Important deadlines and target dates for PDS2 and SCA in EEA

Dear Clients and Industry Colleagues

This email is being send to remind you of important deadlines for MasterCard migration to support 3DSecure 2.1.

EMVCo 3DSecure 2.1 has now been in production for over a year and this period has been used to allow merchants and banks to migrate their systems to this new generation authentication system.

This period has also been used to identify errors in messages and also improve and tune version 2 with production experience. MasterCard has wisely pushed forward Version 2.1 Plus; this means that improvements and corrections have been made to the 2.1 specification without the huge distractions of recertification.

These changes will become part of the official specifications in versions 2.2 and 2.3. The core specification itself allows for values to be defined by the card schemes and for message extensions provide further flexibility.

Now on to important dates and deadlines!

The effective date of the second Payments Services Directive (PSD2) on Strong Customer Authentication (SCA) is 31 December 2020 for all EEA countries but the UK, with a low probability that the European Banking Authority (EBA) or any National Competent Authority grants further delays.

As from 1 January 2021 for the vast majority of Customers in the EEA, each and every e-commerce transaction that is not excluded or exempted from the regulation will need to go through strong customer authentication, i.e. two-factor authentication. The underlying protocol used to drive authentications is the EMVCo EMV 3DS or 3DS2.x protocol with PSD2 extension message that is mandated by MasterCard since 1 July 2020.

Until the UK has to apply SCA as of 14 September 2021, transactions between PSPs in the EEA and UK do not require SCA. As of 14 September 2021, SCA will probably be required between EEA PSP and UK PSP unless an exemption (or exclusion) applies. This is because UK PSPs are mandated to use SCA which means that the EEA requirement to apply SCA (even outside EEA) on a best effort can be met.

MasterCard has prepared three questionnaires for Issuers, Acquirers and Merchants which will help MasterCard get a better understanding of the state of preparation and also provide a useful checklist for all parties to understand the minimum actions they will have to complete to be ready for PSD2 SCA. You can get these forms from MasterCard or contact us for assistance on [email protected].