.svg)
Payment authentication is the process of verifying the identity of the person making a payment. It is a fundamental component of card-not-present (CNP) transactions and is a key measure in reducing fraud.
There are several types of payment authentication:
- Single-factor authentication (1FA): The simplest form, using only one factor, such as a PIN or password, to verify identity.
- Two-factor authentication (2FA): This requires two factors; for example, a password plus a biometric identifier, adding an extra layer of security.
- Multi-factor authentication (MFA): This requires at least two independent factors. Strong customer authentication (SCA), as defined in (revised Payment Services Directive - PSD2), falls into this category.
Multiple protocols support MFA. 3-D Secure (3DS) is widely used for SCA compliance, employing two independent factors for authentication. OAuth 2.0 is another protocol that enables MFA.
This regulatory influencer lays out authentication requirements and exemptions across select jurisdictions in Europe and the Asian-Pacific region. These jurisdictions have been selected due to their approach: mandating authentication through a piece of primary or secondary legislation. Although other markets have likewise introduced similar authentication requirements, including Brazil and South Africa, they have employed slightly different methods.
Nonetheless, a review of the covered jurisdictions shows a clear trend of global regulators increasingly mandating authentication to address rising fraud in digital payments. While authentication requirements continue to expand and develop, implementation approaches vary significantly. The European Union and the United Kingdom have taken the most prescriptive stance through legally binding SCA rules and explicit technical standards. Their regimes are highly structured, with detailed exemption frameworks and strong supervisory enforcement.
In contrast, jurisdictions such as Singapore have prioritised risk-based flexibility, allowing exemptions where fraud controls and transaction risk assessments can be determined to be strong. This less prescriptive model enables financial institutions to tailor authentication measures to their risk appetite and system maturity. Japan is also notable as authentication standards were initially driven by industry practice before becoming formalised by the Ministry of Economy, Trade and Industry.
Despite differing implementation paths across jurisdictions, it is clear that authentication is increasingly becoming a baseline security expectation. Additionally, it is evident that MFA is no longer viewed as an enhanced security feature but as a regulatory necessity. Future developments are likely to focus less on whether MFA is required and more on how it is implemented.
|
Country |
Requirements |
Exemptions |
|
European Union |
Directive (EU) 2015/2366 (PSD2) introduced the concept of strong customer authentication (SCA). According to Article 4, SCA refers to an authentication process based on the use of two or more elements:
These elements must be independent, ensuring that the breach of one does not compromise the reliability of the others. They must also be designed to protect the confidentiality of the authentication data. In accordance with Article 94, payment service providers are required to apply SCA when the payer:
Commission Delegated Regulation (EU) 2018/389 sets out the regulatory technical standards (RTS) for strong customer authentication (SCA) and for common and secure open standards of communication. Specifically, the RTS provides for the following:
|
Article 98 of PSD2 provides that the European Banking Authority (EBA), in close cooperation with the European Central Bank (ECB), shall develop draft technical standards setting out, among others, the exemptions from the application of SCA. Commission Delegated Regulation (EU) 2018/389 provides for certain exemptions for the application of SCA. This includes: Article 10 (Payment account information) payment service providers are permitted to not apply SCA where a payment service user is limited to accessing either or both of the following items online without disclosure of sensitive payment data:
Article 11 (Contactless payments at point of sale) payment service providers are permitted to not apply SCA where the payer initiates a contactless electronic payment transaction provided that the following conditions are met:
Article 12 (Unattended terminals for transport fares and parking fees). Article 13 (Trusted beneficiaries). Article 14 (Recurring transactions). Article 15 (Credit transfers between accounts held by the same natural or legal person). Article 16 (Low-value transactions) payment service providers are permitted to not apply SCA where the payer initiates a remote payment transaction provided that:
Article 17 (Secure corporate payment processes and protocols). Article 18 (Transaction risk analysis) payment service providers are permitted to not apply SCA where the payer initiates a remote electronic payment transaction identified by the payment service provider as posing a low level of risk according to the transaction monitoring mechanisms. Commission Delegated Regulation (EU) 2022/2360 amends the RTS set out in Delegated Regulation (EU) 2018/389 concerning the 90-day exemption for account access. Article 10 of Delegated Regulation (EU) 2018/389 provides an exemption from the requirement to apply SCA when a payment service user is accessing the balance and recent transactions of a payment account without disclosure of sensitive payment data. In such cases, payment service providers may refrain from applying SCA for account access, provided that SCA was applied when the account information was first accessed, and at least every 90 days thereafter. Delegated Regulation (EU) 2022/2360 amends Article 10 to clarify when the SCA exemption can be applied. It specifies that SCA is not required where a payment service user accesses their payment account online directly, provided that access is limited to one of the following without disclosure of sensitive payment data:
However, SCA is not exempted if any of the following conditions apply:
|
|
United Kingdom |
The Payment Services Regulations 2017 (PSR) directly transpose PSD2 in the United Kingdom. As a result, PSD2s SCA requirements are directly applicable. The Financial Conduct Authoritys (FCA) technical standards on SCA specify:
|
Section 106(a), in combination with Section 100(5), permits the FCA to draft technical standards setting out the exemptions to SCA. Chapter 3 of the technical standards on SCA sets out exemptions. The exemptions include: Article 10 (Payment account information accessed directly by a payment service user) payment service providers (PSPs) are permitted to not apply SCA where a payment service user is limited to accessing either or both of the following items online without disclosure of sensitive payment data:
However, this exemption does not apply where either of the following is met:
Article 10A (Payment account information accessed through an account information service provider) PSPs are permitted to not apply SCA where a payment service user is limited to accessing either or both of the following without the disclosure of sensitive payment data:
Article 11 (Contactless payments at point of sale) PSPs shall be allowed not to apply SCA where the payer initiates a contactless electronic payment transaction, provided that the following conditions are met:
Article 12 (Unattended terminals for transport fares and parking fees). Article 13 (Trusted beneficiaries). Article 14 (Recurring transactions). Article 15 (Credit transfers between accounts held by the same natural or legal person). Article 16 (Low-value transactions) PSPs are permitted to not apply SCA where the payer initiates a remote payment transaction, provided that:
Article 17 (Secure corporate payment processes and protocols). Article 18 (Transaction risk analysis) PSPs are permitted to not apply SCA where the payer initiates a remote electronic payment transaction identified by the payment service provider as posing a low level of risk according to the transaction monitoring mechanisms. On September 10, 2025, the Financial Conduct Authority (FCA) published CP25/24 which, among other proposals, seeks feedback on its proposal to scrap the current 瞿100 limit for contactless electronic payments. Currently, per Article 11 of the , there is a limit on the value and number of contactless payments that can be made before requiring authentication. The FCA is proposing to replace these limits with a new exemption. Specifically, the exemption would allow PSPs to process contactless payments without asking the payer to authenticate the payment, where PSPs identify the risk of a transaction to be low. PSPs would also be able to set their own contactless limits. |
|
France |
Ordinance No. 2017-1252 of August 9, 2017 transposed PSD2 into national legislation in France. On June 10, 2024, the French Observatory for the Security of Payment (OSP) launched an action plan to strengthen the security of remote card payments. The action plan is based on issuing banks limiting remote payments without strong authentication made outside the 3DS protocol, and to promote the use of the most secure channels. Specifically, the plan caps payments identified as risky on the basis of the "velocity" measure:
The velocity threshold was initially set at 500 when the plan started on June 10, 2024. It was then lowered to 250 at the start of the 2024 academic year, and then to 100 in the last quarter of 2024. |
See above regarding European Union exemptions. |
|
Iceland, Norway and Liechtenstein (European Free Trade Association Countries - EFTA) |
Through an EEA Joint Committee Decision, the three EFTA countries Iceland, Norway, and Liechtenstein have adopted PSD2. Consequently, SCA is applicable in those nations. |
See above regarding European Union exemptions. |
|
India |
The Reserve Bank of India (Digital Payment Security Controls) Directions 2021 provide an authentication framework consolidating several circulars issued by the Reserve Bank of India (RBI). The directions require regulated entities (REs) to implement, except where explicitly permitted, multi-factor authentication (MFA) for payments through electronic modes and fund transfers, including cash withdrawals from ATMs, micro-ATMs, business correspondents and digital payment applications. REs may also adopt adaptive authentication to select the appropriate authentication factors based on risk assessment, user risk profile and behaviour. Furthermore:
Effective from April 1, 2026, these directions establish a framework setting out the principles that all participants in the payments chain must follow when using authentication. Specifically, the directions require:
These requirements apply to all domestic digital payment transactions. Although the directions do not apply to cross-border digital payment transactions, card issuers are required, by October 1, 2026, to implement a mechanism to validate non-recurring cross-border card-not-present (CNP) transactions when authentication is requested by an overseas merchant or acquirer. |
The Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions 2025 provide for a consolidated list of exemptions from MFA in Annexure 1. The exemptions are:
Small-value contactless card transactions This directive from the RBI further specifies the small-value contactless card transaction exemption. Specifically, AFA may be exempted for individual transactions under 5,000 in contactless mode at points of sale (PoS) terminals. Transactions beyond this limit may utilise contactless interfaces, but with AFA. Recurring transactions This circular specifies that AFA is not mandatory for recurring transactions up to 15,000 where the first transaction was authenticated via AFA. This circular clarifies that AFA is not mandatory for specific recurring transactions up to 100,000 where the first transaction was authentication via AFA. This only applies to:
Select prepaid instruments The directions provide that, for specific prepaid instruments, AFA may not be applied. Specifically, 2FA or AFA is not mandatory for prepaid payment instruments (PPIs) for mass transit systems (PPI-MTS) and gift PPIs where the value does not exceed 10,000. National Electronic Toll Collection (NETC) transactions The directive states that transactions in the NETC system can be performed without AFA. Small-value digital payments in offline mode The directive states that an offline payment means a transaction which does not require internet or telecom connectivity to take effect. Such payments may be offered without AFA. The upper limit of an offline payment transaction is 500. The total limit for offline transactions on a payment instrument is 2,000 at any point in time. Travel booking involving Global Distribution System / IATA through commercial / corporate cards. To the best of 蹤獲鱉鱉s knowledge, the directive providing for this exemption has been . |
|
Singapore |
Pursuant to Section 4.6 of the Notice FSM-N06 Cyber Hygiene, entities must implement multi-factor authentication (MFA) for the following:
Singapore defines MFA as the use of two or more factors to verify an account holders claimed identity. Such factors include, but are not limited to:
The E-Payments User Protection Guidelines require that an account user must, at a minimum, take the following steps when using a device to access a protected account:
The Technology Risk Management Guidelines mandate the use of multi-factor authentication (MFA), which must be deployed at login for online financial services to secure the customer authentication process. MFA can be based on two or more of the following factors:
On July 9, 2024, MAS, alongside the Association of Banks in Singapore (ABS), announced that major retail banks in Singapore will be progressively phasing out the use of one-time passwords (OTPs) for bank account login by customers who are digital token users. |
The guidelines specify that, aside for login and transaction-signing for high-risk activities, financial institutions may implement appropriate risk-based or adaptive authentication that presents customers with authentication options that are commensurate with the risk level of the transaction and sensitivity of the data. Although not explicitly related to authentication, the guidelines provide for an example for compliance with account holders preference: if the account holder chooses not to receive pre-authorised, first person, or recurring transaction notifications, while the responsible FI should make the option to receive these notifications available to the account holder, the responsible FI may comply with the account holders instructions and not notify the account holder of such transactions. The guidelines further specify that an account holder of a protected account is not liable for any loss arising from an unauthorised transaction if the loss arises from any action or omission by the responsible institution. |
|
Malaysia |
The policy document is applicable to all financial institutions and mandates the use of robust authentication processes to ensure the authenticity of identities in use. Authentication mechanisms shall be commensurate with the criticality of the functions and adopt at least one or more of the three basic authentication factors:
Further, institutions are encouraged to properly design and implement, especially in high-risk or single sign-on systems, multi-factor authentication (MFA) that is more reliable and provides stronger fraud deterrents. Financial institutions must ensure that the security controls of MFA solutions include adherence to the following requirements:
For high-risk transactions or transactions above RM10,000, financial institutions must implement additional controls to authenticate devices and users, authorise transactions, and support non-repudiation and accountability. These measures must, at a minimum, include MFA. Financial institutions must also deploy MFA solutions with stronger security controls for open third-party fund transfers and open payment transactions with a value of RM10,000 and above. () In January 2025, Bank Negara Malaysia (BNM), the countrys central bank, issued a policy document on electronic money (e-money). E-money serves as a payment instrument that can be used to make payments for goods and services at merchants accepting e-money. E-money users may also send or receive funds to or from another users e-money or bank account through person-to-person (P2P) fund transfer services, provided the e-money issuer (EMI) is authorised to offer such services. The policy document mandates the use of risk-based authentication for online payment transactions. Specifically:
On December 17, 2024, the BNM published a draft policy document on technology requirements for payment services regulatees (PSRs). The draft outlines new requirements for managing technology risks by PSRs and aims to consolidate these requirements into a single policy document, primarily for approved issuers of electronic money (EMIs), registered merchant acquirers (MAs) and licensed money services businesses. Specifically, the policy mandates PSRs to implement controls to authenticate devices and users, authorise transactions, and support non-repudiation and accountability for transactions performed via digital services. These measures must, at a minimum, include:
Further, PSRs must ensure that the security controls of MFA solutions meet the following requirements:
|
For financial transactions below RM10,000, a financial institution may decide on proportionate controls and authentication methods for transactions assessed by the financial institution to be of low risk. In undertaking the assessment, the financial institution must establish a set of criteria or factors that reflect the nature, size and characteristics of a financial transaction. Such criteria or factors must be consistent with the financial institutions risk appetite and tolerance. The financial institution must periodically review the risk assessment criteria to ensure its continued relevance, having regard to the latest developments in cybersecurity risks and authentication technologies, as well as fraud trends and incidents. Where a financial institution decides not to adopt MFA for financial transactions that are assessed to be of low risk, the financial institution must nevertheless implement adequate safeguards for such transactions, which shall include at a minimum the following measures:
() The policy document specifies that an EMI may adopt risk-based authentication for low-risk online payment transactions. Low risk consists of:
When apply risk-based authentication for low-risk online payment transactions, EMIs are required to:
An EMI is encouraged to identify a tolerable aggregate amount of low-risk online payment transactions eligible for risk-based authentication to mitigate against high fraud losses. Furthermore, an EMI must notify the BNM at least 14 days prior to first-time implementation of risk-based authentication for low-risk online payment transactions. |
|
Japan |
The Japanese Consumer Credit Card Association (JCA), a voluntary industry association, introduced the credit card security guidelines in 2020. The guidelines specify identity verification as a specific countermeasure for fraud. Published in 2023, version 4.0 of the guidelines mandates credit card operators within the JCA to implement 3DS by March 2025. In addition, credit card providers must adopt a risk-based approach to credit card verification by requiring merchants to supply credit card acquirers with data on the risk levels of different purchases from their stores and using information such as the customers device. Although the JCA is not a regulator, as reported by 蹤獲鱉鱉, the list of JCA members reveals that every major credit card issuer in the country is a member. This means any merchant wishing to avail themselves of the services of these card issuers and acquirers must comply with these guidelines. Version 5.0 of the credit card security guidelines sets out new authentication requirements for all payments in Japan from April 1, 2025. Specifically, the guidelines mandate the use of 3DS for all online payments. This includes acquirers, payment service providers and issuers. Transactions without 3DS authentication may therefore be declined. |
Version 5.0 of the guidelines state that all online payments must utilise 3DS authentication, whether there are domestic or international. To the best of 蹤獲鱉鱉s knowledge, specific exemptions to the requirement to implement 3DS are not addressed in the guidelines. |
