Commercial cards cover three quite different uses. An employee may pay for a hotel on a public website with a corporate card. A company may lodge a card with its travel management company, which books and pays on its behalf. Or a booking system may generate a single-use virtual card for each trip. In the EEA and UK, these three uses are treated differently under strong customer authentication (SCA), and the difference decides whether EMV 3D Secure (EMV 3DS) is needed.<\/p>\n
Article 17 of the regulatory technical standards on SCA lets payment service providers not apply SCA to payments initiated by legal persons through dedicated payment processes or protocols that are only available to payers who are not consumers, provided the competent authority is satisfied the security is at least equivalent to what PSD2 requires.<\/p>\n
The European Banking Authority confirmed in Q&A 2018_4060<\/a> that the exemption is not limited to a particular payment instrument, so card payments can qualify. It also stated that only the payer’s payment service provider, which for cards is the issuer, may decide to apply it.<\/p>\n In the UK, the FCA has said that lodged or virtual corporate cards used within access-controlled corporate travel management or purchasing systems would potentially be within scope, while physical corporate cards used by employees on public websites would not, as summarised by Edgar, Dunn & Company<\/a> from the FCA’s Approach Document.<\/p>\nHow each use is treated<\/h2>\n