PSD2 Strong Customer Authentication (SCA) – What’s happened so far?

The first big deadline for the implementation of Strong Customer Authentication (SCA) has come and gone. Most European countries were expected to enforce the new authentication standard beginning December 31, 2020 – with some markets ramping up SCA activity in the fourth quarter of 2020. Now that many months have passed, many have asked, "What happened?"

The short answer is that there was minimal disruption. In the weeks leading up to the December deadline, most large European markets (including the U.K., France, Germany and others) announced that they were softening the rollout of SCA, extending its implementation into the first half of 2021. This approach helped avoid a “cliff-edge” implementation where SCA was turned on overnight and reflected a reality that, while the payments ecosystem had prepared for SCA, it still wasn’t fully ready.

What you need to know now about PSD2 SCA compliance

Many regulators have instructed their issuers to start dialing up SCA more slowly, starting with high value transactions and steadily lowing the value thresholds throughout the first half of 2021. This approach is sensible and helps every party (merchants, issuers, acquirers, schemes and of course consumers) acclimate to the change more gradually. It does, however, create some additional complexity:

1. As you’ll see in the graphic below, SCA implementation road maps have diverged across Europe. This makes managing SCA harder, because there are more dates to watch and more complex strategies to implement. The dates also continue to move and be reinterpreted, so keeping in close contact with your acquirer is key.
2. Some (often smaller) European markets have not given clear, public guidance on new SCA implementation dates. They are not actively enforcing the new standard, and next steps remain uncertain.

What have we seen with PSD2 SCA?

While SCA has not caused significant disruption, there have been some noticeable changes already:

• Payment authorization rates on average are up for 3DS2 compared with 3DS1. The rate is 1% better on 2.1 and 4% on 2.2 in June 2021.
• 3DS2 rates continue to increase. Thirty percent of transactions through Worldpay’s 3DS Flex solution are now 3DS2 rather than 3DS1.
• Soft declines are steadily increasing, especially in certain markets such as the Netherlands and Hungary. Soft declines are the main indicator that an issuer is enforcing SCA. An issuer will send a soft decline if it receives an unauthenticated payment transaction without an exemption flag, or with an exemption flag that it does not wish to honor. In the Netherlands, soft declines now comprise over 60% of all declines, and this is climbing.

With each passing week of 2021 we have seen more SCA-related activity, and we expect this to continue as more markets and issuers increase enforcement.

The good news is that 3DS2 performance has also improved substantially in the last few months. 3DS2 still varies a lot by market and has struggled more in countries like Spain and Italy. However, in places such as the U.K. and Ireland, 3DS2 consistently outperforms 3DS1, with higher payment authentication success rates – meaning challenge rates are lower and the experience was better for the consumer – and high payment authorization rates.

What should merchants do to implement Strong Customer Authentication?

The key thing is to remain alert and keep talking to your acquirer. If you are able to enact a payment authentication strategy that is bespoke by market, then we recommend that you do so. A more blanket approach can work too, and Worldpay has tools such as 3DS Flex which can help optimize between 3DS1 and 3DS2 on your behalf. Wherever possible, use 3DS2 over 3DS1.

Recognizing, understanding and responding to soft declines is critical. If you see a spike in this decline type for a given market or from a given issuer, it means that it has started to enforce SCA. You need to activate authentication for that traffic quickly in order to keep transactions flowing successfully.

Finally, as SCA continues to grow, SCA exemptions will become ever more important in the push to keep your payments friction-free. Dozens of Worldpay customers are already sending transactions with exemption flags attached. In April 2021, Worldpay processed more than five million exemptions through our Exemption Engine, and this is only the beginning. Performance has exceeded expectations, with some of our Tier 1 customers having 98% of their exemption requests honored by issuers – a very encouraging sign.

For more information on implementing SCA or 3D Secure, please get in touch with your Worldpay account team.