Managing SCA enforcement changes in Europe

SCA Is Finally Enforced: What It Means for Payments Operations

Strong Customer Authentication (SCA) has been a topic of discussion for European payments for years, but 2021 is when it became a practical reality. Enforcement is now active in nearly all eligible European countries, and in Q1 2021 the rate of SCA-authenticated payments in the EU more than doubled. The rules are intended to cut fraud and secure online transactions, but they also force merchants to rethink how they handle authentication and payment operations.

Stripe has built an SCA engine to absorb some of that complexity. For merchants already using an SCA-friendly integration, the engine works behind the scenes to satisfy regulatory requirements and optimize each eligible payment. Stripe’s visibility into hundreds of billions of dollars in annual payments volume lets the company spot issuer behavior patterns and conversion pitfalls. Here’s what the enforcement rollout has looked like so far, and how Stripe is addressing the friction.

Fragmented Country Rollouts Create a Compliance Tangle

The original September 2019 enforcement deadline was pushed back because neither issuers nor merchants were prepared. Even with that delay, the 2021 rollout has been anything but uniform. Each country is on its own schedule: the Netherlands reached full enforcement in January 2021, the rest of the EU is expected by end of June 2021, and the UK isn’t projected to reach full enforcement until March 2022. A merchant operating across the UK, France, and the Netherlands therefore has to run three separate sets of authentication logic in parallel.

Stripe’s SCA engine is embedded in the Payments APIs, Checkout, and Billing, so a single integration stays compliant across all enforcement timelines. The engine requests authentication only when PSD2 or the cardholder’s bank actually requires it, adjusting to each country's phase-in to minimize unnecessary friction.

3DS2 Performance Is Still Uneven

3D Secure 2 (3DS2) launched in 2020 as the streamlined successor to the original 3DS standard. It’s the preferred route to SCA compliance because it supports frictionless authentication. But being relatively new has its costs: 3DS2 can produce lower or less consistent authentication rates than the older 3DS1 standard.

Rather than commit to one protocol, Stripe’s engine selects the optimal 3DS version per issuing bank. That issuer-aware switching can lift authentication completion rates by as much as 15%, depending on the bank in question.

Issuer Readiness Gaps Show Up as Declines

The first months of SCA enforcement have exposed a related issue: some issuers are declining transactions they shouldn’t. Legitimate payments that would have cleared an authentication challenge fail anyway, costing merchants revenue and customers goodwill.

Stripe’s SCA engine addresses this with issuer-specific logic that proactively requests authentication when it detects potential issuer-side issues. That approach recovers up to 22% of declined payments.

Stripe continues to iterate on these mechanisms as the SCA enforcement environment evolves. Further details are available in Stripe’s SCA guide or by contacting the team directly.