PSD2 & SCA Compliance: A Simple Guide for Every Business

If your business processes online payments from bank accounts or cards in Europe, you must adhere to two critical regulations: PSD2 and SCA. PSD2 is a foundational European law modernizing payment services. Strong Customer Authentication (SCA), a key component of PSD2, verifies the payer's identity to prevent fraud. Many businesses find these requirements complex, often worrying about added steps in their checkout process. This guide clarifies both regulations. You'll learn who must comply, what steps are necessary, and how to maintain a secure and efficient payment flow. By the end, you will have a clear checklist for navigating PSD2 SCA compliance.

Table of Contents

• 1. What is PSD2 and why does it matter?
• 2. What is SCA and how does it connect to PSD2?
• 3. Who needs to comply with PSD2 and SCA?
• 4. What are the core compliance requirements?
• 5. What are the SCA exemptions and when can you use them?
• 6. What’s the impact on customer experience?
• 7. What are the technical requirements and best practices?
• 8. What happens if you’re not compliant?
• 9. How to maintain compliance long-term?
• 10. What’s next after PSD2? (PSD3 & future outlook)
• Conclusion / TL;DR

1. What is PSD2 and why does it matter?

PSD2 is short for the Revised Payment Services Directive. It updated an earlier law from 2007. This revision came into effect in 2018. The main goal was straightforward: make online payments safer, fairer, and more open across Europe. Before PSD2, banks typically kept customer data private. PSD2 changed this. It requires banks to share account details. They must also allow approved third-party applications to start payments, but only when the customer gives consent. This change fosters innovation. It enables new services, like apps that help users track spending across different banks, to integrate with banking systems. Importantly, banks cannot block these approved services. In essence, PSD2 compels banks and payment companies to collaborate. This cooperation benefits both businesses and customers by offering more choices and better fraud protection.

2. What is SCA and how does it connect to PSD2?

Strong Customer Authentication (SCA) is a specific requirement within the broader PSD2 regulation. It mandates that customers prove their identity using at least two independent factors before completing an online payment. Think of this as adding a second lock to the transaction. These factors must come from different categories. One category is 'knowledge,' something only the user knows, like a password or PIN. Another is 'possession,' something only the user has, such as their mobile phone or a hardware token. The third category is 'inherence,' something the user is, such as a fingerprint or facial scan. To meet SCA requirements, a customer must successfully use any two of these methods during the online payment process. Implementing this two-factor check significantly increases security. It makes it substantially harder for fraudsters to use stolen card or bank details, turning simple one-step logins into more secure two-step checks and keeping customers' money safer.

3. Who needs to comply with PSD2 and SCA?

If your business processes online payments for customers located in the European Economic Area (EEA), Monaco, or the UK, then PSD2 and SCA apply to you. This broad scope includes various entities involved in the payment chain. Banks, credit unions, payment gateways, e-commerce websites, and any application that facilitates payments or provides access to bank data are covered. Compliance is required even if your company is headquartered outside of Europe, provided you serve European customers. However, if your business exclusively handles card-present transactions in a physical store, these online payment regulations do not apply. If you operate both in-store and online sales channels, only the online portion falls under PSD2 and SCA requirements. In summary, if your website or app facilitates the transfer of money for customers in Europe, you need to ensure your payment processes are compliant with these regulations.

4. What are the core compliance requirements?

Achieving PSD2 SCA compliance involves several key steps for businesses handling online transactions. First, for most online payments exceeding €30, you must require customers to perform a two-factor authentication check. This means verifying their identity using two independent methods as defined by SCA rules. A common and effective way for businesses to meet this requirement without extensive custom coding is by using 3D Secure 2.0. This protocol is specifically designed to handle the necessary two-factor authentication flow. Second, you must maintain records of every time a customer undergoes these authentication checks. Store these logs for a minimum of one year. This documentation is crucial to demonstrate compliance to regulatory bodies if requested. Third, you need to inform customers when you share their data with approved third parties, such as budgeting apps. A simple pop-up notification or a clear note in your service terms is usually sufficient. Finally, if you opt to build your own system for handling these checks, you must manage security certificates. These certificates need to be approved under relevant EU regulations like eIDAS. However, most small and medium-sized businesses avoid this technical complexity by relying on their payment provider to handle the SCA process. To ensure smooth implementation, assign responsibility for each compliance task—including development, logging, and legal notices—to specific individuals or teams within your organization.

5. What are the SCA exemptions and when can you use them?

Not every online payment requires Strong Customer Authentication. PSD2 includes specific exemptions to reduce friction for lower-risk transactions. Understanding these can help streamline your checkout process. The most common exception applies to small purchases. Transactions under €30 can often skip SCA. However, there's a limit to this exemption. You can only waive SCA for small purchases if the customer has not made more than five consecutive small payments or if the total cumulative amount of small payments since the last SCA check does not exceed €100. Another exemption is for trusted beneficiaries, sometimes referred to as 'whitelisting'. After a customer successfully completes an SCA check for a specific merchant, they may have the option to add that merchant to a list of trusted sellers with their bank. Future payments to a whitelisted merchant can then bypass SCA. Repeating payments, such as fixed-amount subscriptions, also qualify for an exemption. Only the initial payment in a series requires SCA; subsequent payments of the same amount to the same merchant can proceed without re-authentication. Payments made through dedicated corporate payment processes and protocols, which are not available to consumers and already have robust security measures, may also be exempted. It is important to note that while you can request these exemptions, your bank (the acquirer) must support them and correctly signal the exemption request within the payment flow. Furthermore, the customer's bank (the issuer) ultimately makes the final decision and can still require a full SCA check if they detect unusual or potentially fraudulent activity, even if an exemption was requested.

6. What’s the impact on customer experience?

Implementing extra security checks like SCA can potentially introduce friction into the online checkout process. This can lead to a less smooth experience for shoppers and, in some cases, result in abandoned carts and lost sales. Customers might become frustrated or confused by the additional verification steps. However, you can mitigate these negative impacts and maintain a smooth experience while ensuring payment security. One approach is 'smart skipping'. By working with a payment provider that uses advanced risk analysis tools, you can often bypass the extra authentication step for transactions identified as low risk. Another strategy is effectively utilizing the SCA exemptions. Allowing small-value and recurring payments to process quickly without repeated authentication reduces unnecessary steps for frequent customers. Furthermore, focus on designing a clean and intuitive user flow for the authentication process. This might involve embedding the verification step directly within your mobile app or using simple, clear prompts for phone-based authentication methods like SMS codes. To optimize your approach, consider testing different checkout flows. Show a full SCA check to one segment of customers and a quicker, potentially exempted flow to another. Analyze the results to see what performs best. This iterative process helps you balance security requirements with a positive user experience, keeping payments safe without inconveniencing your customers.

7. What are the technical requirements and best practices?

Most businesses find it simpler and more reliable to leverage their payment provider's infrastructure to handle SCA, rather than building their own system. If you do rely on a provider, ensure their platform supports the necessary protocols. A fundamental technical requirement for online card payments is that 3D Secure 2.0 must be integrated into your payment gateway setup. This protocol is specifically designed to manage the complexities of the two-factor authentication process required by SCA. Beyond 3D Secure, maintaining secure connections is paramount. This involves using security certificates, preferably those approved under EU regulations such as the eIDAS Regulation, to encrypt data transmitted between your system, the payment gateway, and banks. Implementing strong API keys is also critical. These keys secure the connections you use to send payment data, ensuring that only authorized parties—namely, your system and the banks/payment processor—can exchange sensitive information.

Technical Best Practices

Adopting certain best practices can enhance your SCA implementation. Have fallback plans in place. If the primary authentication method fails (e.g., the customer's bank authentication page doesn't load), provide a clear retry option or redirect the customer to a safe, informative page. For mobile applications, utilize Mobile SDKs provided by your payment gateway. These SDKs can facilitate smoother in-app authentication experiences, such as allowing customers to use fingerprint or face scans if supported by their device and bank. Finally, implement comprehensive monitoring. Track every payment attempt, noting whether SCA was applied, if exemptions were used, and the outcome of the transaction. Monitor for unusual spikes in payment failures or potential fraud indicators. Always consult the integration guides provided by your specific bank or payment gateway. These guides offer detailed, step-by-step instructions and code examples tailored to their system, which are essential for correct setup and compliance.

8. What happens if you’re not compliant?

Failing to comply with PSD2 and SCA regulations carries significant risks and real costs for businesses. The most immediate consequence is declined payments. Customer banks (issuers) are mandated to block online transactions that do not meet the SCA requirements or qualify for an exemption. This directly leads to lost sales and frustrated customers. Beyond transaction failures, local regulatory authorities in EU and EEA countries have the power to levy substantial fines for breaches of PSD2 rules. These penalties can be costly and damaging to a business's finances. Furthermore, non-compliance shifts liability for fraudulent transactions back to the merchant. Without the protection offered by successful SCA, you become responsible for losses incurred due to stolen card or bank details used fraudulently. This can result in significant financial losses. Finally, news of regulatory fines or security incidents, such as a data breach resulting from inadequate security measures, can severely damage your business's reputation. This can erode customer trust and deter future business. Delaying or ignoring PSD2 SCA compliance ultimately increases your exposure to financial penalties, fraud losses, and reputational damage.

9. How to maintain compliance long-term?

Achieving PSD2 SCA compliance is not a one-time task; it requires ongoing effort to stay effective and compliant. To maintain compliance long-term, establish a regular monitoring and review process. First, create a simple dashboard or report. This report should track key metrics related to SCA, such as the number of payments that required SCA, how often exemptions were successfully applied, and the rate of authentication failures. Regularly reviewing this data provides insights into your payment flow's performance and potential issues. Second, conduct periodic reviews—ideally each quarter. During these reviews, examine your payment logs, test your checkout flows to ensure SCA is functioning correctly, and identify and fix any gaps in your implementation or processes. Third, stay informed about regulatory changes and updates. The European Banking Authority and your payment providers are key sources for this information. Subscribe to their newsletters or check their websites regularly. Finally, assign a clear owner for compliance maintenance. Designating one person or a specific team to be responsible for overseeing compliance checks, reviewing vendor updates, and implementing necessary changes ensures that nothing is overlooked and your payment system remains healthy and compliant over time.

10. What’s next after PSD2? (PSD3 & future outlook)

The European Union is already looking ahead with plans for the next iteration of payment legislation, known as PSD3. While still in development, early proposals indicate several key areas of focus. One major theme is the push towards real-time payments, aiming to make money transfers settle almost instantly across different countries within the EU. Another area is further facilitating data sharing. The goal is to make it even easier and more controlled for individuals to move their payment data to various innovative applications and services. PSD3 is also expected to introduce stronger measures to combat payment fraud, potentially giving regulators more power to enforce security requirements and crack down on fraudulent activities. The influence of PSD2 and its successors extends beyond Europe. Other regions are observing Europe's lead in modernizing payment systems and enhancing security. Notable examples include the UK’s Open Banking initiative, which enables secure data sharing between banks and third parties, and India’s UPI (Unified Payments Interface), a real-time payment system facilitating inter-bank transactions. Keeping an eye on these global trends and the developments surrounding PSD3 will help businesses proactively plan for future changes in the payment landscape and stay ahead in terms of technology and regulation.

Conclusion 

PSD2 provides the regulatory framework for online payment services in Europe. A core part of this is SCA, requiring two distinct verification factors for most payments exceeding €30. However, many small or recurring payments may be exempted from SCA, but it's crucial to be aware of the specific limits and conditions. Utilizing a payment provider's 3D Secure tool is a standard and effective way to implement the required authentication checks easily. To maintain compliance, continuously monitor your payment processes, regularly test your checkout flows, and stay updated on evolving regulations and guidance. As a practical next step, conduct a quick audit of your current checkout setup today. Verify that SCA is correctly applied to transactions that require it and that your team understands how to handle valid exemptions. Taking these steps now can help you avoid potential fines and prevent lost sales in the future.