- 01PSD2 SCA requires two of {knowledge, possession, inherence}. For remote payments, the authentication code must be dynamically linked to the specific amount and payee — and any change invalidates it.
- 02Dynamic linking is the most-missed requirement. The SCA challenge UI must display amount and payee for confirmation; the back end must verify the binding. Plain OTP without amount/payee binding is a finding.
- 03Exemptions that ship value: low-value (<€30 with cumulative thresholds), trusted beneficiaries (90-day re-auth), Transaction Risk Analysis (issuer fraud rate gated), recurring (after initial SCA), corporate-process payments.
- 04Inherence done right means platform biometrics with attested keys (Apple Face ID, Android BiometricPrompt). Off-the-shelf face matching without liveness fails the RTS accuracy and anti-spoofing requirements.
PSD2 Strong Customer Authentication (SCA), defined by the Regulatory Technical Standards on SCA, requires that electronic payments be authenticated using two or more of knowledge, possession, and inherence — and for remote transactions, dynamically linked to the amount and payee.
Dynamic linking: the often-missed requirement
Dynamic linking means the authentication code presented to the customer is unique to the specific transaction amount and payee, and any change to either invalidates the code. This is not just OTP — it requires the SCA challenge to display the amount and payee for confirmation, and the back-end to verify the binding.
Exemptions that ship value
- 01Low-value transactions (under €30 with cumulative thresholds)
- 02Trusted beneficiaries (whitelists with re-authentication every 90 days)
- 03Transaction Risk Analysis (TRA) for issuers under specific fraud rate thresholds
- 04Recurring transactions (after initial SCA, subsequent payments exempt)
- 05Corporate payments via dedicated corporate payment processes
Inherence done right
Inherence factors — biometrics — must be implemented to specific accuracy thresholds and with anti-spoofing. Off-the-shelf face matching without liveness is a finding waiting to happen. Use platform-provided biometrics (Apple Face ID, Android BiometricPrompt) with attested key material as the path of least regulatory friction.