Strong customer authentication
Strong customer authentication (SCA) is the obligation under the EU Payment Services Directive PSD2 to confirm electronic payments with two independent factors from knowledge, possession and inherence.
Article 97 of PSD2 requires strong customer authentication when payers access their account online or initiate an electronic payment. The regulatory technical standards (Delegated Regulation (EU) 2018/389) set out details and exemptions, for example for small amounts, recurring payments of the same amount or payments after a risk analysis. Merchant-initiated payments based on a prior agreement are generally outside its scope.
For AI agents, the question arises how a customer confirms a payment her agent initiates. Payment networks address this through tokenization, signed purchase intents and exemptions whose application is governed case by case.
Example
A customer sets up recurring orders with a merchant for her agent and confirms the agreement once with strong authentication. The merchant initiates later orders based on this agreement; the agent stays within the signed limits of her purchase intent.
How it differs
Strong customer authentication proves that the customer confirmed a payment or agreement. An agent mandate or a purchase intent following Verifiable Intent proves within which limits her agent may act. The two complement each other.
In practice
- Clarify with your payment service provider how payments by agents are treated under PSD2.
- Record the agreement confirmed once and the limits of the purchase intent as evidence.
- Do not rely on exemptions without checking their conditions in the individual case.
Role in KYA
KYA does not verify authentication at the payment service. It verifies the evidence that records the limits of an agent purchase, such as Verifiable Intent or a mandate, and whether the specific payment stayed within them.
A term from the flow, not a check of its own. To the method
Frequently asked questions
What is strong customer authentication?
The obligation under PSD2 to confirm electronic payments with two independent factors: something you know, have or are.
Does SCA also apply to payments by AI agents?
In principle, the general rules apply. How agent payments are classified depends on the flow, for example whether the customer or the merchant initiates the payment, and on the payment networks' approaches.
Which exemptions exist?
The regulatory technical standards provide exemptions for small amounts, recurring payments of the same amount and payments after risk analysis, among others. Whether an exemption applies is decided by the payment service provider.
Does PSD2 apply in Switzerland?
Not directly. Swiss institutions processing payments in the EU are often affected by the rules, however, and card networks apply similar procedures.
General information, not legal advice. The statutes and the circumstances of each case are decisive.