Strong customer authentication

Also called SCA, PSD2 SCA

The EEA legal requirement that most online card payments be confirmed with two independent factors, such as the player's phone plus a PIN or fingerprint, before the payment goes through.

SCA comes from the EU’s second Payment Services Directive. Article 97 requires payment providers to apply it when a payer “initiates an electronic payment transaction”, and for remote payments the check must “dynamically link the transaction to a specific amount and a specific payee”. On a card checkout, 3-D Secure is how it happens.

Exemptions reduce the friction. Under the regulatory technical standards, payments of €30 or less can skip SCA until the running total passes €100 or five payments since the last check, and transaction risk analysis lets PSPs with low fraud rates exempt more. The PSP requests the exemption, and the player’s bank can still insist.

For a studio selling small top-ups to European players, the €30 exemption covers many single purchases, but the cumulative limit means regular spenders still get challenged. An EU reform, PSD3 with a new Payment Services Regulation, was provisionally agreed in November 2025 and still needed formal adoption as of September 2026. See chargebacks and fraud.