Sign in

PSD2 SCA

PSD2 and the Regulatory Technical Standards on Strong Customer Authentication — European Parliament / European Banking Authority

Also known as: PSD2, SCA, Strong Customer Authentication, Directive (EU) 2015/2366, RTS on SCA

Official site Official change log Subscribe to PSD2 SCA (RSS)

Current version
PSD2 as amended by Regulation (EU) 2024/886
Published 13 March 2024. source
Status
In force
Next deadline
in 35 days
Indicative European Parliament plenary date for PSD3 and the Payment Services Regulation - a forecast, not a fixed date source
Who must comply
Payment service providers in the EU, such as banks, payment and e-money institutions, when a payer accesses a payment account online, initiates an electronic payment or acts remotely in a way that may imply fraud risk. source
How it is assessed
Security measures are documented, tested and audited by independent auditors; providers using the risk-analysis exemption need that audit at least yearly. source
Authority
PSD2 was adopted by the European Parliament and the Council; the Commission adopted the SCA standards drafted by the EBA. National competent authorities supervise payment service providers. source source
Enforced by
National competent authorities enforce under each Member State's PSD2 law, and PSD2's liability rules shift fraud losses to the provider that skips SCA. source
Last change

Strong customer authentication and secure communication requirements for payment services. Tracked as one subject across two acts, because the security obligations live in the delegated regulation rather than in the directive itself.

Recent changes

Nothing changed in the last 90 days. Sign in to read further back.

Key dates

Add these dates to your calendar
  1. in 35 days Indicative European Parliament plenary date for PSD3 and the Payment Services Regulation - a forecast, not a fixed date
  2. European Parliament committee approves the PSD3 and Payment Services Regulation texts agreed with the Council
  3. The 180-day account-access exemption (Delegated Regulation (EU) 2022/2360) applies
  4. Commission proposes PSD3 and the Payment Services Regulation
  5. EBA deadline for completing migration to SCA for e-commerce card-based payments
Show 2 earlier dates
  1. The RTS on strong customer authentication apply
  2. PSD2 transposition deadline and date of application

Amendments

  1. PSD2 as amended by Regulation (EU) 2024/886 AmendmentCurrent text

    The Instant Payments Regulation amends PSD2 Articles 10 and 35 and adds Article 35a; the SCA provisions are unchanged. source

  2. Payment Services Regulation proposal, COM(2023) 367 Draft

    Commission proposal for a Payment Services Regulation that would carry the SCA rules (its Article 85), while the PSD3 directive proposal COM(2023) 366 repeals PSD2. source

    More
    • The European Parliament committee approved the text agreed with the Council on 5 May 2026; the indicative plenary date is 14 December 2026. Not yet adopted.
  3. PSD2 as amended by Directive (EU) 2022/2556 Amendment

    DORA's companion directive amends PSD2 (Articles 3, 5, 19, 95, 96 and 98) to align security and incident rules with DORA. source

  4. RTS amended by Delegated Regulation (EU) 2022/2360 Amendment

    Changes the exemption for account access: SCA is required at least every 180 days instead of 90, and a new Article 10a covers access through account information service providers. source

    More
    • It applies from 25 July 2023.
  5. PSD2 corrected (April 2018) Errata

    Corrigendum to PSD2: recital 47 refers to FATF Recommendation 14 instead of Special Recommendation VI, and cross-references in Articles 5, 52, 61, 62, 76, 89, 92, 99, 102 and 107 are corrected. source

Show 2 older amendments
  1. Delegated Regulation (EU) 2018/389 (RTS on SCA) Major version

    Regulatory technical standards for strong customer authentication and common and secure open standards of communication, published in the Official Journal on 13 March 2018. source

    More
    • It applies from 14 September 2019.
  2. Directive (EU) 2015/2366 (PSD2) Major version

    The revised Payment Services Directive, published in the Official Journal on 23 December 2015; Articles 97 and 98 set the SCA duty and the mandate for the RTS. source

    More
    • Member States had to apply it from 13 January 2018.

Who it applies to

SCA binds payment service providers whenever a payer accesses an account online, pays electronically or acts remotely with fraud risk.

When SCA applies
The payer accesses its payment account online, initiates an electronic payment transaction, or carries out any remote action that may imply a risk of payment fraud or other abuses (PSD2 Article 97(1)). source
What SCA is
Authentication with two or more independent elements from knowledge, possession and inherence (PSD2 Article 4(30)). source
Contactless exemption
Up to EUR 50 per transaction, until EUR 150 cumulative or five consecutive contactless payments since the last SCA (RTS Article 11). source
Low-value remote payments
Up to EUR 30 per transaction, until EUR 100 cumulative or five consecutive remote payments since the last SCA (RTS Article 16). source
Transaction risk analysis
Remote payments the provider assesses as low risk may skip SCA if its fraud rate stays within the reference rates and the amount within the thresholds of the Annex (RTS Article 18). source

How compliance is assessed

Security measures are documented, tested and audited by independent auditors; providers using the risk-analysis exemption need that audit at least yearly.

Security audit
Measures are documented, periodically tested, evaluated and audited by operationally independent auditors with IT security and payments expertise, at intervals set by the provider's audit framework (RTS Article 3(1)-(2)). source
Risk-analysis exemption
Providers using the Article 18 exemption have the methodology, model and reported fraud rates audited at least yearly (RTS Article 3(2)). source
Audit report
The report evaluates compliance with the RTS and is available to competent authorities on request (RTS Article 3(3)). source

Enforcement and penalties

National competent authorities enforce under each Member State's PSD2 law, and PSD2's liability rules shift fraud losses to the provider that skips SCA.

Set by each Member State

PSD2 sets no fine amounts; Member States lay down effective, proportionate and dissuasive penalties, and competent authorities may disclose imposed penalties to the public (PSD2 Article 103). source

Liability
Where the payer's provider does not require SCA, the payer bears no financial loss unless it acted fraudulently; a payee or its provider that fails to accept SCA refunds the damage (PSD2 Article 74(2)). source

Documents

  1. Law text Directive (EU) 2015/2366 (PSD2)
  2. Law text Delegated Regulation (EU) 2018/389 (RTS on strong customer authentication)
  3. Law text Delegated Regulation (EU) 2022/2360 - 90-day exemption for account access
  4. Guidance EBA Opinion on the deadline for migration to SCA for e-commerce card payments (2019)
  5. Law text Payment Services Regulation proposal COM(2023) 367 (SCA in Article 85; not adopted)

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 18 September 2026. Subscribe to PSD2 SCA (RSS)