Regulatory timescales changed for Strong Customer Authentication (SCA)

Global Payments have provided an update on Strong Customer Authentication, and as the payments industry continues to prepare within the current climate, the regulatory timescales have now changed.


The current SCA enforcement deadlines are:

• 14 September 2021 for cards issued in the UK
• 31 December 2020 for cards issued in the European Economic Area

In the UK, the date has been moved from March 2021, giving an additional six months to achieve compliance, however the European date will remain unchanged.

This additional time for UK issued cards should be used to improve implementation, not to delay it.

Both UK and European Issuers will begin to implement their requirements for cardholders to authenticate themselves earlier in 2021, so earlier adoption is essential, to avoid an increased level of declines.

 

3DS 2 Implementation

Over the next 18 months, there are some milestones that you'll need to factor into your 3DS 2 implementation:

• ​​​​​​1 July 2020: Mastercard will require merchants operating in Europe to evidence at least one full 3DS V.2 transaction by this date.
• 1 January 2021: Mastercard will increase its authentication fees for 3DS V.1 from this date. This increased fee will not apply to 3DS V.2, so we encourage you to move your secure transactions to 3DS V.2 before this date, where possible.
• October 2021: Visa will remove liability protection from 3DS V.1 in Europe after this date, meaning 3DS V.2 will be the only version providing liability protection.

In addition to implementing 3DS V.2, it's critical you review your current acceptance and validate that you have developed the ability to process stored card transactions and that you understand the new, soft decline authorisation response.

• Merchant Initiated/Credential on file: Merchant initiated and credential on file (including recurring transactions) benefit from an exemption to SCA but failure to correctly process these transactions could mean the Issuer doesn't recognise the transaction as exempt. This could lead to the Issuer requesting a full 3D Secure authentication, meaning you will be unable to complete the transaction. For details of the Global Payments credential on file guidance, please click here.
• Soft declines: Issuers are already increasing their use of the soft decline response code. This decline code is used to indicate that the Issuer wants to fully authenticate a transaction, and the instruction is for a merchant to 'step up' the payment to 3DS. Issuers will increase their use of soft declines as we near the implementation dates for SCA, but this response is being used now. You must be able to recognise a soft decline response and be ready to reassure your customers there's no problem with their card or their account, that it's just an extra security check requested by their Card Issuer, or you risk losing these transactions.

If you're using Global Payyments gateways, they have completed the development of these requirements, but if you use a third party gateway, you'll need to contact them to understand its roll out plans, so your business isn't adversely affected by these changes.

Visit the Global Payments website for more information on Strong Customer Authentication. 

Useful links

• My ActSmart
• Services
• Join now

If you have any other queries please contact us.