Does PSD3 change strong customer authentication?
The PSR keeps two-factor SCA but clarifies its scope, treats merchant-initiated transactions explicitly, requires methods that work without a smartphone, and widens PSP liability for fraud. Provisionally agreed in November 2025, it applies about 21 months after entry into force. The final compromise texts went to COREPER on April 23, 2026.
In detail
The PSR keeps two-factor SCA but clarifies its scope, treats merchant-initiated transactions explicitly, requires methods that work without a smartphone, and widens PSP liability for fraud. Provisionally agreed in November 2025, it applies about 21 months after entry into force. The final compromise texts went to COREPER on April 23, 2026.
What the PSR changes for SCA
The Council and the Parliament reached a provisional agreement on PSD3 and the PSR on November 27, 2025. The final compromise texts went to COREPER on April 23, 2026, and most provisions apply 21 months after entry into force, which points to 2028. On SCA, the PSR keeps the two-factor principle but clarifies when it applies, treats merchant-initiated transactions explicitly, and requires authentication methods that do not depend on a smartphone and are free of charge. Fraud liability widens: a PSP without adequate anti-fraud mechanisms, or without verification of payee, pays.
The UK goes the other way
The UK government has agreed to move parts of SCA out of the technical standards into FCA rules, towards outcome-based regulation, starting with contactless limits. A PSP operating in both markets will soon run two different rulebooks on the same 3DS stack.
More detail in our #PayDecoding episode on 3-D Secure.