Strong Customer Authentication (SCA)
Strong Customer Authentication (SCA) is the EU rule, set by the second Payment Services Directive (PSD2), that requires your bank to verify you with at least two independent factors before an electronic payment goes through. The factors come from three categories: something you know, something you have and something you are. For a casino or betting deposit, that usually means approving the payment in your banking app or entering a one-time code. Your bank decides whether to ask, not the operator.
How SCA Works on a Deposit
SCA counts factors, not steps. A password plus a PIN is still one category, so it fails; an app approval on your registered phone plus your fingerprint passes, because possession and biometrics are separate categories.
On a card deposit, the check usually runs through 3D Secure, the card-scheme protocol that hands the payment to your bank mid-checkout. Your banking app pops up, you approve, and the cashier carries on. The authentication code must also be tied to the exact amount and payee, a requirement called dynamic linking, so the figure cannot be altered after you approve it.
There are exemptions, and their limits are fixed in Commission Delegated Regulation (EU) 2018/389. Online payments under €30 can skip the challenge, but SCA returns once exempt payments since your last authentication pass €100 in total, or after five of them in a row. A transaction risk analysis exemption also exists for low-fraud payment providers, with ceilings of €100, €250 or €500 depending on their fraud rate.
Exemptions are requested, never guaranteed.
What SCA Is Often Mistaken For
The usual confusion is with KYC. SCA confirms that you are the person authorising this payment, and your bank runs it. KYC confirms who you are to the operator, and the operator runs it, typically with ID and proof of address before or at withdrawal. Passing one does nothing for the other.
SCA and 3D Secure are not the same thing either: SCA is the legal requirement, while 3D Secure is one way card payments meet it, and open banking transfers meet it through the bank’s own login.
Gambling deposits tend to be challenged more often than ordinary retail payments, because issuers treat them as higher risk and can override an exemption the operator requested. How often you see the prompt varies between banks and operators, and no single pattern applies across the market.
