Five Markers of a Good PSD2 SCA Strategy

It’s a story of continuing uncertainty, but PSD2 SCA is a reality. PSPs and merchants need a sound strategy to navigate the mandate and develop a plan to serve their customers. In late 2019, the European Banking Authority (EBA) announced a temporary delay in enforcing Strong Customer Authentication (SCA) until 31 December 2020. In the wake of the COVID-19 crisis, the UK further moved its enforcement date to 14 September 2021. But the EBA has not moved the deadline.

There’s good reasoning to request an extension. SCA calls for optimising fraud rates, which has always been a hard problem to solve. With COVID-19 comes unusual online buying behaviour, making it a lot harder to find fraud. It’s a difficult time to build new models.

That said, PSPs and merchants should recognise that sooner or later, PSD2 SCA is a reality. They would do better to cut through the noise and focus on things that matter. It is possible to execute a sound strategy despite the uncertainty.

The Foundation: In-Depth Interviews

Early in 2020, we interviewed 36 PSPs representing over 60% of EU CNP volume and had more detailed follow-up conversations with several of them.

Over 80% of them considered SCA a strategic opportunity for their companies. However, actions speak louder than words; we evaluated their investment in relevant product offerings to assess if they were acting on their intentions.

Four segments emerged from our study:

1. The Leaders are the large companies that are making a strategic push towards differentiated offerings for their customers;
2. The Challengers are the smaller companies that are treating PSD2 SCA as a unique opportunity to gain market share;
3. The Laggards treat SCA as a regulatory duty and will meet the deadline, but they are not doing enough to help their merchants;
4. The Question Marks have an unclear position. They are niche players who are not investing much into SCA.

The Five Markers

We found several consistent patterns that differentiated leaders versus laggards, but we shall not name names. If you are a PSP, you can go through each of the markers and judge where you stand. If you are a merchant, this list should help you ask your payment processor relevant questions.

1. They have a PSD2 SCA Strategy

The biggest differentiator of a leader versus a laggard was the existence of a strategy. The leaders recognised the potential impact of SCA on their customers and designed a coherent set of activities to help their merchants be ready and win.

One litmus test of a strong strategy is the existence and execution of a customer communication plan, keeping customers at top of mind.

2. They have identified execution priorities that impact the customer experience

The leaders recognised the importance of ways to minimise the number of times they require their consumers to go through the high-friction SCA experience. They invested in understanding and staying on top of out-of-scope and exempted transactions.

It included several tactical items. They made efforts to get to the latest version of 3DS2 which gives better customer experience, is the preferred standard for sharing transaction data with issuers, and is required for SCA. They educated their merchants on out-of-scope areas with a lot of nuances, such as Merchant Initiated Transactions (MITs). They continued to be in touch with issuers to understand the challenges around merchant whitelisting.

3. They are building differentiated data and modelling capabilities

The card schemes have historically mandated fraud ranges of close to 1%. To qualify for exemptions, SCA requires you to get fraud rates down to 0.01% to 0.13%. That’s a significant shift, making fraud optimisation strategic for all processors. In parallel, the biggest differentiator for PSPs will be the power of good Transaction Risk Analysis (TRA) models that drive low-risk exemptions.

Thankfully, several top-tier PSPs are building their internal fraud management capabilities, and recognising the importance of having good data. SCA allows them to get rich data across merchants and augment it with third-party data. For example, identity-based risk signals should be a part of your TRA since most major merchants already utilise Ekata’s identity data for optimising the false-positive versus risk trade-off.

The better the TRA models that PSPs are able to implement, the better exemption rates their merchants may be able to get.

4. They recognise the importance of understanding issuer behaviour

Over the last couple of decades, card networks like Visa and Mastercard have shielded most of the acquirer domain from needing to know much about the issuers. That’s changing with SCA since we can expect varying issuer behaviour towards fraud analytics sophistication, 3DS2, exemptions, etc.

Getting an intimate knowledge of each major issuer’s response to input information will help with decisioning such as what data to send to issuers when requesting exemptions. Note that the issuer behaviour will vary a lot not only across issuer size and geography but also change over time as they refine their operations for PSD2. Experimenting with and understanding issuer behaviour is the most reliable way to peek into this ‘black box.’

5. They are building products and offerings to win with the ‘merchants on the margins’

Larger merchants are preparing well and will optimise against several PSPs. Many smaller merchants need hand holding, and these are the ones to serve well.

There are good reasons to focus on small to mid-sized merchants. Online commerce has a long and fat tail of players and several of these merchants will become large merchants as the industry grows. Many of these differentiated offerings such as full liability shifts that are geared towards smaller merchants could win you incremental revenue and market share.

The Role of Leaders

Major structural changes in the industries require a change in strategy. PSD2 SCA is one such industry shift that will decide winners and losers over the next decade. PSPs with entrenched positions, like the Laggards in our study, may sustain themselves for a while despite not responding to this shift, but the cracks will start showing as early as 2021 and they will begin to shed market share.

Meanwhile, the Leaders and Challengers will navigate this uncertainty and gain market share. But more importantly, they will forge the way to much better customer experience.

About Arjun Kakkar

Arjun Kakkar, Vice President - Strategy & Operations, works with Ekata’s operating teams to drive customer value across ecommerce, payments, marketplaces, and online lending verticals. Prior to Ekata, Arjun was a Principal with Booz & Company. Arjun has a B.Tech. from IIT Bombay and an MBA from The Wharton School.

About Ekata

Ekata provides global identity verification via enterprise-grade APIs and a SaaS solution.  Our product suite is powered by Ekata Identity Engine, the first and only cross-border identity engine of its kind.  It uses machine learning algorithms across consumer attributes to derive unique data links from billions of real-time transactions and globally sourced data. Businesses around the world use our solutions to approve more good transactions, reduce friction, and find fraud.