Should an operator apply the same 3DS rules in every market?

No. In the EEA and the UK, strong customer authentication is a legal requirement and 3DS is the default way to meet it. In the US, 3DS is mostly optional, and turning it on for every transaction can raise declines in some segments. Japan now requires EMV 3-D Secure at e-commerce merchants. Rules are set per merchant and per market.

Different laws, different behaviors

In the European Economic Area and the UK, strong customer authentication is required by law for most online card payments, and 3-D Secure is the standard way to apply it, with exemptions for low value, low risk and recurring payments. In the United States there is no such requirement, and issuers and cardholders are less used to challenges, so applying 3DS everywhere raises abandonment. Japan now requires EMV 3-D Secure for e-commerce merchants, and other markets sit in between.

Rules per merchant and market

• EEA and UK: request authentication by default, use exemptions where the acquirer supports them.
• US: apply 3DS selectively, for high-risk segments or high amounts, and measure the effect on approvals.
• Elsewhere: follow issuer behavior, which reporting reveals quickly.

How to manage it

Authentication rules should live in the hosted checkout configuration, per merchant account and per market, not in merchant code. That way an operator adjusts them when a regulator, a scheme or the data says so, and the change applies to every merchant on the platform at once.