The European Accessibility Act and 3DS Challenges

The European Accessibility Act has applied to services provided to consumers in the EU since 28 June 2025. It covers consumer banking services and ecommerce services, which means it reaches both ends of an online card payment, and the EMV 3D Secure (EMV 3DS) challenge that sits between them. A cardholder who cannot read, navigate, or complete a challenge screen cannot pay, however accessible the rest of the checkout is.

How the European Accessibility Act reaches a 3DS challenge

The Act, Directive (EU) 2019/882, applies to services provided to consumers after 28 June 2025, including consumer banking services and ecommerce services, as SGS summarises. Legal commentary from Lexgo notes that consumer banking services include payment services and services related to e-money, and that the Act applies to economic operators whether or not they are established in the EU.

For these services, the Act sets additional requirements that identification methods, electronic signatures, security, and payment services be perceivable, operable, understandable, and robust, as Bird & Bird explains. A 3DS challenge is an identification and security step in a payment service, so it falls within that description.

Part of the challenge	Who provides it	Which service under the Act
Checkout page and the frame or window the challenge appears in	Merchant or its PSP	ecommerce service
Challenge content (HTML) or challenge data for native rendering	Issuer, through its Access Control Server (ACS)	Consumer banking service
Out-of-band approval in the banking app	Issuer	Consumer banking service

Transitional rules and exemptions

Service providers may continue to provide their services using products they lawfully used before 28 June 2025 until 28 June 2030, and service contracts agreed before that date may continue unchanged until they expire, for no longer than five years. Microenterprises providing services are exempt from the service accessibility requirements under the Directive. Each EU member state enforces the Act through national law and its own designated authorities.

What makes a challenge screen accessible

Until EU harmonised standards under the Act are published, many organisations use the Web Content Accessibility Guidelines (WCAG) at level AA, the basis of the existing European standard EN 301 549, as their benchmark. For challenges, the points that most often fail are:

Time limits on entering a one-time passcode with no way to extend them.
Challenge frames without a meaningful title or accessible labels, so screen readers announce nothing useful.
Keyboard focus that does not move into the challenge when it opens, or that cannot leave it.
Instructions conveyed only by colour, images, or brand graphics.
Challenge windows sized for desktop that hide content or controls on small screens (iframe requirements).
Out-of-band approval screens in banking apps that do not support screen readers or larger text.

In app-based flows using native rendering, the 3DS SDK draws the challenge with the device’s own controls, so operating-system accessibility features apply more naturally. In HTML challenges, the ACS controls the markup (how an ACS renders challenges).

What issuers and merchants should do

Issuers should test their ACS challenge content and out-of-band approval flows with assistive technologies, offer at least one challenge method that suits cardholders who cannot use another, and allow time extensions on passcode entry. Merchants and PSPs should check that the challenge container in their checkout is labelled, receives focus, and works at small screen sizes. Because the challenge combines both, issuers and merchants each need to test their part with the other’s in place.

Frequently asked questions

Does the European Accessibility Act apply to 3D Secure?

The Act does not name 3D Secure, but it covers consumer banking and ecommerce services, including their identification, security, and payment functions. A 3DS challenge is part of those functions.

Who is responsible for an accessible challenge screen?

Responsibility follows who provides each part. The issuer provides the challenge content and any app approval; the merchant provides the checkout that hosts it.

Are small merchants exempt?

Microenterprises providing services are exempt from the service accessibility requirements. Larger merchants and all issuers in scope are not.

When do existing systems have to comply?

New services provided after 28 June 2025 must comply. Products already lawfully in use before that date may continue to be used until 28 June 2030.

Does the Act apply to non-EU businesses?

It applies to economic operators providing in-scope services to consumers in the EU, whether or not they are established there.

Making challenges accessible

GPayments provides ActiveAccess for issuers and ActiveServer for acquirers, PSPs and merchants. To discuss accessibility in your authentication flows, contact GPayments.