PSD2 compliance now hinges on stronger authentication and fraud control

At a glance

What this is: PSD2 compliance in 2025 is still driven by Strong Customer Authentication, exemption discipline, and fraud evidence across modern payment flows.

Why it matters: For payment, fraud, and identity teams, the practical issue is controlling authentication consistency across cards, wallets, open banking, and A2A flows while keeping auditability defensible.

Context

PSD2 is a payment security and consent framework, but its operational pressure now comes from the way modern payment journeys fragment across cards, wallets, open banking, and account-to-account transfers. The control gap is rarely the existence of authentication rules themselves, but whether firms can apply them consistently and prove that exemptions, challenge flows, and fraud decisions were justified.

For IAM and fraud practitioners, this is an identity governance problem as much as a payments one. Strong Customer Authentication, dynamic linking, and auditable exemption handling all depend on reliable identity proofing, transaction binding, and controlled exception management. The article’s starting position is typical for 2025: the rules exist, but implementation drift creates the risk.

The article also reflects a wider regulatory pattern in payments security: controls that work in one channel often fail when product teams add wallets, fintech integrations, or mobile-first journeys without re-baselining authentication and evidence capture.

Key questions

Q: What breaks when PSD2 exemptions are used without strong fraud monitoring?

A: Exemptions stop being a friction-reduction tool and become a hidden trust channel. If fraud thresholds, issuer responses, and chargeback outcomes are not reviewed together, an organisation can keep approving high-risk transactions under a policy that no longer matches reality. The result is soft declines, higher fraud exposure, and weak evidence for regulators.

Q: Why do weak SCA flows increase regulatory and fraud risk?

A: Weak SCA breaks the link between user identity, transaction intent, and authorisation. That creates softer approval paths for fraudsters, more soft declines when authentication is missing, and weaker evidence when firms have to justify a payment decision.

Q: What are the signs that payment authentication controls are drifting out of policy?

A: Common signs include rising soft declines, inconsistent challenge rates across channels, exemptions that keep being reused without fresh review, and audit logs that cannot explain why a specific payment bypassed stronger authentication.

Q: How should teams respond when PSD2 controls need to work across cards, wallets, and open banking?

A: They should standardise decisioning around a single control model for authentication, exemption approval, and evidence retention. That reduces channel-by-channel drift and makes it easier to prove that each payment path was governed consistently.

Technical breakdown

Strong Customer Authentication and transaction binding

Strong Customer Authentication, or SCA, requires more than a login step. In PSD2, authentication should combine independent factors such as possession, knowledge, and inherence, and for open banking flows the authentication needs to bind the user to a specific payee and amount. That reduces replay risk and makes payment approval materially different from ordinary account access. In practice, the technical challenge is not just invoking a second factor, but ensuring the factor is tied to the right transaction context across mobile apps, web checkouts, and API-driven payment journeys.

Practical implication: validate that each payment path binds identity to the transaction, not just to the session.

Exemptions, transaction risk analysis, and control drift

PSD2 exemptions are meant to reduce friction, but they also create a governance burden because every exemption is a conditional exception to stronger authentication. Transaction Risk Analysis, low-value thresholds, merchant-initiated payments, and trusted beneficiary flows all rely on fraud performance, scope control, and evidence that the exemption remains justified. The failure mode is control drift: teams keep using an exemption after fraud conditions change, or they cannot show why a particular payment bypassed challenge. That turns a convenience mechanism into a compliance exposure.

Practical implication: tie exemption approval to measurable fraud thresholds and retain evidence for every exception path.

Audit trails and fraud telemetry in regulated payments

PSD2 compliance is as much about proof as protection. Regulators care about whether a firm can show authentication logic, exemption use, challenge outcomes, soft declines, and chargeback behaviour over time. That means payment telemetry has to be preserved in a way that supports investigation, supervision, and dispute resolution. Where organisations fail, the issue is usually not a lack of security signals, but an inability to retain them in a coherent form across gateways, issuers, and internal risk systems.

Practical implication: centralise authentication logs, consent records, and fraud outcomes so compliance and risk teams can reconstruct each payment decision.

Threat narrative

Attacker objective: The objective is to move fraudulent payments through channels where authentication and exemption governance are weak enough to avoid challenge or post-event rejection.

1. Entry begins when attackers target less-protected payment flows such as wallets, open banking journeys, or mobile checkouts where authentication enforcement is inconsistent.
2. Credential or trust abuse follows when synthetic identities, social engineering, or weak wallet binding let fraudulent transactions pass where SCA or dynamic linking is incomplete.
3. Impact occurs when exempted or poorly challenged payments are authorised without enough fraud evidence, creating losses, soft declines, chargeback exposure, and regulatory scrutiny.

Breaches seen in the wild

• Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

PSD2 compliance has become an identity governance problem disguised as a payments issue. The technical standard is not failing because authentication disappeared, but because firms now run multiple payment journeys with different risk postures and inconsistent control enforcement. That creates an identity assurance gap between the user, the transaction, and the approval event. Practitioners should treat authentication consistency as a governance requirement, not a checkout feature.

Exemptions are the clearest example of controlled risk turning into unmanaged drift. Low-value, trusted beneficiary, merchant-initiated, and transaction risk exemptions only work when teams can prove that each exception remains inside policy thresholds. Once exemption logic becomes stale or opaque, the organisation is no longer managing risk by exception, it is normalising bypass. Practitioners should assume every exemption path will be reviewed as a control decision, not a convenience.

Dynamic linking is the named concept that matters most for modern PSD2 control design. It is the point where identity, transaction details, and authorisation must be cryptographically and operationally bound together. Without that linkage, payment approval becomes separable from payment intent, which weakens both fraud prevention and accountability. Practitioners should prioritise transaction binding wherever payment initiation and consent are distributed across apps and APIs.

PSD3 signals that the market is moving from static compliance to measurable fraud governance. Stronger identity verification, tighter SCA management, and real-time monitoring point toward a model where firms must evidence how controls behave in production, not just that the controls exist on paper. For practitioners, that means testing the whole payment path, not isolated controls, because regulators will care about operational consistency.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Dynamic linking has become the practical test of whether PSD2 controls still hold in modern payment architectures. When payment initiation and consent are separated across apps, APIs, and embedded checkout flows, teams need to prove that the authorisation event is still bound to the exact payee and amount. The control issue is not theoretical: if the transaction can be changed after authentication, the protection model is already broken.

Fraud teams should expect regulators to treat exemption governance as a live control, not a policy document. As payment journeys expand into wallets and account-to-account transfers, organisations will be asked to show not only that they used exemptions, but that they monitored the conditions under which the exemptions remained safe. The operational question is whether the payment stack can evidence the decision path end to end.

Identity proofing, authentication, and payment approval are converging into one governance problem. That convergence matters because fraudsters exploit whichever layer is weakest, whether that is onboarding identity assurance, step-up authentication, or challenge logging. For practitioners, the right response is to manage the full path from identity assertion to transaction authorisation, not separate the controls into disconnected teams.

For practitioners

• Harden SCA enforcement across every payment path Map card-not-present, wallet, open banking, and A2A journeys to the exact authentication logic they use, then remove any path that relies on implied rather than enforced SCA.
• Re-baseline exemption governance against current fraud rates Tie each exemption type to a documented fraud threshold, review cadence, and evidence record so the exemption remains defensible when payment behaviour changes.
• Preserve end-to-end audit evidence Store authentication outcomes, consent records, soft-decline events, and challenge results in a single retrievable trail that compliance and fraud teams can reconstruct.
• Test mobile and wallet failure paths Verify that fallback flows, biometric challenges, and issuer error handling still preserve transaction binding and do not silently downgrade authentication strength.

Key takeaways

• PSD2 compliance still depends on coherent authentication and fraud governance across every modern payment journey, not just legacy card flows.
• The real operational risk is control drift, where exemptions, wallets, and mobile journeys outpace the evidence needed to defend them.
• Practitioners should treat transaction binding, exemption review, and auditability as one control chain rather than three separate problems.

Key terms

• Strong Customer Authentication: A regulated authentication requirement that demands more than a single password or code. Under PSD2, it requires at least two factor types and must support the payment context, so the approval is tied to the specific transaction rather than a reusable login event.
• Transaction Risk: Transaction risk is the likelihood that a payment, deposit, withdrawal, or transfer is abusive, compromised, or inconsistent with normal behaviour. It is distinct from login risk because a legitimate session can still produce fraudulent or non-compliant financial activity.
• Dynamic Linking: A transaction integrity control that binds authentication to the payment amount and payee. If either changes, the authentication code is no longer valid, which helps stop substitution attacks and prevents a legitimate approval from being reused for a different transfer.
• Soft Decline: A payment rejection caused by missing or insufficient authentication rather than a permanent card or account problem. Soft declines are operationally useful because they signal where SCA logic is missing or incomplete, and they often expose whether fallback paths are wired correctly.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the NHI Foundation Level course, the industry's only accredited NHI security programme, if you are building governance across identity, access, and credential lifecycles.