When SCA Applies to Commercial and Virtual Cards

Commercial cards cover three quite different uses. An employee may pay for a hotel on a public website with a corporate card. A company may lodge a card with its travel management company, which books and pays on its behalf. Or a booking system may generate a single-use virtual card for each trip. In the EEA and UK, these three uses are treated differently under strong customer authentication (SCA), and the difference decides whether EMV 3D Secure (EMV 3DS) is needed.

What the secure corporate payment exemption says

Article 17 of the regulatory technical standards on SCA lets payment service providers not apply SCA to payments initiated by legal persons through dedicated payment processes or protocols that are only available to payers who are not consumers, provided the competent authority is satisfied the security is at least equivalent to what PSD2 requires.

The European Banking Authority confirmed in Q&A 2018_4060 that the exemption is not limited to a particular payment instrument, so card payments can qualify. It also stated that only the payer’s payment service provider, which for cards is the issuer, may decide to apply it.

In the UK, the FCA has said that lodged or virtual corporate cards used within access-controlled corporate travel management or purchasing systems would potentially be within scope, while physical corporate cards used by employees on public websites would not, as summarised by Edgar, Dunn & Company from the FCA’s Approach Document.

How each use is treated

Card use	SCA position in the EEA and UK	What it means for EMV 3DS
Employee pays with a physical corporate card on a public website	Not a dedicated corporate process, so SCA applies as for any card	Authenticate through EMV 3DS like any other checkout
Lodged card used by a travel management company within an access-controlled system	Potentially exempt under Article 17, if the issuer applies it and the competent authority is satisfied	The issuer decides; the merchant cannot apply the exemption itself
Virtual card generated in a corporate booking or purchasing system	As for lodged cards	As for lodged cards

What this means for merchants and travel intermediaries

A merchant receiving a corporate card cannot assume the payment is exempt. Only the issuer can apply Article 17. For lodged and virtual card payments where no cardholder is present to complete a challenge, merchants and travel management companies should agree with their acquirer how those transactions are processed and how the issuer’s exemption decision is reflected. For employee cards used at an ordinary checkout, normal EMV 3DS authentication applies, and the exemptions article explains how other exemptions can be requested.

What this means for card issuers

Identify which commercial card ranges and products run through dedicated corporate processes, and which are ordinary corporate cards used on public websites.
Make sure the competent authority is satisfied with the security of those processes before applying the exemption.
Configure the ACS and authorisation rules so exempted products are recognised, and ordinary corporate cards are authenticated like consumer cards.
Monitor fraud on exempted products, because the issuer that chose not to apply SCA generally carries the losses.

Outside the EEA and UK

Article 17 is part of the EU and UK SCA framework. In markets without an SCA mandate, such as Australia, commercial cards follow the same authentication and liability rules as other cards under scheme programmes and any local framework, such as AusPayNet’s CNP Fraud Mitigation Framework (multi-jurisdictional 3DS compliance).

Frequently asked questions

Can a merchant apply the secure corporate payment exemption?

No. The EBA has stated that only the payer’s payment service provider, the card issuer, may decide to apply it.

Do corporate cards used by employees online need SCA?

In the EEA and UK, generally yes. A physical corporate card used on a public website does not use a dedicated corporate process, so normal SCA rules apply.

Are virtual cards always exempt from SCA?

No. They can qualify when used within dedicated corporate processes, but only if the issuer applies the exemption and the competent authority is satisfied the security is equivalent.

Does the secure corporate payment exemption apply in Australia?

No. It is part of the EU and UK SCA framework. Australia has no general SCA mandate; authentication follows scheme rules and AusPayNet’s framework.

Who carries fraud liability when the exemption is used?

Generally the issuer, as the party that chose not to apply SCA. Confirm the treatment under each card scheme’s rules.

Configuring authentication for commercial cards

GPayments provides ActiveAccess for issuers and ActiveServer for merchants, PSPs and acquirers. To discuss how commercial card products should be handled in authentication, speak with a GPayments 3DS specialist.