Clarity from chaos the EBA SCA and recurring

Clarity from chaos the EBA, SCA and recurring merchant requirements Francesc Altisent - Card Scheme Manager francesc. altisent@adyen. com wherever people pay

One modern platform Traditional value chain Adyen value chain

Get paid today 80 % 20 %

Get paid today Account Information Services (AISP) Access to Account (XS 2 A) Payment Initiation Services (PISP) Strong Customer Authentication Surcharging

The rule Strong Customer Authentication is mandatory, always And there are exceptions

Exceptions In a separate document, not yet approved by EC The RTS defines a set of exceptions based on a very low risk appetite • • Exempted • Under 30 EUR (required every 5 transactions or 100 EUR) • Recurring (only if fixed amount) Risk Based Approach possible • Up to 500 EUR • Based on fraud levels

Exceptions For the RBA to be possible, the PSP has to be under the fraud levels identified in the RTS: Transaction Amount Fraud rate 0 EUR to 100 EUR < 0. 13 % 100. 01 EUR to 250 EUR < 0. 06 % 250. 01 EUR to 500 EUR < 0. 01 % Beyond 500 EUR N/A Note: one leg out transactions and MOTO are excluded

The ecosystem There is not a single way of running a recurring business

The recurring ecosystem Transactions Subscription with trial Recurring Card-on-File Omnichannel

The toolbox There is no universal solution, Merchants are unique and have unique needs

3 DS 2. 0 • Consolidated by EMVCo • All schemes are participating • Major improvements • Improved mobile experience • In-app/Natvie authentication • No redirection • RBA and Issuer decision built in

Current 3 DS and new 3 DS 2. 0 approach Directory Lookup Yes Scheme Redirect Issuer No Directory Lookup Yes Scheme SDK or Web Flow Auth Needed Issuer Passive Approval No

Creative interpretations • White listing • Applicable to cards too • Are issuers on board? • Are card Schemes going to issue mandates? • Recurring transactions • Out of scope except 1 st one • Because initiated by the payee • Account validations • 0$ has to be authenticated?

The new PSP universe • 13 bps of Fraud for < 100 EUR • Quite difficult to achieve • Classical solution • Identify individual contributors • Define mitigation measures • Reduce fraud • Creative solution • Several PSPs

Takeaways The rule The ecosystem The toolbox • The RTS are not yet set in stone, but starting the race late will not buy you time • Each Merchant is unique, business models may need to change and adapt • Assess which are the possibilities, be creative and make your own interpretations

Questions? Francesc Altisent - Card Scheme Manager francesc. altisent@adyen. com