PSD2 Authentication: The complete guide

This article was updated in May 2020

There’s a lot to cover when it comes to regulatory changes. In our previous PSD2 articles, we explored the essentials of this European regulation, key changes that may impact your business, and how our 3D Secure 2 solution helps withstrong customer authentication (SCA).

This time we’re focusing on how our new Authentication Engine feature helps you reduce regulatory complexity and optimises for authorisation success.

With an increasing number of parties (national regulators, banks, schemes, 3D Secure providers) interpreting and implementing PSD2 in different ways, it can all get complicated.

For example, some EU countries have decided on different timelines to start monitoring PSD2 compliance.

These complexities and the ever-changing payments landscape directly impact your business growth. More than anything else in the payment space it affects your authorisation rates due to a wide variety of required checks across sets of compliance, transactional, risk, and issuer data.

And there’s no 'one size fits all' approach. The profile of each transaction needs to be considered based on its amount, if it’s recurring, local regulations, issuers' authentication preferences, your relationship to your shopper, and more.

So how do you stay compliant, trigger the right checks, optimise for certain behaviors, and ultimately get your payments authorised? It’s simple, you employ smart technology and proven expertise to guide you through it.

With PSD2’s regulatory requirements taking effect in most EU countries from 31 December 2020, you’ll already have questions about your payment processing setup. Your payment authorisation rates could be in the hands of a preference of one PSD2 SCA exemption over another. Or it might depend on how strictly a bank is enforcing or monitoring authentication. Or maybe it depends on which 3DS2 version you're on. And what happens if one of these settings change? Which they do, often at the last minute.

To tackle this uncertainty, we've enriched our optimisation toolkitRevenueAccelerate, by using our machine learning intelligence to assess every transaction, beyond just exemptions. By analysing our platform-wide data, the Authentication Engine can identify insights as the PSD2 landscape matures. Plus, at a bank level, the Authentication Engine monitors, identifies patterns and behaviors, and acts on them in real-time.

For example, if regulation allows, we can skip an authentication process so shoppers aren’t interrupted at your checkout because we can see that a bank authorises a transaction with our3D Secure product. Or, if a bank changes its exemptions preferences we can see almost instantly what works from actual transactions we’re optimising across our merchant network.

This means less friction when the shopper is checking out, and transactions are geared towards the best chance of authorisation, no matter what angle PSD2 comes from.

To give you context on the complexity of the authentication process around PSD2, as well as show you how with Adyen, you have all your bases covered, we have outlined a range of parties that have different responsibilities surrounding this regulation. These either dictate the way a transaction is treated, or directly impacts its authorisation success.

Further down, we also outline example flows of this authentication decisioning, so you can see it put to practice and the benefits specific to your business.

Business benefits:Reduction in costs, less checkout friction, and faster authorisation.

The bank is not yet enforcing PSD2 SCA. Even if you send supporting data that meets 3D Secure standards to us, we would skip this authentication step and route the transaction through a 'No 3D Secure flow'. Your shopper will not experience an unnecessary challenge and the speed of checkout is increased. You'll always have control, as you can set rules tailored to your business needs. And, where regulation mandates, we will always meet 3D Secure standards and route accordingly.

Business benefits:Reduction in checkout friction, increased authorisations, and optimised chargeback liability.

The bank does not yet have 3D Secure 2 but you are 3DS2 ready. To avoid any chance of an unnecessary challenge for your shopper, we would send 3D Secure 2 supporting data to the bank to prove your readiness. This shifts chargeback liability to the bank and helps to reduce the impact of a chargeback for you.

However, some banks may behave differently and choose not to authorise in this situation. We will always route your transaction across the route that has the best chance of authorisation, meets bank's preferences, and is friction-free for shoppers.

Business benefits:Reduction in checkout friction, increased authorisations, less costs, and faster authorisations.

The bank grants exemptions at the point of authorisation rather than at the point of authentication. Depending on a banks preference for certain exemptions, we would pick the best route.

For example, a bank may prefer full 3D Secure authentication even if the transaction fits an exemption (say for a low value exemption (<€30) )if presented in this way, you may experience faster authorisation.

Over time we’ll see more changes as PSD2 authentication needs mature. Outside Europe, in Australia for example, industry parties are in consultation phases for SCA frameworks, suggesting that other countries will soon follow with more authentication rules.

If you’re using the Adyen platform, our 3D Secure product,Acquiring, and Authentication Engine have you covered for today, tomorrow, and whatever comes up in the future. We’re always here to help too, so if you have any questions around these regulations and our products, doget in touch.