fraud happens, and SCA here is not optional.
Open banking: the bank authenticates, the TPP relies on it
Under PSD2 Art. 97(5) the account-servicing bank (ASPSP) must let a payment initiation service provider (PISP) or account information service provider (AISP) rely on the bank's own authentication procedures. The TPP never holds a factor; it starts the flow and receives the result. The three SCA approaches differ only in where the customer meets the bank:
App-to-app or browser redirect
The TPP sends the customer to the bank's app or web page, the bank runs SCA and shows the consent, then redirects back. The dominant model, and the one FAPI profiles.
Approve on another device
The bank pushes the request to its app on the customer's phone; the TPP polls or is notified (CIBA style). Useful for desktop and call-centre journeys.
Factors entered at the TPP
The customer types credentials and OTP into the TPP, which relays them to the bank's API. Permitted, but supervisors treat it as an obstacle when it is the only option, and it is fading.
Animated flow — payment initiation with redirect SCA
A "pay by bank" checkout under PSD2: the PISP creates the payment order over the ASPSP's API, the payer is redirected to their bank for SCA with dynamic linking, and the payment settles as a (usually instant) credit transfer — no card rails involved.
Pay by Bank Selected
PSU chooses account-to-account payment at checkout.
Instead of entering card details, the payer picks their bank. The merchant hands off to its payment-initiation provider — a licensed PISP.
What this means per service
| Service | SCA rule |
|---|---|
| Account information (AIS) | SCA when the customer first connects the account through the AISP; since 25 July 2023 the bank must then exempt that access (Art. 10a) and renew SCA at least every 180 days, prompted through the AISP. Data beyond 90 days of history or sensitive payment data still needs SCA. |
| Payment initiation (PIS) | SCA with dynamic linking for each payment, performed by the bank on the amount and payee the PISP submitted. Exemptions are the bank's call, not the PISP's. |
| Confirmation of funds | A yes/no answer to a card-issuing PSP; the customer gives explicit consent once, no SCA per request. |
| Variable recurring payments | The bank authenticates the customer when the mandate is created; payments within the mandate's limits then run without a fresh SCA each time. Under PSD2 this rests on exemption and mandate design, which varies by market. |
The EUDI Wallet as an SCA method
Under eIDAS 2.0, PSPs that must apply SCA also have to accept the EU Digital Identity Wallet for it by the end of 2027. The wallet acts as a possession element (its key is held in a certified secure device) plus a knowledge or inherence element (the unlock), and dynamic linking comes from the transaction data the bank, as verifier, puts into the presentation request. The EUDI Wallet guide walks through the flow.
🧩 Check yourself