Strong Customer Authentication: Legal Regulation and Implementation Challenges

In recent years, the widespread adoption of digital payment services has made ensuring the security of these transactions an increasingly important issue. In this context, strong customer authentication (hereinafter SCA) plays an important role in enhancing payment security. However, the implementation of SCA raises legal questions concerning the proper identification of authentication elements, the legal assessment of different technological means, the justification of exemptions from SCA and the assessment of transaction risks. The article provides a comparative analysis of the legal and practical aspects of SCA on the basis of the legislation of the Republic of Azerbaijan, the European Union’s Second Payment Services Directive, the relevant Regulatory Technical Standards and the approaches of the European Banking Authority. The study examines the independence of authentication elements, the compliance of means such as card credentials, one-time passwords and biometric data with SCA requirements, as well as the legal grounds for exemptions from SCA. It also considers the identification of low-risk transactions, the monitoring of risk indicators and the role of payment service providers in this process. The analysis finds that there is a need to increase legal certainty in the practical application of the national framework. In this regard, it is proposed to develop more specific criteria and practical guidance for identifying SCA elements, to clarify the conditions for applying exemptions, to improve risk-based monitoring mechanisms and to strengthen the exchange of risk information among payment service providers.