SCA for recurring payments: when is authentication needed?

Strong Customer Authentication can affect the initial setup and later charges in different ways. Whether a specific recurring transaction requires authentication depends on the transaction, its mandate and the payment providers involved. Use this guide to prepare questions for your provider; it does not decide the outcome for your transactions.

Jurisdiction: European Union (PSD2 payment rules) · Last reviewed: 22 October 2026

This guide is general information, not tax or legal advice. Requirements can vary by transaction and applicable jurisdiction.

Separate the first charge from later charges

The payment that sets up a recurring arrangement and the later charges in that arrangement can follow different authentication paths. The rule text and your provider decide which path applies.

Ask how the mandate is handled

Ask your provider how it records the customer’s consent and mandate, and whether a change in amount, schedule or payment method starts a new series.

Plan for a challenge on a later charge

Authentication may be requested on a later charge. Explain what customers may see and how to complete it, without promising that every renewal will pass without a step.

Review responsibility end to end

Map what your service, payment provider and business each control. For applicability questions, consult current official guidance and qualified payments or legal advice for the relevant jurisdiction.

SCA in 60 seconds

SCA is an authentication requirement. It is not one rule that applies to every recurring charge in the same way.
The first charge and later charges are checked separately. A change to the arrangement can start a new check.
Exemptions and provider behaviour vary. Confirm each case with your provider and the current rule text.

Four situations to check with your provider

Situation	Question for your provider
First purchase	Which authentication does the first payment trigger, and how is the payment method stored for later charges?
Recurring follow-up	Is a later charge in an unchanged arrangement authenticated, exempted, or sent for a challenge?
New mandate or change	Does a change in amount, schedule or payment method start a new authentication step?
Payment failure	What happens to the arrangement, and what does the customer see, if a later charge needs authentication and is not completed?

Check the provider flow

Customer starts or changes an arrangement
The applicable rule and transaction details matter.
Provider evaluates the transaction
The configured payment provider and payer’s provider determine the supported authentication path.
Authentication may be requested
Do not assume every recurring transaction follows the same path or is exempt.
Later transactions follow configured rules
Confirm behavior, exceptions, and customer messaging with your payment provider.

Read the primary rules and interpretation

The rule text and the EBA Q&A are starting points. Confirm current applicability and provider implementation for your transactions.

How Komashi handles the charge

Komashi charges recurring payments through the payment provider you connect. Review that provider’s integration page and documentation before you promise customers a specific authentication experience.

Compare supported payment providers

What to ask your payment provider

How are the first payment, later recurring payments and a changed arrangement handled?
Which authentication steps can customers see, and where does the provider document them?
What happens when authentication is requested on a later payment?
Do your customer messages avoid saying recurring payments are always exempt?

Ready to put this into practice?

Create a service with Komashi.