How Strong Customer Authentication in the UK Is Changing

The rules for strong customer authentication in the UK are set to move. In its July 2026 consultation on modernising payment services regulation, HM Treasury confirmed it has committed to start revoking the authentication provisions in the Payment Services Regulations 2017 (PSRs) that relate to strong customer authentication (SCA), so that the Financial Conduct Authority (FCA) can make more outcomes-based rules. The consultation closed on 6 October 2026. For card issuers, acquirers and merchants, the change is about where the rules sit and who can change them. The requirements that apply today have not changed.

Where strong customer authentication in the UK sits today

Two layers set the current rules. The legal requirement to apply SCA is in regulation 100 of the PSRs, the UK’s implementation of the EU’s second Payment Services Directive (PSD2). The technical detail, including the exemptions, is in technical standards made by the FCA (the SCA-RTS). When the FCA made the UK SCA-RTS after Brexit, it made them substantially the same as the EU version. It has since changed them, for example by adding a new exemption so that customers using account information services do not have to re-authenticate with their bank every 90 days.

For online card payments, EMV 3D Secure (EMV 3DS) is the protocol issuers generally use to apply SCA. The issuer’s Access Control Server (ACS) decides whether to authenticate frictionlessly or challenge, and the merchant’s or acquirer’s 3DS Server can request exemptions such as transaction risk analysis. How those exemption requests travel through the protocol is covered in How Exemptions Are Requested, Granted and Reported Across the 3DS Message Flow.

What HM Treasury has committed to

The consultation sets out three points that matter for authentication:

The revocation. HM Treasury refers to the Future of Payments review, which found that the technical standards behind SCA had reduced fraud but had also created burdensome friction for customers. The government has therefore committed to commencing the revocation of the SCA authentication provisions in the PSRs, to enable the FCA to make more outcomes-based rules about authentication.
Where the rules go. Where requirements are delegated, they would be removed from legislation, and the government would work with the FCA so it can replace them with requirements in its Handbook. The FCA could consult on carrying existing requirements over where they remain appropriate, or on changing them.
Open questions. The consultation asks how provisions on authentication, consent and liability for unauthorised payments need to change to support agentic payments, where AI agents act for consumers. It also asks how the reforms can support an inclusive payments system, including for people who cannot or do not want to use digital payments.

The government says changes will be made through secondary legislation and that it will set out more detail on implementation after the consultation.

What has not changed for strong customer authentication in the UK

The consultation does not set a date for the revocation, and it does not say what the FCA’s replacement rules will contain. Until the revocation takes effect and FCA rules replace the current provisions, regulation 100 and the SCA-RTS continue to apply. Issuers still need to apply SCA where the rules require it, and the existing exemptions remain available on their current conditions.

What implementers should watch for in the FCA’s rules

An outcomes-based approach usually means rules that state what must be achieved rather than prescribing exactly how. We will not guess at the FCA’s drafting. These are the points in a card authentication programme that would be affected by any change, and which teams should check when the FCA consults:

Area	Why it matters for EMV 3DS	Where it is configured today
Authentication elements	Today SCA means two or more elements from the categories of knowledge, possession and inherence. Any change affects which challenge methods count.	ACS challenge method configuration
Exemptions and thresholds	Transaction risk analysis and low-value exemptions carry fixed conditions in the SCA-RTS. Outcomes-based rules could change how they are set.	ACS risk rules; exemption logic in the 3DS Server
Liability for unauthorised payments	The consultation links authentication and liability, including for agentic payments.	Dispute and refund processes; scheme liability rules are separate
Inclusion	Authentication methods that assume a smartphone can exclude some customers.	Available challenge methods and fallbacks
Agent-initiated payments	Rules on consent and authentication when an AI agent pays.	Not yet standardised in EMV 3DS

Card scheme rules sit alongside the law. They set liability shift and programme requirements, and they will not change automatically when UK legislation does.

How the UK and EU approaches now differ

The EU is moving the other way on structure. Its new Payment Services Regulation (an EU regulation, not to be confused with the UK’s Payment Services Regulations 2017) puts the conduct rules, including SCA, into a regulation that applies directly in every member state. The Council of the EU adopted its first-reading position on that regulation on 29 October 2026, and the text now goes to the European Parliament for its second reading. The UK is moving detail out of legislation and into regulator rules. A merchant or acquirer serving both markets should expect two sets of requirements that will drift further apart, and should keep its UK and EU authentication logic separately configurable. Our article on multi-jurisdictional 3DS compliance covers how to manage several regimes at once.

What issuers and acquirers should do now

Keep complying with the current PSRs and SCA-RTS. Nothing in the consultation suspends them.
List where SCA decisions are encoded: ACS challenge rules, exemption requests in the 3DS Server, authorisation rules and contracts. Rules held as configuration are easier to change than rules held in code.
Separate UK and EU logic now, so a UK change does not force an EU change or the reverse.
Follow the FCA’s consultations once the government sets out its next steps, and respond where the drafting affects your challenge methods or exemption use.
Review challenge methods for inclusion. Know which cardholders cannot use your default method and what they are offered instead.

Where GPayments fits

ActiveServer is GPayments’ 3DS Server for acquirers, payment service providers and merchants, and ActiveAccess is its Access Control Server for issuers. If you are reviewing how your authentication rules would adapt to a change in UK requirements, speak with a 3DS specialist.

Frequently asked questions

Has the UK removed strong customer authentication?

No. HM Treasury has committed to begin revoking the SCA provisions in the PSRs so the FCA can set its own rules. Until that happens and FCA rules replace them, the current requirements apply.

When will the FCA publish new authentication rules?

No date has been set. The consultation closed on 6 October 2026 and the government has said it will set out further detail on implementation after the consultation.

Will UK changes alter card scheme 3DS rules?

Not automatically. Card scheme programme rules and liability shift are set by the schemes. Issuers and acquirers need to follow both the law and the scheme rules that apply to them.

Do UK exemptions such as transaction risk analysis still apply?

Yes, on their current conditions in the SCA-RTS, until the FCA changes them.

Does the UK change affect payments by customers in the EU?

The UK reforms apply to UK regulation. Payments within the EU follow EU rules, which are being updated through the Payment Services Regulation.