EMVCo Statement: EMV® 3-D Secure and the PSD2 Requirements for Strong Customer Authentication

EMVCo Statement: EMV^® 3-D Secure and the PSD2 Requirements for Strong Customer Authentication EMVCo believes EMV^® 3-D Secure1 provides tools and features that can allow implementers to fully satisfy Strong Customer Authentication (SCA) requirements as described in the Second Payment Services Directive (PSD2) by the European Commission2. EMV 3-D Secure (EMV 3DS) enables issuers to leverage the appropriate authentication methods to ensure PSD2 compliance. European Banking Authority Opinions: The European Banking Authority (EBA) published an Opinion on 21 June 2019 regarding elements of SCA under PSD2. This Opinion states (at point 23): "… communication protocols such as EMV 3DS provide a means for merchants to support the use of SCA. The EBA notes that versions 2.0 and newer support a variety of SCA methods, while trying to ensure customer convenience, limiting fraud through data sharing and transaction risk analysis, and enable the use of exemptions set out in the Regulatory Technical Standards (RTS). For those reasons, the EBA encourages the use of such communication protocols and expedient onboarding." EMV 3DS supports all EU SCA factors, including inherence, through a range of authentication methods, such as the facilitation of biometrics (e.g. biological and behavioural). These factors can be delivered in or out-of-band, or using FIDO Authentication Standards3. EMV 3DS v2.2.0 was specifically designed to support an improved user experience for biometrics. A further EBA Opinion was published on the 16 October 2019 deadline for the migration to SCA for e-commerce card-based payment transactions. It references the RTS and states (at point 15) that the ‘[EMV] 3DS v2.2. communication protocol… should enable the application of the full range of SCA exemptions specified in the RTS and the out-of-scope of SCA transactions, such as payee-initiated transactions.’ For further information on EMV 3DS, visit the technology pages and read the press kit on the EMVCo website. 1 Version 2.1.0 and version 2.2.0. Please note that although the EBA Opinion mentions older protocols such as ‘EMV 3-D Secure version 1.0’, version 1.0 is not an EMV Specification and is not managed by EMVCo. 2 ‘COMMISSION DELEGATED REGULATION (EU) 2018/389 of 27 November 2017, the Opinion of the European Banking Authority on the implementation of the RTS on SCA and CSC issued on 13 June 2018, as well as the Opinion of the European Banking Authority on the elements of strong customer authentication under PSD2 issued on 21 June 2019.’ 3 This is in reference to Point 21 raised in the EBA Opinion on 21 June 2019 stating that EMV 3DS ‘does not currently appear to constitute inherence elements, as none of the data points, or their combination, exchanged through this communication tool appears to include information that relates to biological and behavioural biometrics…’ © 2020 EMVCo, LLC. All rights reserved.

Understanding the role of EMVCo in supporting SCA: EMVCo is a global technical body that works to facilitate the worldwide interoperability and acceptance of secure payment transactions by managing and evolving the EMV Specifications and related testing processes. It achieves this by providing a technology toolbox that the payments community can use to conduct globally interoperable secure payments across face-to-face and remote environments. Adoption of EMV Specifications – including EMV 3DS – and associated approval and certification processes, promotes a unified international payments framework, which supports an advancing range of payment methods, technologies and acceptance environments. The specifications are available royalty free, designed to be flexible, and can be adapted regionally to meet national payment requirements and accommodate local regulations. EMVCo works with local partners where possible to ensure the EMV technology toolbox meets current and future marketplace needs and encourages all input that will enable it to support the industry and regulation requirements. It is, however, the responsibility of the parties implementing the specification to ensure that their EMV 3DS solutions comply with local regulations, such as PSD2. -ENDS- EMV^® is a registered trademark in the U.S. and other countries and an unregistered trademark elsewhere. The EMV trademark is owned by EMVCo, LLC. © 2020 EMVCo, LLC. All rights reserved.