Topic starter
11/11/2026 5:56 pm
TL;DR: PSD3 and PSR will push proof of authorization beyond SCA, with transaction-level evidence needed to settle disputes, according to Forter’s survey and analysis. Payment flows will need earlier fraud checks and sharper exemption governance as risk decisions become harder to justify.
Editorial analysis by NHI Mgmt Group, based on content published by Forter: “PSD3 and PSR’s Acquirer Liability Shift: What It Means for Your Authorization Rates”.
Key questions
Q: Why do transaction risk exemptions create liability under PSD3?
A: They create liability because a merchant or payment provider that relies on a transaction risk exemption is asserting that the payment was low risk and could be processed without full authentication.
Q: How should merchants govern payment authentication evidence?
A: Merchants should treat payment authentication evidence as governed records, with controls for capture, retention, integrity and retrieval across checkout, issuer response and fraud review.
Q: Did PSD3 make SCA enough to prove payment authorisation?
A: No. Strong Customer Authentication proves the payer was authenticated, but it does not by itself prove that a specific payment was authorised or that the merchant had valid consent evidence. Payment authorisation still depends on records such as authentication logs, payer device or channel data, and transaction context showing why a payment was approved.
Practitioner guidance
- Separate authentication from authorization evidence Record the transaction signals, decision inputs and risk checks that justify approval, so SCA is only one part of the dispute record.
- Rework exemption governance for TRA decisions Define who can grant exemptions, what evidence is required, how often the policy is reviewed and when exemptions are revoked.
- Validate acquirer and PSP liability assumptions Map which party holds evidence for monitoring, challenge and approval across each payment flow, then close any documentation gaps.
Bottom line: PSD3 and PSR raise the bar from authentication success to defensible payment approval, which changes how dispute evidence is built.
Glossary terms: Acquirer Liability Shift, Strong Customer Authentication, Transaction Risk Analysis (TRA), Merchant-Initiated Transaction
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
PSD3 turns payment authentication into an evidence problem. The central shift is not that identity checks disappear, but that they stop being enough on their own. Payment governance now has to prove the legitimacy of the transaction event, not merely that a customer passed a challenge. For practitioners, that means the control design must move from single-step authentication assurance to defensible transaction evidence.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: What happens when acquirers become liable for weak fraud monitoring?
A: They usually tighten controls, because liability for weak fraud monitoring pushes acquirers to demand better transaction screening, stronger exception handling and clearer evidence of merchant checks. A more conservative posture typically means stricter exemption use, closer review of fraud patterns and faster escalation when monitoring gaps or abnormal payment behaviour appear.
👉 Read our full editorial: PSD3 and PSR make transaction proof harder, not easier