Loading article…
Loading article…
Last updated on Aug 28, 2026
If your Advanced Billing account processes card payments in the European Economic Area, PSD2 compliance affects your checkout flow, your supported gateways, and how failed renewals are handled. Understand which gateways support 3D Secure and what your integration needs to stay compliant.
PSD2 is the European regime. If you process recurring card payments in India, the equivalent requirements come from the Reserve Bank of India rather than PSD2 — see Understand RBI Rules for Recurring Card Payments and e-mandates.
PSD2 is a European Economic Area (EEA) regulation that requires Strong Customer Authentication (SCA) as a means to increase security and authorization rates while decreasing online payment fraud. Only transactions where both the issuing and acquiring banks are in the EEA are affected by PSD2, so this only affects you if your acquiring bank is in the EEA.
SCA must be collected prior to processing a payment by authenticating two of three possible identification traits: something the customer owns, knows, or is.
3D Secure (3DS) has become the most common, globally accepted security protocol that collects and confirms SCA. 3DS was initiated and created by Visa and Mastercard and may be familiar to some merchants through these card networks' brand names such as Visa Secure and Mastercard Identity Check. PSD2 turns 3DS into a requirement instead of a nice-to-have.
A PSD2 transaction follows this general flow:
General guidelines are listed below. See Test and Implement 3D Secure for gateway-specific information.
If you meet the requirements for PSD2, the first step is to reach out to your gateway to enable 3D Secure on your account. When SCA is required, your gateway receives the request and serves 3D Secure challenges that Advanced Billing automatically includes in your checkout experiences; see below for more detail on this.
After you've enabled 3D Secure with your gateway, you may also need to make gateway-specific updates in your Advanced Billing account to authorize Advanced Billing to communicate with your gateway's 3D Secure service. In some cases a separate 3D Secure service is used, so you need to add additional API credentials to give Advanced Billing access to receive and serve these 3D Secure challenges to your customers. Visit your gateway settings page in Advanced Billing to verify that you have included all required credentials to enable 3D Secure.
If you are using Advanced Billing's hosted pages for payments, such as the Public Signup Page, Self-Service Page, and public invoice URLs, no further action is required on your end. These pages have all been updated to handle any SCA requests by default.
Any custom integrations that create Subscriptions, transactions, or credit card payment profiles via API need to be reviewed to ensure they are prepared for 3D Secure.
action_link that Advanced Billing returns when a transaction fails due to requiring SCA.There are two cases in which transactions are created without your customer being present: subscription renewal transactions, and transactions created when you create a new Subscription inside the Advanced Billing UI manually. These transactions are generally exempt from SCA, though the issuing bank may still request it in rare cases. Advanced Billing's dunning system helps save these transactions from failure by automatically sending emails to communicate the reason the transaction failed to your customer, along with a prompt to visit Advanced Billing's Self-Service Page to either authorize the transaction with 3D Secure or enter a new credit card.
Advanced Billing has put in a lot of work to ensure that your transactions are exempted from SCA wherever possible, and to ensure that when SCA is required your gateway's 3D Secure service passes seamlessly through Advanced Billing's checkout experiences to achieve the highest possible success rates for your customers. Below is a list of various workflows that have been modified to account for SCA requests.
Stored Credentials: Renewal transactions are exempted from SCA because no customer is present to authenticate the transaction. To receive this exemption, the transaction must be marked as a "Merchant Initiated Transaction" and must include a prior transaction ID to prove that a prior relationship exists with this customer. In many cases the gateway has automated this process and Advanced Billing simply includes a recurring flag when it submits these transactions to the gateway. However, some gateways do not support stored credentials, and in those cases Advanced Billing submits these transactions as MITs and includes prior transactions to ensure that these transactions remain exempt from SCA.
3D Secure: While renewal transactions should always be exempt from SCA, the issuing bank can choose to ignore this exemption and request SCA whenever they wish. Advanced Billing includes measures to ensure that when SCA is required on renewal transactions, your customers are able to authorize the transaction at their convenience. If a renewal transaction is not successful because SCA is required, the Subscription moves to past due status and dunning kicks off.
When a renewal transaction requires SCA, the transaction fails with a reason code related to SCA being required. The Subscription moves to a past due status and dunning emails are sent to the customer letting them know why the transaction failed and encouraging them to visit Advanced Billing's Self-Service Page to authorize the transaction. We recommend updating your dunning emails to tailor these emails for your customers.
Advanced Billing's Self-Service Pages detect if a renewal transaction is awaiting SCA and include a link to the 3D Secure page to allow the customer to authenticate the transaction rather than enter new credit card information.
When new credit cards are collected using Advanced Billing Self-Service Pages (SSPs), Advanced Billing runs authorizations on the card with 3D Secure that are used as initial transactions to ensure that your later renewal transactions process successfully.
If a prior transaction on the Subscription is awaiting SCA, a link is shown on the SSP so that your customer can authenticate via 3D Secure directly from the Self-Service Page.
If SCA is required when your customer attempts to pay an Advanced Billing invoice, your gateway's 3D Secure challenge page is presented to your customer in a modal, or pop-up, on the page.
When SCA is required while creating Subscriptions using Advanced Billing's Public Signup Pages, 3D Secure challenges are presented to your customer directly in the PSP, and the Subscription is not created unless 3D Secure passes successfully.
When you create Subscriptions in the Advanced Billing UI, these transactions are classified as Mail Order and Telephone Orders (MOTO) whenever possible, since the credit card information is usually collected via telephone, mail, or another similar method. For the most part, SCA should not be required, but the customer's bank may request verification at any time.
If an initial transaction occurs and fails due to SCA, the Subscription is not created. If SCA is required and you prefer to have the customer authorize the transaction via your dunning flow, you can push out the Subscription start date. This approach skips any trial or setup fees on the Subscription's product.
When SCA is required on transactions created via Advanced Billing's API, Advanced Billing returns a response with a redirect link parameter called action_link. Make sure your pages are updated to handle these action_link redirects. Advanced Billing has integrated with the 3D Secure systems of all 3D Secure supported gateways to ensure that these 3DS URLs and tokens are passed seamlessly between Advanced Billing, your gateway, your gateway's 3D Secure service, Visa/Mastercard, and the issuing bank.
Pre-authentication payment gateways such as CyberSource, Windcave (formerly Payment Express), or Adyen require the end-customer to be actively in the session to validate SCA through 3D Secure. Because of this requirement, certain workflows aren't supported because they do not involve the end-customer being in the session.
It is recommended to make use of the Understand Public Pages for new signups, and Understand Self-Service Pages or Understand the Billing Portal for card updates. If you wish to continue using the API or user interface for signups, adjust your flow to sign the end-customer up to a no-cost/free product that doesn't require card collection, collect their card through a Self-Service Page or Billing Portal, and then follow the Change a Subscription's Plan process to charge them for the product.
Still need help?
Reach out and our support team will take it from here.