Strong Customer Authentication

Strong Customer Authentication (SCA) is a new set of rules that will change how you confirm your identity when making purchases online. The implementation of SCA requires merchants and Payment Service Providers (PSPs) to work together with technology suppliers, card schemes and many others to deliver SCA in a way which works well for customers.

The Financial Conduct Authority (FCA) announced and agreed to a managed rollout for SCA with UK Finance to give the payments and e-commerce industry extra time to implement SCA.

To facilitate ongoing commitment to the managed rollout and for the best customer and industry outcomes, UK Finance set up a central Programme Management Office. In the managed rollout, we propose a number of measures aimed at implementing SCA at pace, but also in a way that is structured to help coordinate as well as help answer the remaining tricky questions the industry still has. This page will be regularly updated with information for the industry, merchants and consumers.

In light of the impact of Covid-19 on key stakeholders, and to minimise the impact on both consumers and e-merchants, the FCA has updated their Strong Customer Authentication page to give an additional six months to implement strong customer authentication (SCA) for e-commerce, to a revised date of 14 September 2021. This can be found here.

The FCA statement clearly expects momentum to be maintained but recognises that additional time may be needed due to the impacts of Covid-19.

The UK Finance SCA Programme Team have developed a revised implementation roadmap which can be found here.

The focus of the rollout is a technology called 3DSecure which will help to facilitate the authentication of the majority of card-based transactions. However, there are other SCA compliant solutions available in the market, such as those provided by Payment Initiation Services (e.g. through Open Banking), Apple Pay or Google Pay as well as other potential solutions.

It is important to remember that some documents previously published on this site will still refer to the end of the managed rollout as March 2021, please note this is now 14 September 2021.

INFORMATION FOR STAKEHOLDERS