Strong Customer Authentication (SCA) Enforcement Date

Last updated: 17 September 2019

Strong Customer Authentication (SCA) requirements officially went into effect on 14 September 2019.

That said, on 21 June 2019, the European Banking Authority published new guidance which allows national regulators to postpone this SCA enforcement date for select banks and payment providers. The following national regulators have issued public statements about the enforcement timeline for online payments with cards issued in their country:

Country Announcement by national regulator
Austria On 19 August 2019, the Austrian regulator announced a temporary enforcement extension for Austrian cards. Although they will not enforce SCA by 14 September, they expect to have additional details on the exact enforcement timeline by late September.
Belgium On 27 August 2019, the Belgian regulator acknowledged the new guidance by the European Banking Authority and shared that they’re working on a phased implementation plan. The length of the delay or any intermediary milestones have not yet been officially confirmed.
Cyprus On 2 September 2019, the Cypriot regulator announced a temporary enforcement extension for Cypriot cards. The length of the delay or any intermediary milestones have not yet been officially confirmed.
Czech Republic On 11 September 2019, the Czech regulator announced a temporary enforcement extension for Czech cards. They expect to have additional details on the exact enforcement timeline from the European Banking Authority later this year.
Denmark On 4 September 2019, the Danish regulator announced an 18-month implementation period for SCA requirements on online card payments. As a result, we don’t expect banks to fully require SCA for online payments from Danish cards until March 2021.
Finland On 5 September 2019, the Finnish regulator announced a temporary enforcement extension for Finnish cards. They expect to have additional details on the exact enforcement timeline and milestones later this year.
France On 11 September 2019, the French regulator announced an 18-month implementation period for SCA requirements on online card payments. As a result, we don’t expect banks to fully require SCA for online payments from French cards until March 2021.
Germany On 21 August 2019, the German regulator announced a temporary enforcement extension for German cards. Although they will not enforce SCA by 14 September, the exact length and scope of the delay has not yet been defined.
Hungary On 10 September 2019, the Hungarian regulator announced a 12-month implementation period for SCA requirements on online card payments. As a result, we don’t expect banks to fully require SCA for online payments from Hungarian cards until September 2020.
Ireland On 8 August 2019, the Irish regulator announced a temporary enforcement extension for Irish cards. Although they don't anticipate a disruption of payments services on 14 September, the exact length and scope of the delay has not yet been defined.
Italy On 1 August 2019, the Italian regulator acknowledged the new guidance by the European Banking Authority and shared that they’re working on a phased implementation plan. The length of the delay or any intermediary milestones have not yet been officially confirmed.
Lithuania On 11 September 2019, the Lithuanian regulator announced a temporary enforcement extension for Lithuanian cards. Banks will need to contact the regulator directly to secure this delay. They expect to have additional guidance on the exact enforcement timeline from the European Banking Authority towards the end of September.
Luxembourg On 30 August 2019, the Luxembourg regulator announced a temporary enforcement extension for Luxembourg cards. Banks will need to contact the regulator directly to secure this delay. They expect to have additional details on the exact enforcement timeline later this year.
Malta On 14 August 2019, the Maltese regulator announced a temporary enforcement extension for Maltese cards. The length of the extension or any intermediary milestones have not yet been officially confirmed.
The Netherlands On 8 August 2019, the Dutch regulator acknowledged the new guidance by the European Banking Authority and shared that they’re working on a phased implementation plan. The length of the delay or any intermediary milestones have not yet been officially confirmed.
Norway On 20 August 2019, the Norwegian regulator announced a temporary enforcement extension for Norwegian cards. Banks will need to contact the regulator directly to secure this delay. The length of the extension or any intermediary milestones have not yet been officially confirmed.
Poland On 19 August 2019, the Polish regulator announced a temporary enforcement extension for Polish cards. Banks will need to contact the regulator directly to secure this delay. The regulator expects to have additional details on the exact enforcement timeline from the European Banking Authority after 14 September.
Slovenia On 6 September 2019, the Slovenian regulator announced a temporary enforcement extension for Slovenian cards. They expect to have additional details on the exact enforcement timeline and milestones later this year.
Spain On 11 September 2019, the Spanish regulator acknowledged the new guidance by the European Banking Authority and shared that they’re working on a phased implementation plan. The length of the delay or any intermediary milestones have not yet been officially confirmed.
Sweden On 4 September 2019, the Swedish regulator acknowledged the new guidance by the European Banking Authority. However, they expect to enforce SCA for online payments with Swedish cards starting 14 September 2019. Banks that require additional time can reach out to the regulator with a proposed migration plan.
UK On 13 August 2019, the UK regulator announced an 18-month phase-in period for SCA requirements on online card payments. As a result, we don't expect banks to fully require SCA for online payments from UK cards until March 2021.

How this impacts your business

To date, few European banks have started enforcing these requirements and declining non-authenticated payments. Nevertheless, we recommend SCA-impacted Stripe users prepare their payment flows to be SCA ready as soon as possible. This will help prevent an increase in declines as enforcement of these requirements ramps across European banks.

Our new payments APIs and other SCA-ready solutions are designed to take this uncertainty into account. If you're using the new solutions, we'll only apply authentication and exemptions when they're required by the cardholder's bank—taking into account each country’s enforcement timeline to minimise friction.

We're closely tracking any change in banks’ behaviour as well as the ongoing regulatory discussions, and we'll continue to update this page with the latest information.