Strong Customer Authentication - Frequently Asked Questions

1. Where can I find the SCA implementation plan?

You can find the SCA UK Implementation and ramp up plan here.

2. Is the implementation plan only relevant to the UK?

This is UK only, the UK Finance SCA Programme team has developed the revised detailed implementation plan and the high-level plan. UK Finance urges all stakeholders active in e-commerce to take note of the various deadlines and the introduction of a gradual SCA ramp up from 1 February 2021 with all journeys starting on 1 June 2021 which will require all parties to be ready by the end of May 2021. The SCA UK Implementation and ramp up plan can be found here.

3. How does the implementation plan fit with the rest of Europe's plan?

There will be differing requirements due to the SCA enforcement deadlines of the EU (31 December 2020) and UK (14 September 2021) being different. Please refer to the full UK Finance SCA UK implementation and ramp up plan here. For further details or visit the EBA website.

4. Do European transactions still require SCA by the end of this year?

Yes – for more information see UK Finance SCA Guidance document section 1.2 here. UK Finance will further clarify in our second version of the guidance which will be published in due course.

5. Is there a summary of where the FCA has chosen to adopt a different position to the EBA?

UK Finance is working with the FCA on an ongoing basis to ensure clarity is provided to the UK market. If there are specific areas of concern, please contact the UK Finance PMO by email scapmo@ukfinance.org.uk.

6. What are the enforcement and implementation dates?

The original enforcement date was March 2021. The FCA has allowed an extension to 14 September 2021.

However, parties engaged on e-commerce card-based payments need to enable all SCA flows in readiness for the full UK SCA Ramp up due to start on 1 June 2021. The UK Finance SCA UK Implementation and ramp up plan can be found here.

7. When would we expect e-merchants to be compliant?

The UK Finance SCA Programme team has developed an industry implementation plan. UK Finance urges all stakeholders active in e-commerce, including e-merchants, to take note of the various deadlines and the introduction of a gradual SCA ramp up which will require all parties to be ready by 1 June 2021 in order to ensure the customer impact is minimal. The full SCA UK Implementation and ramp up plan can be found here.

8. Do all e-commerce transactions have to be migrated to 3DS by 1 June 2021?

No, this is not the case – see the full SCA UK Implementation and ramp up plan here.

The expectation is that by 1 June 2021 all ecommerce transactions should comply with SCA. This means ecommerce transactions need to be sent via 3DS or directly to authorisations with the correct flag (exemption or out of scope), but not that all in scope transactions will be subject to full SCA.

9. When does testing have to be completed by?

The EU enforcement deadline is generally 31 December 2020, and as such testing may need to be in place before the EU deadline comes into force.

1. What does SCA apply to?

Unless a transaction is out of scope or an exemption applies, providers must apply SCA in specified scenarios, i.e where a customer:

a) accesses their payment account online;
b) initiates an electronic payment transaction; or
c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.

All electronic payments initiated by the payer are covered by the scope of the SCA requirement, unless one of a limited number of exemptions applies. This scope is broad as it covers both remote and face-to-face electronic payments initiated by the payer and extends to all channels or devices through which initiation occurs, so including payments made through a browser, mobile, in-app, devices using the Internet of Things (IoT), as well as payments made via a terminal where the data extracted in relation to the payment is all electronic. For full details of scope, see UK Finance SCA Guidance document section 2 here.

2. Where can I find out more about what is in the scope of SCA?

This can be found in section 2 of the UK Finance SCA Guidance document which can be found here.

3. Are MITS inlcuding no shows in scope?

Payee or card-based merchant-initiated transactions (MITs) are out of scope of the requirement for SCA and do not need to rely on an exemption. They include direct debits or card transactions, where the transaction is initiated by the payee only.

However, if the authority for the payments is given electronically (such as with online subscription services), then the action of granting the authority will be caught by the SCA requirement under the third 'other action' requirement of SCA.

In certain use cases, the payment authority will have been given on paper and so will be out of scope for that reason.

For more information refer to the UK Finance SCA Guidance document section 2 which can be found here.

4. Are one leg out transactions ins cope of SCA?

For guidance on one leg out transactions refer to the UK Finance SCA Guidance document section 2. which can be found here.

5. Are direct debits in scope of SCA?

Direct debits of fixed or variable amount that are initiated by the payee only without any direct intervention from the payer are out of scope of SCA, the mandate when created through a specific e-mandate scheme requires SCA. For further information refer to the UK Finance SCA Guidance document section 2 which can be found here.

6. What are the SCA implications of face to face (F2F) transactions?

For more information refer to the UK Finance SCA Guidance document section 2 which can be found here.

1. Are there any other SCA-compliant options apart from 3DS?

In the context of card-based payments SCA-compliant transactions can be sent directly via authorisations (where relevant) as long as they are flagged correctly (with an exemption or as out of scope).

The focus of the rollout is a technology called 3DSecure which will help to facilitate the authentication of the majority of card-based transactions. However, there are other SCA compliant solutions available in the market, such as those provided by Payment Initiation Services (e.g. through Open Banking), Apple Pay or Google Pay as well as other potential solutions.

2. What are the differences between 3DS versions 1 and 2?

UK Finance produced a webinar which can be viewed on demand and discusses 3DS in greater detail and the differences between the versions of 3DS. It can be found here.

3. Is 3DS mandatory?

No – 3DS is not mandatory. 3DS enables the issuer authentication and usage of exemptions for ecommerce transactions, however ecommerce transactions can still be sent directly via authorisations in a complaint manner as long as they are flagged correctly.

There are other solutions available, the focus of the rollout is a technology called 3DSecure which will help to facilitate the authentication of the majority of card-based transactions. However, there are other SCA compliant solutions available in the market, such as those provided by Payment Initiation Services (e.g. through Open Banking), Apple Pay or Google Pay as well as other potential solutions.

4. At what point should issuers decline/soft decline an authorisation?

Issuers will only decline/soft decline non SCA-compliant transactions. SCA compliance can be achieved via 3DS or by sending transactions directly to authorisations with the correct flag.

From 1 February 2021 issuers should begin a gradual activation of various transactions and SCA step ups commence.

Commencing 1 June 2021 until 14 September 2021 there will be a full ramp up to SCA, meaning all parties need to be ready to comply with every aspect of SCA by 31 May 2021.

From June 2021 transactions will be randomly checked by issuers on an increasing basis to determine whether they are SCA compliant and may be soft declined if they are not.

From 14 September 2021 – full SCA enforcement will be in place.

5. Do UK Finance endorse any alternative approach to OTP?

UK Finance cannot mandate any particular solution and it is the decision of each Payment Service Provider (PSP) as an issuer to define their authentication solutions and to satisfy their own security requirements and risk appetites. The majority of issuers will be leveraging their mobile apps in order to authenticate most customers but need to provide alternatives that work for customers.

6. Which 2nd factor category does OTP sent through a mobile device fall into?

For more information refer to the UK Finance SCA Guidance document sections 4 and 5 which can be found here.

7. To what extent have behavioural biometrics been piloted?

Behavioural biometrics have been used for risk profiling historically. However behavioural biometrics as an authentication factor is relatively new, and issuers are encouraged to engage the different suppliers in the market as part of their risk assessment. Behavioural biometrics are already being utilised in online banking as part of risk-based authentication strategies.

8. How will behaviroual works for a new cardholder?

Data maturity is one of the key challenges for any behavioural based approach, and any approach needs to be consistent with the principles proposed by UK Finance and the regulator. The number of transactions and information required to build an acceptable profile will depend very much on the issuer’s solution and risk appetite.

The FCA has acknowledged that behavioural profiles will take time to be established and results will be weaker in the first instance.

However, the recommended industry position is the use of behavioural biometrics as the second factor in authentication, with no fall back (for scenarios where the use of behavioural biometrics is not feasible). The Financial Conduct Authority supports the development of strategic solutions that are good for customers and businesses and has welcomed the industry’s suggestion to focus on behavioural biometrics as second factor to an OTP solution

Based on this June 2019 EBA Opinion the minimum viable proposition (MVP) recommended is for issuers to leverage 3DS flows and integrate their chosen behavioural biometric solution via the ACS provider (if applicable).

Issuers, can, however, work with their ACS and behavioural biometric suppliers to enhance current 3DS flows so that extra customer data (e.g. email address or cardholder name) is captured providing additional data for enhanced behavioural biometric profiling.

Issuers will need to ensure that their final implementation solution complies with all the relevant requirements.

Ensure that data collected and processed as part of their chosen solution meets the minimum standards set by the EBA and in compliance with the FCA’s requirements set out in its Approach Document.

UK Finance has produced a second factor guidance document with more details, this can be found here.

9. What is a typical number of transactions needed to hae enough data?

UK Finance encourages issuers to review, with the relevant vendors, the different scenarios required to enable behavioural biometrics as it will depend very much on the supplier’s solution and issuer’s risk appetite. There are a number of free pre-recorded vendor showcase webinars available to view which can be found here.

UK Finance cannot endorse any solution or class of solutions. UK Finance and the FCA support strategic solutions for the industry and have done extensive work with the industry on the risks and benefits of particular solutions. It is the responsibility of PSPs to find their own solutions depending on their own circumstances and risk/security appetite.

10 How can biometric data be captured in merchant apps and consoles etc?

The FCA has acknowledged that this will be a gap for day 1 – for more information see the Strong Customer Authentication: Considerations for what can be used as a second factor alongside One Time Passcode (OTP) here.

11. Why is behavioural biometrics rather than biometrics beng recommeded?

The European Banking Authority (EBA’s) Opinion in June 2019 clarified that card details could not be considered a valid factor. This position has an impact on card issuers using an OTP solution, sent by text or via landline when the solution relies upon possession as one factor (the OTP sent to the customer’s pre-registered mobile device or landline proves that the customer is in possession of the mobile device or landline).

As a result, card issuers will require a second factor (either inherence or knowledge) over and above the OTP solution to comply with SCA.

With the introduction of SCA, there is a need for participants within the payments ecosystem to be cognisant of the wide variety of consumers and the ways in which they access goods and services. While the move to digital continues to make advancements, issuers are asked to consider alternative authentication options available to consumers who have poor mobile reception, making it difficult for them to receive an SMS OTP in the context of authentication. Equally there will be some consumers who choose not to have a mobile phone or specifically those without smartphones where other approaches such as authentication via a mobile app may inhibit a consumer from performing an e-commerce transaction. It must be acknowledged that not all customers are able or chose to use biometric solutions.

However, issuers have the flexibility to define the best authentication solutions.

1. What is Dynamic Linking?

The RTS require that the two or more authentication elements used result in the generation of a secure authentication code. The recitals to the RTS explain that the authentication code "should be based on solutions such as generating and validating one-time passwords, digital signatures or other cryptographically underpinned validity assertions using keys or cryptographic material stored in the authentication elements, as long as the security requirements are fulfilled".

In addition, for electronic remote payment transactions (e.g. payments on the internet), the authentication code generated must be specific to the amount of the payment transaction and the payee. This is known as ‘dynamic linking’. For more information refer to the UK Finance SCA Guidance document section 8 which can be found here.

2. When will an official position on dynamic linking be announced?

The FCA is due to publish its approach document in Q1 2021.

3. Has an agreement been reached on the tolerance levels in dynamic linking?

This issue will form part of the wider consultation of the FCA Approach Document which is due in Q1 2021.

4. Are 3DS v1 transactions SCA compliant?

Visa 3DS1 transactions will be compliant with dynamic linking with the implementation of CAVV Us3 V7. The Mastercard position on Mastercard 3DS1 transactions was confirmed in its Authentication Guide published in November 2020.

5. Can the authentication code be used more than once, as per schemes?

Visa 3DS1 transactions will be compliant with dynamic linking with the implementation of CAVV Us3 V7. The Mastercard position on Mastercard 3DS1 transactions was confirmed in its Authentication Guide published in November 2020.

6. What circumstances would need to be in place for the amount to be different?

There are several use cases where the final amount is not known at the time of authentication. The most common use case is online grocery shopping where an item is switched out for a different brand/weight at the point of authorisation, which may be several hours after authentication by the customer.

7. Will the authentication code be invalid if the amount/ name changes?

In respect of a name change, it has been agreed at UK industry level that the EBA Q&A 2018_4556 means that no change to the status quo is needed; that the authentication code (Cryptogram) is specific to the payee and cannot be intercepted or broken during the ‘life’ of the transaction.

In respect of the amount change, this differs depending on whether the amount decreases or increases. In respect of amount decreases current FCA guidance confirms that this will not invalidate the authentication code.

The question in respect of amount increases will be confirmed in the FCA's consultation to its Approach paper. The UK industry view is that an amount increase does not invalidate the authentication code. We have shared this view with the FCA. The FCA will give its direction in the consultation to its Approach document which will be published in the next few months.

8. Where can I find more information on cryptograms?

This information can be found in the scheme documentation. This level of detail is of a technical nature and as such will not form part of any UK Finance guidance. Please refer to the schemes for further information.

9. Is there risk of further development following the FCA consultation?

UK Finance guidance on Dynamic Linking was issued in October and updated in December and includes details on what each party (e.g. merchant, acquirer, issuer) must do for readiness and/or compliance with Article 5. FCA confirmation will come in the consultation to its Approach document which is due in Q1 2021. The UK Finance SCA Guidance document can be found here.

However, this only covers the UK approach; there may need to be significant changes for a party which operates across UK-EEA e.g. UK merchants selling into EEA or card issuers with a UK book and EEA book. This is because a competent authority in an EU Member State may have a different view of enforcement of dynamic linking to the FCA.

10. How does dynamic linking work when the e-merchants name differs?

We understand that EBA accepts that the merchant name can differ in authentication and authorisation. Hence issuers may accept transactions where the merchant name differs. There may also be instances (for example in the hotel and travel sector) where multiple merchants are involved (i.e. one at authentication, two or more at authorisation (one for each involved merchant). For more information in respect of these scenarios, refer to the EBA Q&A 2018_4556, scheme documentation for travel & hospitality and UK Finance SCA guidance here.

11. Who validates that the e-merchant is the same?

UK Finance recommends the e-merchant is not checked as otherwise around 30 per cent would fail. In our view EBA endorsed this approach.

12. How will DL work for customers using apps?

Dynamic linking is required whenever SCA is performed for remote transactions. So if the customer is required to complete SCA during these transactions dynamic linking is also required. For further information refer to the UK Finance SCA Guidance document here.

13. Do the schemes have common rules for identity linking?

There are no common rules for identity linking; please refer to individual scheme mandates for linking identity.

14. Has the FCA accepted that MIM attacks cannot apply to card use cases?

UK Finance has explained the process to the FCA (including Man in the Middle attacks - MIM). Its direction will be confirmed in the consultation to its Approach paper in Q1 2021.

15. When is the consultation for upwards tolerance with the EBA due to be completed?

There is no ongoing UK Finance or EBF discussion with the EBA on upwards tolerance; the EBA's Q&A 2020_5133 was its final response.

16. Is transaction cascading possible?

Yes, this is possible. For more information on dynamic linking please refer to the UK Finance SCA Guidance document section 8 here.

17. When will dynamic linking be enforced?

Dynamic linking is required whenever SCA is undertaken on remote payment transaction. If a customer is stepped up in the low-risk flows, the dynamic linking requirements will also kick in at that point, but this will not be enforced until September 2021. For further information refer to the SCA Implementation and ramp up plan here.

18. Can MITs be used to avoid SCA (and Dynamic Linking)?

MIT is seen as an acceptable alternative to comparing the amounts and to building a tolerance here.

19. How will third-party authentication work in a T&H scenario?

Hotels often use third parties to authenticate and the payment is processed separately which will lead to authentication on one merchant ID and payment taken on another. This works because the unique authentication data (AAV, DS Transaction ID) can be re-used by multiple authorisations and different acquirers here.

20. Does 3DS enablement affect if a transaction is SCA compliant?

The compliance of a transaction against SCA requirements will be down to the treatment of that transaction, not simply that a party is 3DS2 enabled here.

21. Are pre-approved transactions in scope of SCA e.g petrol at pump?

Card present transactions (e.g Chip & PIN) do not require dynamic linking. For further information of the scope of SCA refer to the UK Finance Guidance document section 2 here.

22. What is meant by "reasonable expectations" in relation to tolerance?

There is an established payment scheme practice of allowing a price rise tolerance and this is usually explained as being within the customer's 'reasonable expectations'. In respect of what merchants, acquirers and issuers must do to establish and apply 'reasonable expectations' for dynamic linking, please see Chapter 8 of the UK Finance SCA Guidance document here.

23. Does Dynamic Linking have a common data element?

No, each scheme has different data elements that are relevant for dynamic linking. Please refer to the scheme manuals for further information here.

1. What communications will be delivered to the industry?

The UK Finance SCA Programme has two Engagement Task Forces teams to drive awareness and readiness across the industry.

UK Finance has been delivering a series of free webinars and issuing multiple SCA guidance documents to ensure industry awareness. These webinars can be viewed on demand using this link. To access a variety of SCA Guidance documents, please visit our SCA landing page here.

2. Where can I find the UK Finance SCA Guidance document?

The SCA communication can be found here and UK Finance hosted a free webinar which can be viewed on demand here.

3. Where can I find the SCA Implementation roadmap?

This can be found here.

4. Where can I find more information on finding a second factor alongside OTP?

The SCA communication can be found here and UK Finance hosted a free webinar which can be viewed on demand here.

5. Where can I find information on improving customer outcomes on 3DSecure?

The SCA communication on improving outcomes from 3DSecure – Data Consistency, can be found here and the free webinar which can be viewed on demand here.

6. Where can I find out about the SCA testing approach and guidance?

The SCA communication can be found here.

7. Where can I find more information on vendor solutions?

UK Finance hosted a number of vendor showcase webinars which can be found here.

8. Where can I find more information on Dynamic Linking?

UK Finance hosted a free webinar discussing Dynamic Linking which can be viewed on demand here.

9. Where can I find more information on Operational Resilience?

UK Finance hosted a free webinar discussing Operational Resilience which can be viewed on demand here.

10. Where can I find out about the impact on the Travel & Hospitality sector?

UK Finance hosted a free webinar discussing the impact on the impact on the travel and hospitality sector which can be viewed on demand here.

11. How can contact the SCA Programme Management Office?

Email details can be found here.

UK Finance search

Search form