For businesses subject to Strong Customer Authentication (SCA), not every transaction will require the customer to authenticate their payment. Some types of payments qualify for an exemption, though it is important to note that exemptions are not guaranteed. The cardholders’ banks dictate whether an exemption is accepted or not.
Existing subscriptions and saved card information will be grandfathered: information saved to Stripe prior to the enforcement date for SCA will not require additional authorization.
Collected payment methods—either as a token, source or payment_method—saved prior to the SCA enforcement date can be used for off-session payments without requiring additional authentication.
Subscriptions and stored card information created after the enforcement date will require authentication in compliance with SCA regulation.