PSD2

PSD2 (the second Payment Services Directive) is the EU law that governs electronic payments across the EEA. It requires Strong Customer Authentication on most online card payments. It also requires banks to let licensed third parties access accounts through APIs, which is the basis of open banking.

What PSD2 requires

• Many online and contactless payments need two independent authentication factors. The customer's issuer enforces this.
• Banks must let authorized providers start payments and read account data when the customer consents.
• Clearer consumer rules on liability, refunds, and surcharges.

SCA enforcement started across the EEA in 2020 and 2021. The €30 low-value exemption and the risk-based exemptions still apply.

Who it affects

SCA under PSD2 applies when both the customer's bank and the merchant's acquirer are in the EEA. A US business selling to Europeans is not directly regulated by it. A European issuer may still ask its cardholders to authenticate, though, so US merchants see challenges too.

Why it matters for subscriptions

PSD2 treats a background subscription renewal as a merchant-initiated transaction, which usually doesn't need a live SCA challenge. That only holds if the customer authenticated the card when they first subscribed. Authenticate at signup and renewals are far less likely to fail.