Last updated: 25 February 2021
Strong Customer Authentication (SCA) requirements officially went into effect on 14 September 2019, and the European Banking Authority mandated that these requirements should be fully enforced by 1 January 2021. In response to this, many countries in Europe have communicated their individual enforcement timelines (see image below*).
Although full SCA enforcement was meant to go into effect for a number of countries on 1 January 2021, requests for two-factor authentication have been limited and at a level far less than expected based on previously published country-level enforcement plans.
Since no updated country plans have been published, SCA enforcement will continue to increase from January 2021 onward. Please note that SCA plans are subject to change — follow this page for updates.
*Switzerland - Stripe’s acquiring bank for Swiss merchants is located in the UK. Because of this, Swiss merchants will need to meet SCA requirements with the same UK full enforcement deadline of 14 September 2021.
Now that the official SCA enforcement date has passed, we recommend preparing your payment flows immediately. This will help prevent an increase in declines as enforcement of these requirements ramps across European banks.
Our new payments APIs and other SCA-ready solutions are designed to take this uncertainty into account. If you are using our SCA-ready solutions, we will only apply authentication and exemptions when they are required by the cardholder's bank—adjusting to each country’s enforcement timeline to minimise friction.
We are closely tracking any change in banks’ behaviour as well as the ongoing regulatory discussions, and we will continue to update this page with the latest information.