What Strong Customer Authentication Is
Strong Customer Authentication (SCA) is a requirement under the EU's revised Payment Services Directive (PSD2) and its Regulatory Technical Standards (RTS). It applies to most electronic payments initiated by a payer within the European Economic Area, including card payments and account-to-account transfers. The goal is to confirm that the person authorizing a payment is really the account holder, reducing fraud on remote and card-not-present transactions.
The Two-Factor Rule
SCA requires authentication using at least two independent elements from three categories: something the customer knows (a PIN or password), something the customer has (a phone, card, or hardware token), and something the customer is (a fingerprint or face scan). A payment that uses only one of these factors, such as a card number and expiry date alone, does not meet the SCA bar. In practice, SCA is usually carried out through 3-D Secure flows, banking apps, or one-time passcodes tied to a registered device.
Exemptions Merchants Can Ask For
PSD2's technical standards also set out exemptions that let a payment skip the extra authentication step when the risk is judged low enough. A merchant does not grant these exemptions itself; the request is made to the card issuer or payment service provider, which decides whether to apply it. The main categories are:
- Low-value payments: remote transactions below a set amount, with limits on how many low-value payments or how much cumulative spend can go unchecked before SCA is required again.
- Transaction Risk Analysis (TRA): acquirers and issuers with fraud rates below the reference levels set in the RTS can apply an exemption up to certain transaction amounts, assessed in real time per payment.
- Recurring transactions: SCA is required on the first payment in a series of fixed-amount recurring charges; later payments in the same series can be exempted.
- Trusted beneficiaries (merchant whitelisting): once a customer adds a merchant to their bank's trusted list through an SCA step, later payments to that merchant can bypass further authentication.
- Corporate payments: transactions made through dedicated corporate payment processes or protocols not available to consumers can qualify for an exemption.
Any exemption can still be overridden. The issuer can always ask for full authentication if its own risk checks flag the payment, so requesting an exemption is not a guarantee that a transaction will go through without a challenge.
Where This Fits Into the Checkout Flow
Because the issuer makes the final call on exemptions, the way a payment request is built matters. Omwio's hosted checkout passes the transaction data an issuer or provider needs to evaluate an exemption, and its provider routing lets a transaction be directed to a provider that supports the relevant SCA and exemption flows for that payment method and corridor. The merchant panel gives merchants visibility into how individual transactions were authenticated, while the manager panel lets payment operations teams review authentication outcomes across merchants and providers.
What Merchants Should Keep in Mind
SCA and its exemptions sit inside a technical and regulatory framework set by PSD2 and the RTS, not inside any single platform. Before relying on an exemption for a given flow, merchants should check with their acquirer or PSP which exemptions it supports and under what conditions, since issuers and schemes apply the same rules with some discretion. This article explains the mechanism; it is not a guarantee about how any specific transaction, issuer, or provider will behave.
