PSD2 strong customer authentication (SCA) testing requirements

What PSD2 and the RTS on strong customer authentication require

Directive (EU) 2015/2366 (PSD2) Article 97(1) requires a payment service provider to apply strong customer authentication when the payer accesses a payment account online, initiates an electronic payment transaction, or carries out a remote action that may imply a risk of payment fraud. Article 97(2) adds dynamic linking for remote electronic payments: the authentication links the transaction to a specific amount and a specific payee.

The detailed rules sit in Commission Delegated Regulation (EU) 2018/389, the regulatory technical standards (RTS) on strong customer authentication (EUR-Lex, checked on 2026-09-16). The RTS applies from 14 September 2019 (Article 38(2)). The requirements that change test scope:

• Authentication code (Article 4). The code is accepted only once. A failed authentication does not reveal which element was wrong. No more than five consecutive failed attempts are allowed before a block. Online account access ends after at most 5 minutes without payer activity.
• Dynamic linking (Article 5). The payer sees the amount and the payee. The code is specific to that amount and payee, and any change to either invalidates the code.
• Elements and devices (Articles 6 to 9). A breach of one element does not compromise the others. When an element or the code runs on a multi-purpose device such as a phone, the provider uses separated secure execution environments and detects alteration of the software or device (Article 9(3)).
• Exemptions (Articles 10 to 18). The exemptions cover account information access, contactless and low-value payments, trusted beneficiaries, recurring payments, and transaction risk analysis (TRA), among others. Delegated Regulation (EU) 2022/2360 extended the SCA renewal period for account information access from 90 days to 180 days and added a mandatory exemption for access through an account information provider (Article 10a), applicable from 25 July 2023 (EBA final report EBA/RTS/2022/03, checked on 2026-09-16).
• Fraud rates and monitoring (Articles 18 to 21). TRA is allowed only while the provider's fraud rate stays at or below the Annex reference rate for the exemption threshold value: for remote card payments, 0.13% up to EUR 100, 0.06% up to EUR 250, and 0.01% up to EUR 500. Article 19 calculates the rate by value over a rolling 90-day quarter, including both SCA-authenticated and exempted payments.
• Review of security measures (Article 3). SCA measures are documented, periodically tested, evaluated, and audited. A provider that uses TRA has its methodology, model, and reported fraud rates audited at least yearly.

The financial consequence sits in PSD2 Article 74(2): when the payer's provider does not require strong customer authentication, the payer bears no financial loss unless the payer acted fraudulently. Card payments in the EEA usually apply SCA through EMV 3-D Secure; the EMV 3DS testing requirements page covers the message flow. In the UK, the FCA applies its own SCA-RTS, which added an Article 10A exemption through PS21/19 (checked on 2026-09-16). The successor EU package is tracked on the PSD3 and PSR page.