Strong Customer Authentication (SCA) is the security requirement mandated by PSD2's Regulatory Technical Standards, requiring multi-factor authentication (two of knowledge, possession, and inherence) for electronic payments and account access in the EU and UK. It is the regulatory backbone of the FAPI-grade security stack that open-banking APIs implement, and the reason bank-grade auth is the floor in European open finance rather than a premium tier.
Strong Customer Authentication
Strong Customer Authentication (SCA) is the security requirement that sits under European open banking’s reputation for rigor. Mandated by PSD2’s Regulatory Technical Standards, it requires multi-factor authentication — two independent factors drawn from knowledge, possession, and inherence — for electronic payments and account access, with tightly scoped exemptions.
- Two factors, independent - Something you know, something you have, something you are — at least two, engineered so that compromising one does not compromise the others.
- The reason bank-grade auth is the floor - SCA is why FAPI, OAuth2/OIDC, mutual-TLS, and dynamic client registration show up as the baseline across open-banking APIs, not as a premium option.
- A regulation implemented by standards - SCA is the legal requirement; FAPI and the OBIE security profile are how it is met in machine-readable practice.
SCA is the clearest case in banking of a regulation producing genuine technical rigor. When I score a European or UK bank and find the full FAPI stack — PAR, private_key_jwt, mTLS-bound tokens — that is SCA having forced bank-grade security as the floor. It is the one place the mandate reliably reached past existence to real quality.
Referenced in API Evangelist papers
This regulation shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this regulation in the context of a real sector.
The State of UK Banking APIs
The regulatory requirement behind the FAPI/OIDC/mTLS stack every UK bank documents — bank-grade auth as the mandated floor.
Implemented by these standards
A regulation is the law; a standard is the machine-readable contract that makes it real. These are the technical standards that implement this regulation, catalogued at contracts.apievangelist.com.
FAPI
The financial-grade API security profile that operationalizes SCA in open-banking APIs.
UK Open Banking Standard
The OBIE standard mandates SCA-compliant auth across its Read/Write APIs.
