Strong Customer Authentication (SCA) is the security requirement mandated by PSD2's Regulatory Technical Standards, requiring multi-factor authentication (two of knowledge, possession, and inherence) for electronic payments and account access in the EU and UK. It is the regulatory backbone of the FAPI-grade security stack that open-banking APIs implement, and the reason bank-grade auth is the floor in European open finance rather than a premium tier.
Strong Customer Authentication
Directive European Union / United Kingdom
Strong Customer Authentication (SCA) is the security requirement that sits under European open banking’s reputation for rigor. Mandated by PSD2’s Regulatory Technical Standards, it requires multi-factor authentication — two independent factors drawn from knowledge, possession, and inherence — for electronic payments and account access, with tightly scoped exemptions.
- Two factors, independent - Something you know, something you have, something you are — at least two, engineered so that compromising one does not compromise the others.
- The reason bank-grade auth is the floor - SCA is why FAPI, OAuth2/OIDC, mutual-TLS, and dynamic client registration show up as the baseline across open-banking APIs, not as a premium option.
- A regulation implemented by standards - SCA is the legal requirement; FAPI and the OBIE security profile are how it is met in machine-readable practice.
SCA is the clearest case in banking of a regulation producing genuine technical rigor. When I score a European or UK bank and find the full FAPI stack — PAR, private_key_jwt, mTLS-bound tokens — that is SCA having forced bank-grade security as the floor. It is the one place the mandate reliably reached past existence to real quality.
Implemented by these standards
A regulation is the law; a standard is the machine-readable contract that makes it real. These are the technical standards that implement this regulation, catalogued at standards.apievangelist.com.
FAPI
The financial-grade API security profile that operationalizes SCA in open-banking APIs.
UK Open Banking Standard
The OBIE standard mandates SCA-compliant auth across its Read/Write APIs.
Reaches these HTTP headers
Where a regulation actually touches the wire. Mandated means the law, or a technical standard it makes binding, names this header. Evidentiary means no law names it, but it is the deployed control for an obligation the law does impose. Inferred means it would be good evidence and nothing requires it — interesting to read, never to score.
