Strong Customer Authentication: Legal Regulation and Implementation Issues (Baku State University Law Review)

Summary

• The Management Board of the Central Bank of the Republic of Azerbaijan approved the Strong Customer Authentication (SCA) Rule on 13 March 2024 under Decision No. 12/2, applying to payment transactions from January 2026.p.3
• Session inactivity limits requiring re-authentication are fixed at 5 minutes for mobile applications and 30 minutes for internet banking.p.17
• Exemptions allow payment account balance inquiries and transaction history reviews for up to the last 180 days without requiring mandatory SCA.p.18
• Under national rules, contactless payments require SCA when an individual transaction exceeds 100 manat or when daily cumulative volume exceeds 500 manat.p.20
• European Regulatory Technical Standards (RTS) cap contactless payments without SCA at a single transaction maximum of 50 Euro and a cumulative limit of 150 Euro or 5 transactions.p.20
• Remote electronic transactions up to 60 manat are exempt from SCA provided cumulative consecutive transactions do not exceed 5 payments or a total of 300 manat.p.22
• Payment service providers were required to align their transaction monitoring systems with paragraph 4.1 of the SCA Rule by 1 January 2025.p.30

Key insights

1. Strong Customer Authentication (SCA) requires the dynamic combination of at least two independent elements drawn from knowledge, possession, and inherence categories.p.4
2. Card numbers, expiration dates, and static printed CVV codes do not constitute valid SCA elements because their public visibility compromises confidentiality.p.8
3. To preserve element independence on multi-functional devices, European standards mandate isolated execution mechanisms such as a Trusted Execution Environment (TEE).p.15
4. Exemptions for accessing payment account history without SCA require mandatory re-authentication if it is the first remote access or if more than 180 days have passed since the previous SCA.p.18
5. In-branch physical identity verification conducted by bank employees does not qualify as an electronic payment initiation subject to SCA obligations under EBA guidance.p.24
6. Merchant Initiated Transactions (MIT) and payment orders sent via electronic mail fall outside mandatory SCA requirements under EU regulation as they are not directly initiated by the payer at the moment of execution.p.25
7. Azerbaijani regulations enforce the immediate suspension of risk-based exemptions upon exceeding fraud limits, whereas European RTS rules establish a multi-quarter phased warning approach.p.30