How strong customer authentication works
A payment service provider applies SCA when a payer accesses a payment account online, initiates an electronic payment, or does anything through a remote channel that may carry a risk of payment fraud (PSD2, Article 97, and UK regulation 100). The elements are independent, so a breach of one does not compromise the others.
For remote payments the authentication code is tied to the amount and the payee, which is called dynamic linking: a change to either invalidates the code (Delegated Regulation (EU) 2018/389, Article 5). The same regulation caps consecutive failed attempts at five within a given period, and inactivity after sign-in to a payment account at five minutes.
The SCA exemptions and their thresholds
The technical standards list cases in which a provider is allowed, not obliged, to skip SCA.
- Contactless, EU: up to EUR 50 a payment, and EUR 150 in total or five payments in a row since the last SCA.
- Contactless, UK: no fixed limit since 19 March 2026. The provider identifies the payment as low risk.
- Low-value remote payments: EUR 30, with EUR 100 or five payments since the last SCA, in the EU. In the UK, £25, with £85 or five payments.
- Transaction risk analysis, EU: remote card payments up to EUR 100, EUR 250 or EUR 500 where the provider's fraud rate is at most 0.13%, 0.06% or 0.01%.
- Trusted beneficiaries, and recurring payments of the same amount to the same payee: SCA to set them up, not afterwards.
- Corporate payments through dedicated processes for payers who are not consumers, where the authority is satisfied they are as secure.
Who applies SCA, and why it matters at launch
The duty sits with the payer's payment service provider: the card issuer, the bank or the e-money institution. A company that issues cards or accounts builds SCA into sign-in, payments and sensitive actions.
Merchant-side businesses carry it too. Under PSD2, Article 74, a payee or its provider that fails to accept SCA refunds the financial damage caused to the payer's provider. Where the payer's provider does not require SCA, the payer bears no loss unless the payer acted fraudulently.
What is changing: the Payment Services Regulation
The EU has agreed a Payment Services Regulation that would carry the SCA rules, but has not adopted it. The agreed text adds triggers such as raising a spending limit or changing contact details online, and writes merchant-initiated payments and mail or telephone orders into the rules. It also bars providers from making SCA depend on owning a smartphone.
SCA, 3-D Secure or two-factor authentication?
- 3-D Secure
- The card schemes' protocol that carries authentication between merchant, acquirer and issuer. SCA is the legal requirement, and 3-D Secure is one way to meet it for online card payments.
- Two-factor authentication
- Any two steps at sign-in. SCA needs independent elements from the three legal categories and, for remote payments, a code linked to the amount and the payee.
- KYC
- Identity verification establishes who a customer is when the relationship starts. SCA confirms, at each sign-in or payment, that the person acting is that customer.
Where strong customer authentication shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- Card issuingVirtual and physical cards, wallets and controls, on the issuer processor you choose.
Platforms that need it
Guides that go deeper
- How to launch a business account with expense cards for SMEsThe account, the cards and the controls around them: what a business account with expense cards needs, from licensed partners and KYB to SCA and the interchange rules for commercial cards.
- SoftPOS certification, explainedWhat it takes for a phone to accept card payments: the PCI standard behind it, card scheme approval, attestation and monitoring, and what a merchant needs on day one.
Where it is written
The laws and standards this page's facts come from.
- Directive (EU) 2015/2366, PSD2, consolidated: Articles 4, 74 and 97 (EUR-Lex)
- Delegated Regulation (EU) 2018/389, the technical standards on SCA, consolidated (EUR-Lex)
- Payment Services Regulations 2017 (legislation.gov.uk)
- FCA Handbook, UK technical standards on SCA: Chapter 3, exemptions
- Payment Services Regulation, text agreed in negotiations, 5 May 2026 (European Parliament)
General information, not legal advice: what applies to you depends on your services and your market.