{"id":3272,"date":"2026-10-29T12:14:20","date_gmt":"2026-10-29T02:14:20","guid":{"rendered":"https:\/\/www.gpayments.com\/blog\/?p=3272"},"modified":"2026-10-29T12:14:21","modified_gmt":"2026-10-29T02:14:21","slug":"european-accessibility-act-3ds-challenges","status":"publish","type":"post","link":"https:\/\/www.gpayments.com\/blog\/article\/european-accessibility-act-3ds-challenges\/","title":{"rendered":"What the European Accessibility Act Means for 3DS Challenge Screens"},"content":{"rendered":"\n

The European Accessibility Act has applied to services provided to consumers in the EU since 28 June 2025. It covers consumer banking services and ecommerce services, which means it reaches both ends of an online card payment, and the EMV 3D Secure (EMV 3DS) challenge that sits between them. A cardholder who cannot read, navigate, or complete a challenge screen cannot pay, however accessible the rest of the checkout is.<\/p>\n

How the European Accessibility Act reaches a 3DS challenge<\/h2>\n

The Act, Directive (EU) 2019\/882<\/a>, applies to services provided to consumers after 28 June 2025, including consumer banking services and ecommerce services, as SGS<\/a> summarises. Legal commentary from Lexgo<\/a> notes that consumer banking services include payment services and services related to e-money, and that the Act applies to economic operators whether or not they are established in the EU.<\/p>\n

For these services, the Act sets additional requirements that identification methods, electronic signatures, security, and payment services be perceivable, operable, understandable, and robust, as Bird & Bird<\/a> explains. A 3DS challenge is an identification and security step in a payment service, so it falls within that description.<\/p>\n\n\n\n\n\n\n\n
\n

Part of the challenge<\/strong><\/p>\n<\/td>\n

\n

Who provides it<\/strong><\/p>\n<\/td>\n

\n

Which service under the Act<\/strong><\/p>\n<\/td>\n<\/tr>\n<\/thead>\n

\n

Checkout page and the frame or window the challenge appears in<\/p>\n<\/td>\n

\n

Merchant or its PSP<\/p>\n<\/td>\n

\n

ecommerce service<\/p>\n<\/td>\n<\/tr>\n

\n

Challenge content (HTML) or challenge data for native rendering<\/p>\n<\/td>\n

\n

Issuer, through its Access Control Server (ACS)<\/p>\n<\/td>\n

\n

Consumer banking service<\/p>\n<\/td>\n<\/tr>\n

\n

Out-of-band approval in the banking app<\/p>\n<\/td>\n

\n

Issuer<\/p>\n<\/td>\n

\n

Consumer banking service<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Transitional rules and exemptions<\/h2>\n

Service providers may continue to provide their services using products they lawfully used before 28 June 2025 until 28 June 2030, and service contracts agreed before that date may continue unchanged until they expire, for no longer than five years. Microenterprises providing services are exempt from the service accessibility requirements under the Directive. Each EU member state enforces the Act through national law and its own designated authorities.<\/p>\n

What makes a challenge screen accessible<\/h2>\n

Until EU harmonised standards under the Act are published, many organisations use the Web Content Accessibility Guidelines (WCAG) at level AA, the basis of the existing European standard EN 301 549, as their benchmark. For challenges, the points that most often fail are:<\/p>\n