SCA comes from the Payment Services Regulations 2017 and has applied since 14 September 2019. The FCA gave firms until 14 March 2022 to apply it in full to online card payments. For remote payments, the check must also be linked to a specific amount and payee. EMVCo, which manages the 3-D Secure standard, says it gives merchants and card issuers a way to support SCA on online card payments.

How it applies in travel

• It applies to online payments by consumers and businesses alike.

• Card payments taken by phone or post are outside it, although the FCA expects payment firms to have other safeguards against fraud.

• A balance the business takes later from a stored card under the customer’s agreement, without the customer having to act, is outside it. Setting up that agreement online needs SCA. A price rise outside the agreement needs a new or amended one.

• Where an online travel agent takes authorisation for a whole itinerary paid to several suppliers, such as an airline and a hotel, the FCA says the authentication must cover the total amount and those payees.

Exemptions

The exemptions include online payments of £25 or less (until a cumulative limit is reached), repeat payments of the same amount to the same payee and secure corporate payment processes. The FCA says the corporate exemption can cover lodged and virtual company cards used in an access-controlled corporate travel management system, but not company cards used on a public website. The card issuer ultimately decides whether to apply an exemption. If a merchant or its card acquirer asks for one and the payment turns out to be fraud, the regulations make them compensate the issuer.

Worth knowing

The government has committed to revoking the SCA provisions in the Payment Services Regulations so that the FCA can replace them with more outcomes-based rules. No date has been set.