Strong authentication made checkout an operating discipline
A secure checkout still has to carry the customer through bank and merchant systems. Strong authentication made that shared responsibility central to a payment provider's commercial value.
A customer could choose a product, enter a valid card and still fail to complete a purchase. Strong customer authentication brought that possibility into sharper focus when Europe's detailed payment security rules began applying on 14 September 2019. The merchant controlled the basket and much of the checkout, while other participants controlled authentication and payment authorisation. A reliable sale depended on those systems working together.
The commercial challenge was unusually distributed. Issuing banks needed compliant authentication, payment providers needed compatible flows, and retailers needed to explain new steps without losing the customer. The legal application date remained fixed, but supervisors recognised that parts of the industry needed an organised migration. For payment startups, the resulting work concerned operational responsibility as much as a new security feature.
The legal date and the migration plan diverged
Commission Delegated Regulation 2018/389 set the detailed standards, including authentication requirements, exemptions and secure communication. Ahead of the application date, the European Banking Authority explicitly said it could not postpone a date established in EU law. It nevertheless accepted limited additional time through national supervisors where payment service providers had agreed migration plans and would execute them promptly.
- 21 June 2019
EBA clarifies implementation
The legal date stands; agreed supervisory migration plans may allow limited additional time.
- 13 August 2019
FCA announces its plan
An 18-month e-commerce implementation plan ties enforcement flexibility to evidence of progress.
- 14 September 2019
Technical standards apply
Most provisions of Delegated Regulation 2018/389 become applicable.
The UK implementation plan allowed supervisory flexibility while the legal application date remained in place.
The UK Financial Conduct Authority announced an 18-month implementation plan on 13 August for the e-commerce industry. Its enforcement approach depended on firms taking the necessary steps under that plan. The announced plan set a migration schedule; completion still depended on implementation. A company selling across Europe therefore needed to track its banks, markets and supervisory arrangements individually; a single promise that the deadline had moved would have been misleading.
Two factors had to remain independent
Strong authentication required at least two elements drawn from different categories: knowledge (something the customer knew), possession (something the customer possessed) and inherence (something the customer was). Independence mattered because compromising one element should not undermine the other. For remote electronic payments, the standards also required dynamic linking to the amount and payee. These requirements made the exact sequence of authentication relevant, beyond the presence of a password or a bank screen that looked familiar.
For a provider building merchant infrastructure, the practical task included passing accurate transaction information, handling the authentication response and returning the customer to the correct order. A successful identity check did not itself establish that a bank would authorise the payment. Reporting those stages separately helped merchants understand whether a problem arose from authentication, a declined transaction or a failure to resume the checkout.
Exemptions needed information and judgment
The standards allowed defined exemptions, including certain remote transactions of low value and payments judged low risk through transaction risk analysis. Each came with conditions. The exemption for remote transactions of low value used a €30 individual transaction threshold alongside cumulative controls, while risk analysis depended on such matters as monitored fraud rates and transaction characteristics. Payment service providers could apply an exemption only where its regulatory conditions were met.
Scroll to view all columns
| Comparison | Remote card payments | Remote credit transfers |
|---|---|---|
| €100 exemption threshold | 0.13% | 0.015% |
| €250 exemption threshold | 0.06% | 0.01% |
| €500 exemption threshold | 0.01% | 0.005% |
Reference fraud rates from the original Annex to Delegated Regulation 2018/389. These are regulatory thresholds, rather than observed industry rates. Article 19 measures fraud by transaction value over a rolling period of 90 days, including authenticated and exempt transactions of the same type. Article 18 also requires analysis of individual transaction risk and other conditions; meeting a numerical threshold alone does not establish an exemption.
Source1
A startup could help by collecting useful transaction context, applying the payment provider's supported routes and showing merchants what happened afterward. The product needed a credible fallback when authentication was required. An integration that looked efficient in an exempted transaction could still fail when the issuer requested a challenge, so testing had to include the less convenient branches of the payment journey.
The customer experienced one checkout
A shopper would not necessarily distinguish between a merchant, its payment provider and the bank's authentication service. A stalled screen or unclear instruction could become the retailer's support problem. The FCA's announcement also asked banks and payment providers to consider different consumer groups and provide alternative authentication methods where needed. Accessibility and recovery paths therefore belonged in the rollout itself.
Useful merchant tools could identify repeated failures by bank or device, preserve the customer's order state, and give support teams enough context to explain the next step. These capabilities had specific buyers: payment operations, customer service and conversion teams. The opportunity was strongest where a provider could demonstrate reliable completion and lower investigation effort, with comparisons controlling for changes in customer mix and fraud exposure.
The migration created work beyond launch day
For investors, an authentication rollout offered a way to examine the underlying quality of a payments business. A provider needed documentation that merchants could use, evidence of testing across the full payment journey, clear incident ownership and an economical way to maintain integrations. Manual assistance for every merchant could turn apparent software revenue into a business reliant on services.
The requirements created a more demanding operating environment. They did not make a visible challenge necessary for every purchase or guarantee that a sale would complete. Companies that could explain exceptions, diagnose failures and support customers through them had a concrete basis for earning a place in the checkout.
Sources
- Commission Delegated Regulation (EU) 2018/389, original adopted text (opens in a new tab)
European Commission, preserved by The National Archives
- EBA publishes an Opinion on the elements of strong customer authentication under PSD2 (opens in a new tab)
European Banking Authority
- FCA agrees plan for a phased implementation of Strong Customer Authentication (opens in a new tab)
Financial Conduct Authority
Published
