Does strong customer authentication apply to AI agents in Europe?
Yes, to the human behind the agent. PSD2 requires strong customer authentication of the payer, so Visa’s European pilots authenticated agent transactions with payment passkeys bound to the user. Exemptions and merchant-initiated logic, and the PSD3 and PSR rules that follow, will shape how unattended agent purchases are approved.
In detail
Yes, to the human behind the agent. PSD2 requires strong customer authentication of the payer, so Visa’s European pilots authenticated agent transactions with payment passkeys bound to the user. Exemptions and merchant-initiated logic, and the PSD3 and PSR rules that follow, will shape how unattended agent purchases are approved.
SCA applies to the human
In Europe, strong customer authentication applies to the human, not the agent, which makes a passkey-bound mandate the only compliant path for now. When the merchant’s PSP sends the authorization with the token and the agent identifier, strong customer authentication still applies. In July 2026, 31 European issuers completed live agent-executed transactions, authenticated with Visa Payment Passkeys to meet strong customer authentication.
What comes next
The rules are being rewritten. On SCA, the PSR keeps the two-factor principle but clarifies when it applies, treats merchant-initiated transactions explicitly, and requires authentication methods that do not depend on a smartphone and are free of charge. Most provisions apply 21 months after entry into force, which points to 2028.
More detail in our #PayDecoding episode on Agentic commerce.