Does PSD3 replace strong customer authentication?

No. Strong customer authentication remains. The PSR adjusts it: two biometric checks can count as two factors, exemptions are tightened, and PSPs must have detailed agreements with technical providers that perform authentication for them.

What stays the same

SCA still requires two independent factors from different categories, knowledge, possession and inherence, for most electronic payments initiated by the payer. Exemptions for low-value payments, trusted beneficiaries, recurring payments and low-risk transactions continue in some form.

What changes

• More flexibility in combining factors, for example two inherence elements.
• Clearer rules on merchant-initiated transactions, which remain outside SCA once the mandate was set up with authentication.
• Agreements required with wallet providers and other technical services that carry out authentication on behalf of the PSP.
• Accessibility requirements, so that people without a smartphone or with disabilities can still authenticate.

Why it matters for checkout

The way authentication and exemptions are applied affects approval and abandonment. Changes in the rules usually mean updating 3-D Secure strategies and exemption logic.

What it means for payment operators

For you, SCA rules sit in your authentication policies per merchant. A platform where exemptions, challenge preferences and merchant-initiated flags are configurable lets you follow the PSR without rebuilding the checkout for each merchant.