# What is Strong Customer Authentication (SCA)?

URL: https://www.paydude.io/resources/what-is-sca
Type: Guide
Published: 2026-09-02 · Updated: 2026-09-02
Summary: SCA requires two-factor authentication on most EEA and UK payments. Who it applies to, the exemptions that matter, and what US sellers need to know.

**Strong Customer Authentication is a European regulatory requirement, introduced under PSD2, that most electronic payments be authenticated with two independent factors.** In practice it is why European checkouts trigger a bank app approval — usually implemented through [3D Secure 2](https://www.paydude.io/resources/what-is-3d-secure).

## Summary

Two of three factors: knowledge, possession, inherence. Scope is set by where the bank and acquirer are, not the customer. Several exemptions exist, and using them well protects conversion. Recurring charges you initiate are generally exempt after the first.

## The three factors

**Two of these three are required**

| Category | Examples |
| --- | --- |
| Knowledge — something you know | Password, PIN, security question |
| Possession — something you have | Phone, card reader, hardware token |
| Inherence — something you are | Fingerprint, face, voice |

They must be from different categories and genuinely independent. A password plus a security question is not SCA; both are knowledge.

## Who is actually in scope

This is the part most often misunderstood. SCA applies when **both** the cardholder''s issuing bank and the merchant''s acquirer are in the EEA or UK. A US business with a US acquirer selling to a customer in Berlin is generally out of scope — though the issuer may still request authentication.

> **If you have a European entity:** Selling through a European entity with a European acquirer puts you in scope regardless of where your customers are. This catches out US companies that set up an EU subsidiary for tax or contractual reasons without considering the payments consequence.

## The exemptions worth knowing

- **Merchant-initiated transactions.** Recurring charges you initiate after an authenticated first payment. This is what keeps subscriptions working.
- **Low value.** Under €30, subject to cumulative caps of roughly five transactions or €100 since the last authentication.
- **Transaction risk analysis.** Low-risk transactions can be exempted, with the threshold depending on the acquirer''s overall fraud rate.
- **Trusted beneficiaries.** A customer can allowlist your business with their bank.
- **Corporate cards.** Secure corporate payment processes can be exempt.

Exemptions are requested by the acquirer and granted — or refused — by the issuer. A good provider requests them automatically where they apply, which is why SCA-region conversion varies noticeably between processors.

## What it means practically

If you sell into Europe with a European acquirer, ensure your integration supports 3DS2, authenticate the first payment of any subscription, and confirm your provider requests exemptions rather than challenging everything. The difference between a good and a lazy implementation is measured in completed checkouts.

**Authentication handled for you** 3DS2 with automatic exemption handling where it applies. — [See how it works](https://www.paydude.io/pricing)

## Frequently asked questions

### Does SCA apply to US businesses?

It applies when both the cardholder's bank and the merchant's acquirer are in the EEA or UK. A US company with a US acquirer selling to a European customer is generally out of scope — but if you have a European entity or acquirer, you are in scope.

### What counts as two factors?

Two of three categories: something you know (a password or PIN), something you have (a phone or card reader), and something you are (a fingerprint or face). Two passwords do not count — they are the same category.

### Do subscriptions need SCA every time?

No. The first payment generally requires authentication, and subsequent fixed-amount charges you initiate are treated as merchant-initiated transactions and exempt. If the amount changes, you may need to authenticate again.

### What is the low-value exemption?

Transactions under €30 can be exempted, subject to cumulative limits — typically five consecutive exempt transactions or €100 total since the last authentication, after which the next one is challenged.