Reference
Payment Certification Levels
A practical guide to EMVCo L1 / L2 / L3 terminal certifications, PCI DSS merchant compliance tiers, and the standards that govern every card-present transaction.
3D Secure Authentication Protocol
Protocol for authenticating cardholders in card-not-present transactions. EMV 3DS 2.x (3DS2) replaced the 1.0 full-page redirect with browser/app SDK-based exchanges, rich device data, and risk-based authentication supporting frictionless, challenge, and decoupled flows.
1.0 vs 2.x Comparison
3DS 1.0
- Full-page redirect to ACS (breaks mobile flow)
- Password-based authentication (static)
- Limited data sent to ACS — high friction
- Poor mobile UX, high cart abandonment
- No risk-based / frictionless path
EMV 3DS 2.x
- iframe / native SDK — no redirect required
- Device fingerprinting in background (Method URL)
- Frictionless or challenge — issuer decides
- 100+ rich data elements sent to ACS
- SCA-compliant (EU PSD2 RTS); decoupled flow support
Protocol Architecture
3DS Server (3DSS)
Merchant-side component. Initiates authentication, sends AReq to the Directory Server, receives ARes. Integrates with the merchant payment page or payment gateway.
Directory Server (DS)
Scheme-operated (Visa ACS, Mastercard DS). Routes messages between 3DSS and ACS. Manages card range lookups, versioning, and scheme-level fraud rules.
Access Control Server (ACS)
Issuer-operated. Authenticates the cardholder, evaluates risk, decides frictionless / challenge / decline. Generates the CAVV / authenticationValue on success.
Authentication Flows
Frictionless
3DSS sends AReq
→
DS routes to ACS
→
ACS decides low-risk
→
ARes transStatus=Y
No cardholder interaction required
Challenge
AReq
→
ARes (C)
→
CReq (OTP/biometric)
→
CRes (Y/N) + RReq
Cardholder enters OTP, biometric, or answers question in ACS challenge window
Decoupled
AReq (deviceChannel=03)
→
ACS initiates out-of-band auth
→
RReq delivers result async
Cardholder authenticates on a separate device; up to 1-hour timeout
Message Types
Message
Direction
Purpose
AReq
3DSS → DS → ACS
Authentication Request — initiates 3DS flow with full context
ARes
ACS → DS → 3DSS
Authentication Response — frictionless outcome or C = challenge required
CReq
Browser/SDK → ACS
Challenge Request — cardholder OTP, biometric, or knowledge data
CRes
ACS → Browser
Challenge Response — final Y/N authentication decision
RReq
ACS → DS → 3DSS
Results Request — post-challenge or decoupled result delivery
RRes
3DSS → DS → ACS
Results Response — acknowledgement of RReq receipt
PReq/PRes
Browser → ACS
Preparation — delivers Method URL for device fingerprint collection
Key AReq Fields
Field
Values / Notes
messageType / messageVersion
AReq / 2.1.0 or 2.2.0
deviceChannel
01=App-based, 02=Browser, 03=3RI (3DS Requestor Initiated)
messageCategory
01=Payment Authentication, 02=Non-Payment Authentication
acctNumber / acctExpiry / acctID
PAN, YYMM expiry, optional account identifier
purchaseAmount / purchaseCurrency / purchaseExponent / purchaseDate
Amount in minor units, ISO 4217 numeric, decimal exponent, YYYYMMDDHHmmss
mcc / merchantCountryCode / merchantName
ISO 18245 MCC, ISO 3166-1 numeric, free text
browserInfo
userAgent, acceptHeader, IP, colorDepth, screenHeight, screenWidth, timeZone, javaEnabled, javaScriptEnabled
threeDSCompInd
Y=Method completed, N=Not completed, U=Unavailable
notificationURL
Merchant URL where ACS posts CRes after challenge
transStatus Values
Y
Authentication Successful — full strong authentication achieved; CAVV generated
A
Attempts Processing — proof of attempt; merchant gets partial liability shift without full auth
C
Challenge Required — ACS needs additional cardholder interaction; proceed to CReq/CRes
D
Decoupled Confirmed — authentication happening out-of-band on separate device
N
Not Authenticated — transaction declined by issuer; do not proceed
U
Could Not Perform — technical error; merchant may proceed at own risk
R
Authentication Rejected — fraud or block signal; do not attempt the transaction
ECI Values
ECI
Scheme
Meaning
05
Visa
Fully authenticated via 3DS — full liability shift to issuer
06
Visa
Attempted — proof of attempt, partial liability shift
07
Visa
Not authenticated / no 3DS — no liability shift
02
Mastercard
Fully authenticated via 3DS
01
Mastercard
Attempted — proof of attempt
00
Mastercard
Not authenticated
05
Amex
Fully authenticated via SafeKey 3DS
06
Amex
Attempted authentication
SCA Exemptions (EU PSD2)
Exemption
Trigger Condition
Liability
Low Value
Under EUR 30; up to 5 consecutive transactions or cumulative EUR 100 limit. Soft decline if limit exceeded.
Merchant
Low Risk TRA
Transaction Risk Analysis by acquirer/issuer showing low fraud rate (applies under volume thresholds)
Requester
Trusted Beneficiary
Merchant is on cardholder's trusted/whitelisted list maintained by issuer
Merchant
Recurring
Same amount, same merchant. First transaction requires SCA; subsequent are exempt.
Merchant
Secure Corporate
Lodge cards, virtual cards, B2B corporate with centralized control processes
Corporate
MIT (Merchant Initiated)
Subscription or delayed delivery triggered by merchant; cardholder not present
Merchant
Related Tools
Use these tools to work with the cryptographic primitives that underpin terminal and card security.