Strong Customer Authentication (SCA)
SCA is the PSD2 rule that an electronic payment, or online access to a payment account, must be authenticated with two independent factors — and, for remote payments, bound to the exact amount and payee. This guide covers the whole rule set across channels: the factors and dynamic linking, what is out of scope and every exemption with its thresholds, how SCA runs for cards online and in store and for online and open banking, the UK regime, what PSD3 / PSR change, and similar mandates elsewhere.
United Kingdom
The UK kept the RTS after Brexit as the FCA's SCA-RTS and has since diverged from the EU text:
- E-commerce — full enforcement from 14 March 2022, with the same soft-decline mechanics as the EEA.
- Contactless — the single-transaction limit rose to £100 and the cumulative limit to £300 in October 2021. From 19 March 2026 the fixed limits were removed: firms set their own limits under a risk-based exemption, must let customers set a lower limit or turn contactless off, and most kept £100 to begin with.
- Account information — since 2022 a customer authenticates with the bank only when first connecting through an AISP; afterwards the AISP itself reconfirms the customer's consent every 90 days, without a bank SCA.
- Open-banking APIs follow the UK Open Banking standard on FAPI, with app-to-app redirect as the norm.
PSD3 and the Payment Services Regulation
PSD2 is being replaced by a directive (PSD3) for licensing and supervision and a directly applicable Payment Services Regulation (PSR) for conduct rules, which is where SCA moves. The final compromise texts were settled on 23 April 2026; as of late October 2026 formal adoption and publication in the Official Journal are still pending, and the PSR's obligations are expected to apply around 2028. Details below follow the agreed texts and may still move in the EBA's technical standards:
- Clearer scope — MIT and MOTO stay outside SCA, but setting up an MIT agreement through a remote electronic channel needs SCA, and MOTO must have security measures of its own. The PSR names actions that trigger SCA, such as adding a payee or a new device.
- Accessibility — PSPs must offer at least one SCA method that does not depend on a smartphone, free of charge, for customers who cannot use the default (older users, people with disabilities, no smartphone).
- Outsourcing and delegation — SCA performed by technical service providers and wallets on the PSP's behalf needs an outsourcing agreement, and a TSP that fails to apply SCA correctly can be made liable for the resulting losses.
- Fraud — IBAN/name verification of payee for all credit transfers, fraud-data sharing between PSPs, and refunds for bank-impersonation fraud — complementing SCA rather than replacing it.
- Open banking — permission dashboards and tighter interface rules; the redirect, decoupled and embedded models remain, with the bank still performing SCA.
More on the package: PSD3 / PSR in the Open Banking guide →
Outside Europe
| Market | Rule | What it means for integrations |
|---|---|---|
| India | RBI has required an Additional Factor of Authentication for domestic card-not-present payments since the early 2010s. Its Authentication Mechanisms for Digital Payment Transactions Directions (September 2025) apply from 1 April 2026: two-factor authentication for domestic digital payments, with alternatives to SMS OTP and risk-based checks allowed, and issuers must be able to validate non-recurring cross-border CNP transactions from 1 October 2026. | OTP or app approval on almost every domestic online payment; recurring card payments run under the RBI e-mandate framework. |
| Japan | The Credit Card Security Guidelines (METI with the Japan Consumer Credit Association) required EMV 3DS on all online card payments by the end of March 2025, and issuers to move cardholders off static passwords. | Japanese merchants must run 3DS on every e-commerce payment; there is no EU-style exemption catalogue. |
| Australia | No statutory SCA. The industry's CNP Fraud Mitigation Framework (AusPayNet) requires merchants above fraud-rate thresholds to apply strong authentication or other mitigation. | 3DS is risk-based; heavy-fraud merchants are pushed into it. |
| United States & Canada | No regulatory SCA mandate. 3DS is optional and driven by liability shift and issuer risk. | Use 3DS selectively; exemption flags are not used. |
For cross-border traffic the rule follows the issuer: a US card at an EU merchant is a one-leg-out transaction (best effort), while an EU card at a US merchant can still be soft-declined by its issuer.
🧩 Check yourself