What are the PSD2 Country specific information?

On this page you will find:

The 'Latest PSD2 migrations': where you can see the most up to date breakdown of the countries that have started to enforce PSD2
A country-by-country list of migration plans and implementation dates for PSD2, as presented by the country's National Competent Authority (NCA).

Given that individual issuers might deviate from their NCA's advice, we strongly recommend to process SCA-compliant transactions from 1 January 2021, irrespective of national ramp-up plans.

Country

Latest PSD2 migrations

Austria

Since 14 January we are seeing soft declines on a very small percentage of transactions returned for non-authenticated transactions above 250 EUR.
Some issuers are also applying soft declines to transactions with amounts above zero, but still to a very small extent.
On 16 March many Austrian issuers increased their soft decline policy to transactions of all amounts.

Belgium

For some weeks Belgian issuers have been soft declining a very low count of non-authenticated transactions for any amount.
Since 23 March they started increasing this behaviour on transactions above 250 EUR.
Since 19 April Belgian issuers started soft declining large part of in-scope non-authentication payments above 100 EUR.
From 18 May onwards this was extended to part of transactions under 100 EUR as well.

Bulgaria

Several issuers in Bulgaria started using soft declines already in the last several weeks of 2020 and continued to do so without a visible increase until 3 May when they increased this to roughly 1% of non-authenticated transactions in scope for PSD2.

Cyprus

Since the beginning of 2021 a small percentage (less than 1%) of transactions are declined to require authentication. This has not significantly changed over time.

Denmark

As of Monday 11th January, we are seeing PSD2 widespread enforcement from multiple Issuing Banks in Denmark.
On Friday 15 January one issuer that reverted soft declines earlier in the week, started enforcing PSD2 compliance again.
In February all issuing banks continue to enforce PSD2, including soft declines, on all transaction types that are in scope for the regulation.

Finland

As of January 12th we are seeing PSD2 enforcement in Finland primarily from one Issuing Bank.
On the 10th of February additional issuers also started using the soft decline codes. During March and April this remained the same.

France

In accordance with the migration plan we are seeing soft declines being applied to non-authenticated transactions above 250 EUR since 15 March.
Per 19 April, a bit later than announced, there was a significant increase in Authentication Required refusals on transactions above 100 EUR.
Since Saturday 16 May an increase is visible in PSD2 enforcement on transactions under 100 EUR. On Monday 18 May additional issuers started showing the same behavior.

Germany

Since 14 January we are seeing Soft Declines on a very small percentage (<1%) of transactions returned for non-authenticated transactions above 250 EUR.
Per the 15th of February German issuers increased the use of soft declines on all transaction values. The overall percentage remains low.
On 15 March we saw an increase (to >5%) in usage of soft declines on non-authenticated transactions between 0 and 30 EUR.

Greece

Since 1 April 2021 Greek issuers started soft declining payments over 30 EUR. They apply this to roughly 10-20% of non-authenticated transactions.

Hungary

Although expected to migrate on the 30th of December, the first increase in declines was visible just after midnight on the 31st of December. This happens for one issuer only, who is not using the soft decline codes. Per the morning of 5 January they started using the soft decline codes.
Since 28 January there is at least one issuer that specifically requires 3DS2 authenticated transactions and soft declines 3DS1 authenticated transactions.

Greece

Since 1 April 2021 Greek issuers started soft declining payments over 30 EUR. They apply this to roughly 10-20% of non-authenticated transactions.

Italy

Since the beginning of 2021 Italian issuers started responding with soft declines on a small percentage of high value (>500 EUR) transactions. As of 28 February there were soft declines visible for the first time on transactions of 100 EUR and above which they increased on 1 March to around 5% of transactions above that amount threshold. This seemed to be further increased on 20 April.
In May, Italian issuers started applying the same logic to transactions of all amounts.

Ireland

Since the beginning of March issuers are requesting authentication for transactions above €500. In April this remains the same and is applied to over half of those transactions.

Latvia

As of January 18th, we are seeing PSD2 enforcement in Latvia, largely from one Issuing Bank.

Lithuania

Since January issuers in Lithuania are applying PSD compliance rules to a subset of transactions above 250 EUR.
They started including transactions from 100 EUR and above per 1 March. The SCA requirement now applies to above 20% of transactions above that amount.
On 26 April soft declines went up for Lithuanian Visa cards, applied to all transactions above 30 EUR.

Malta

Soft declines rates remain minimal up to May.

Netherlands

Some issuers in the Netherlands have started applying soft declines on non-authenticated transactions above 250 EUR per 5 January and subscription 0 EUR sign ups as of January 6th.
Per the second week of February issuers also started applying soft declines on part of transactions above 75 EUR.
Since 2 March we are seeing an increase in soft declines in transactions in the range from 30 to 75 EUR.
On 16 March issuers started applying PSD2 compliance to transactions under 30 EUR as well.

Norway

In Norway all issuers migrated to PSD2 logic on December 28th, but they reverted after a couple of hours. Since then, we are seeing Soft Declines on a small percentage of transactions returned for non-authenticated transactions.
Throughout January issuers have increased the PSD2 requirement on all transaction amounts and this remains stable throughout February.

Poland

We are seeing Soft Declines on a small percentage of transactions returned for non-authenticated transactions.
In April this applies to 1-3% of transactions of all amounts.

Portugal

Soft declines rates remain minimal up to May.

Slovakia

In April the soft decline rate is under 1% of transactions.

Slovenia

Soft declines rates remain minimal up to May.

Spain

Since 1 February Spanish issuers have started soft declining non-authenticated transactions above 30 EUR. This, for now, happens on a subset of payments across issuers.
This behavior was largely reverted on the second of February and then reinstated on the 8th of February. This remains stable through March and April and there are soft declines on around 5% of in-scope transactions.
On 30 April Spain significantly increased soft declines on non-authenticated transactions between 0 and 30 EUR.

Sweden

We are seeing Soft Declines on a small percentage of transactions returned for non-authenticated transactions, largely from one Issuing bank.
During the week of the 15th of February Swedish issuers increased the use of soft declines on all transaction values. The overall percentage remains low.

United Kingdom

There have been a minimal amount of soft declines over the course of 2021 already. On 1 June 2021, in line with the migration plan, a small increase was visible in PSD2 compliant behavior on all transaction values.

Countries with confirmed delay in enforcement

Austria

The FMA (Finance Market regulator) has announced an extension for all payment methods. The FMA extended the deadline for implementation of SCA until 31 December 2020.

In the third week of December FMA presented a migration plan to their issuers which is as follows:

Starting 15 January: SCA enforcement on transactions above 250 EUR
Starting 15 February: SCA enforcement on transactions above 150 EUR
Starting 15 March: SCA enforcement on all transactions

Not all issuers have confirmed they will follow this plan.

Belgium

The NBB (National Bank of Belgium) previously announced that while the deadline of 14 September is still valid, enforcement will be delayed until a sensible migration plan is finalized and agreed upon. They agreed on a new migration plan on 7 October 2020: they agreed to review the > EUR 1,500 soft-decline testing on 15 November 2020 and have planned further decreasing this threshold to EUR 500 on 18 January, 100 EUR on 23 February and EUR 0 on 23 March 2021.

Starting 19 January: SCA enforcement on transactions above 1500 EUR
Starting 23 February: SCA enforcement on transactions above 500 EUR
Starting 23 March: SCA enforcement on transactions above 250 EUR
Starting 19 April: SCA enforcement on transactions above 100 EUR
Starting 18 May: SCA enforcement on all transactions

We are currently (half October) seeing soft declines being applied above EUR 1,500.

Cyprus
The CBC (Central Bank of Cyprus) announced that they do not intend to take supervisory enforcement action against licensed institutions which have not implemented SCA in remote electronic card transactions by 31 December 2020, provided that these institutions have submitted a migration plan to the Central Bank of Cyprus.

This follows a previous announcement that regulated entities which currently support a non-reusable and non-replicable element for online card transactions, will be granted a limited migration period for the purpose of adequate preparation for the introduction of SCA in remote electronic card transactions.

Denmark
The FinantilSysNet (Financial Regulator) has announced an 18-month delay. The Danish FSA will now, together with all card issuers in Denmark, translate the implementation plans that have been discussed with the players in the market into concrete, operational milestones for how the players will ensure compliance with the rules by 11 January 2021. This after having announced previously that no delay would take place.

Finland
The FIN-FSA has announced a delay in enforcement. They will adhere to the 31 December 2020 deadline proposed in the EBA opinion and the supervisory measures described therein.

In Finland soft declines are being applied to a small extent on both customer initiated transactions (without SCA) and merchant initiated transactions without a networkTxReference already.

France
The BF (Bank of France) has announced that a migration plan will be pending. The timeline announced covers 18 months. Additionally, non 2FA authentication solutions will be progressively forbidden for a 'large majority' of customers before December 2020. In March 2021 all merchants should connect to the new 3DS infrastructure.

On 28th of October 2019 France published a press release stating that the final deadline will be 31st of December 2020 both for authentication solutions for consumers as well as for merchant to connect to the new 3DS infrastructure.

The Observatoire de la sécurité des Moyens de Paiement published the French SCA migration plan which states that the final deadline for SCA enforcement is 31 March 2021.

On 22nd of September 2020, The BF (Bank of France) has announced a ramp-up plan for soft-decline of non-compliant transactions. The plan covers the period from October 2020 to March 2021.

Latest information (beginning of December) is that the migration plan is the following:

From September to December 2020: non-3D Secure transactions of more than EUR 2.000
per 5 January 2021 non-secure transaction of 1000 EUR and above
per February 2021 non-secure transaction of 500 EUR and above

Half February this plan was finalized with:

per 15 March 2021 non-secure transaction of 250 EUR and above
per 15 April 2021 non-secure transaction of 100 EUR and above
per 15 May 2021 on all non-secure transactions

During migrations, no soft-declines will be applied for non compliance with PSD2 for the following MCCs:

Germany
BaFin (Federal Financial supervisory authority) has announced a delay in enforcement for PSD2. This statement was followed by a press release) stating that they will not enforce SCA until the 31 December 2020 provided certain milestones are met.

In the beginning of December BaFin presented a migration plan to their issuers which is as follows:

Starting 15 January: SCA enforcement on transactions above 250 EUR
Starting 15 February: SCA enforcement on transactions above 150 EUR
Starting 15 March: SCA enforcement on all transactions

Not all issuers have confirmed they will follow this plan.

Greece
Bank of Greece has announced a a delay in enforcement for SCA until 31 December 2020

Hungary
MNB (Bank of Hungary) has announced a 12-months extension plan for SCA migration. The timeline covers 12 months starting from the 14th of September 2019, and more details will follow.

Ireland
The Central Bank of Ireland has announced a delay in enforcement for all payment methods during a limited migration period. The current migration plan is as follows:

1st January to 28th February 2021: SCA for all securely presented transactions >€500
1st March to 31st March 2021: SCA for all securely presented transactions >€250 and all direct to authorisation transactions are soft declined >€750
1st April to 30th April: SCA for all securely presented transactions as necessary i.e. no value threshold all direct to authorisation transactions are soft declined >€500
1st May to 31st May 2021: SCA for all securely presented transactions as necessary i.e. no value threshold and all direct to authorisation transactions are soft declined >€250
1st June – 30th June 2021: SCA for all securely presented transactions as necessary i.e. no value threshold and direct to authorisation transactions are soft declined >€150.

Italy
Banca d'Italia (Bank of Italy) has announced a migration period. It recommends parties that want to use such migration period to present a detailed migration plan. The deadline for the migration period is 31 December 2020.

Starting 1 January: SCA enforcement on transactions above 1000 EUR
Starting 1 February: SCA enforcement on transactions above 500 EUR
Starting 1 March: SCA enforcement on transactions above 100 EUR

Lithuania
Lietuvos Bankas (Bank of Lithuania) has announced a migration period. It recommends parties that want to use such a migration period to present a detailed migration plan. No specific timeline was announced.

Luxembourg
The CSSF (Surveillance Commission of the Finance Sector) has announced an extension of the implementation period for SCA for all payment methods. They mention an interest in harmonization of the migration plan with the EBA and requires parties that want to make use of the additional period to submit a detailed migration plan. In December 2019 the CSSF announced that PSPs should be compliant with SCA on 31 December 2020.

Malta
The Central Bank of Malta has announced an extension of the SCA enforcement period after 14th of September. In October 2019 they announced that the SCA provision will come into force on 31 December 2020.

Netherlands
The DNB (Dutch Bank) has announced an extension of the SCA enforcement period after 14th of September. DNB encourages market parties to cooperate in order to ensure that the phased introduction of SCA proceeds in an orderly fashion and that it is completed on 31 December 2020.

Starting 1 October 2020 issuers will gradually soft-decline non-authenticated transactions, starting with amounts larger than EUR 250 down to EUR 30.

Merchants should make sure their implementation or their service provider is ready to support the new, mandatory transaction flows that include 3DS authentication. Failing to implement and test the new transaction flows may impact merchants’ conversion from this date.

Norway
The Finanstilsynet (Financial Supervisory Authority) has announced an extension of the SCA enforcement period. Parties wishing to make use of this extension would need to reach out to the Finanstilsynet. The Supervisory Authority allows for a migration period until 31 December 2020.

Poland
The KNF (Financial Supervisory Authority) has announced an extension of the SCA enforcement period. Parties wishing to make use of this extension would need to reach out before 14 september. No specific timeline was announced.

Portugal
On 17th October 2019 Banco de Portugal announced that the deadline for banks/PSPs to fully apply the strong customer authentication requirements in e-commerce card-based payment transactions is 31 December 2020.

Slovenia
Banka Slovenije (Bank of Slovenia) has announced an extension of the SCA enforcement period. In November the Bank of Slovenia announced a transition period that lasts until 31 December 2020.

Spain
The BdS (Bank of Spain) has announced an extension of the SCA enforcement period. The Spanish SCA migration plan described the phased roll-out of SCA and the roll-out deadline of 31 December 2020.

End December 2020 a new migration plan was published:

Starting 1 January: SCA enforcement on transactions above 250 EUR
Starting 1 February: SCA enforcement on transactions above 30 EUR
Starting 1 March: SCA enforcement on all transactions

The plan includes a statement that exemptions can be applied. Final acceptance will still be up to issuers.

Sweden
Parties can request an extension, but the supervisory body will otherwise enforce the regulation. It is currently not known which banks have filed for an extension.

We are seeing that some issuers are already applying soft declines.

United Kingdom
The FCA (Financial Conduct Authority) has announced an 18-months extension plan for SCA migration. The timeline covers 18 months starting from the 14th of September 2019, and more details will follow.

On January 28th 2020 the UK Financial Conduct Authority (FCA) published the enforcement date for the UK market. The new enforcement date was 14 March 2021 in the UK

On 30 April 2020 the FCA announced an additional 6 months delay for SCA enforcement due to the exceptional circumstances of the COVID crisis. The new deadline will shift from 14 March 2021 to 14 September 2021.

Then on 20 May 2021 the FCA further delayed the final implementation date until 14 March 2022. However from the 1st June 2021 as planned, transactions will start being randomly checked by issuers to identify whether they are SCA compliant and soft-declined if they're not.

Countries with no clear position

Although the following countries have not publicly commented on SCA migration deadlines, it is expected they will follow the EBA deadline of 31 December 2020: