Does strong customer authentication still apply when an AI agent pays in Europe?

Yes. PSD2 strong customer authentication still applies per payment, so agent flows in Europe rely on the existing exemptions, such as low-value payments within cumulative limits or payees the consumer has added to a trusted list. The card network frameworks for agent identity and proof of intent build on 3-D Secure and delegated authentication rather than replacing them.

The law did not change

PSD2 requires strong customer authentication for electronic payments initiated by the payer, with exemptions for low-value payments, trusted beneficiaries, recurring payments and transaction risk analysis. An AI agent paying on a consumer's behalf does not create a new exemption. Each payment is either authenticated, exempted under an existing rule, or treated as merchant-initiated with a prior mandate.

How agent flows fit today

• Low-value exemption: small purchases within cumulative limits, which suits many agent tasks.
• Trusted beneficiaries: merchants the consumer has whitelisted with the issuer.
• Merchant-initiated transactions: the consumer authenticates once to set up the agent, later payments reference that mandate.

Where the schemes are heading

Visa and Mastercard frameworks for agentic commerce add agent identity and proof of intent, built on 3-D Secure data and delegated authentication rather than replacing them. For an operator, the practical point is to store the authentication outcome, the exemption used and the agent identifiers on each transaction, so a contested purchase can be defended under the rules that actually applied.