Payments glossary · Compliance
Strong Customer Authentication (SCA)
Strong customer authentication (SCA) is an EEA and UK requirement for customers to verify electronic payments with at least two independent factors from something they know, something they have and something they are, unless an exemption applies.
How Strong Customer Authentication works
SCA comes from PSD2 and its regulatory technical standards, Commission Delegated Regulation (EU) 2018/389, which applied from 14 September 2019. The card industry was given extra time to adapt online card payments; in the UK, the FCA set 14 March 2022 as the final deadline for e-commerce. SCA also applies to bank and open banking payments, which banks authenticate in their own apps.
The rules include exemptions that merchants' providers can request to reduce friction: remote payments of up to 30 euros (subject to cumulative limits), later payments in a series of recurring payments of the same amount to the same payee, payees the customer has added to a trusted list, and transaction risk analysis where the provider's fraud rates are low enough. Merchant-initiated transactions, such as subscription renewals charged without the customer present, are treated as outside the scope of SCA, provided the customer authenticated when the agreement was set up.
The issuer always makes the final decision and can require authentication even when an exemption is requested. Where only one of the payment providers is in the EEA, the European Banking Authority has said SCA still applies to the EEA-based provider where it can be applied, while non-EEA issuers are not bound by PSD2. For card payments SCA is usually delivered through 3-D Secure, so a working 3DS integration and good use of exemptions are key to protecting approval rates.