Topic starter
12/07/2026 12:22 pm
TL;DR: PSD2 still requires Strong Customer Authentication for nearly all remote and electronic payments, while UK firms continue to face FCA scrutiny over fraud detection, exemption use, and audit trails, according to Sift. As payment flows shift toward wallets, open banking, and account-to-account payments, the governance problem is no longer just compliance, but control consistency across channels.
Editorial analysis by NHI Mgmt Group, based on content published by Sift: “PSD2 Compliance: A Checklist to Secure Payments and Fraud Prevention”.
Key questions
Q: What breaks when PSD2 exemptions are used without strong fraud monitoring?
A: Exemptions stop being a friction-reduction tool and become a hidden trust channel.
Q: Why do weak SCA flows increase regulatory and fraud risk?
A: Weak SCA breaks the link between user identity, transaction intent, and authorisation.
Q: What are the signs that payment authentication controls are drifting out of policy?
A: Common signs include rising soft declines, inconsistent challenge rates across channels, exemptions that keep being reused without fresh review, and audit logs that cannot explain why a specific payment bypassed stronger authentication.
Practitioner guidance
- Harden SCA enforcement across every payment path Map card-not-present, wallet, open banking, and A2A journeys to the exact authentication logic they use, then remove any path that relies on implied rather than enforced SCA.
- Re-baseline exemption governance against current fraud rates Tie each exemption type to a documented fraud threshold, review cadence, and evidence record so the exemption remains defensible when payment behaviour changes.
- Preserve end-to-end audit evidence Store authentication outcomes, consent records, soft-decline events, and challenge results in a single retrievable trail that compliance and fraud teams can reconstruct.
Bottom line: PSD2 compliance still depends on coherent authentication and fraud governance across every modern payment journey, not just legacy card flows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:35 pm
PSD2 compliance has become an identity governance problem disguised as a payments issue. The technical standard is not failing because authentication disappeared, but because firms now run multiple payment journeys with different risk postures and inconsistent control enforcement. That creates an identity assurance gap between the user, the transaction, and the approval event. Practitioners should treat authentication consistency as a governance requirement, not a checkout feature.
A few things that frame the scale:
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
A question worth separating out:
Q: How should teams respond when PSD2 controls need to work across cards, wallets, and open banking?
A: They should standardise decisioning around a single control model for authentication, exemption approval, and evidence retention. That reduces channel-by-channel drift and makes it easier to prove that each payment path was governed consistently.
👉 Read our full editorial: PSD2 compliance now hinges on stronger authentication and fraud control