두 가지 SCA 요소. 원 탭.

Didit is infrastructure for identity and fraud, the platform we wished existed when we were building products ourselves: open, flexible, and developer-friendly, so it works as a real part of your stack instead of a black box you integrate around.

One API covers verifying people (KYC, know your customer), verifying businesses (KYB, know your business), screening crypto wallets (KYT, know your transaction), and monitoring transactions in real time, on a stack built to be:

• Fast, sub-2-second p99 on every session
• Reliable, in production with 1,500+ companies across 220+ countries
• Secure, SOC 2 Type 1, ISO 27001, GDPR-native, and formally attested by Spain's financial regulator as safer than verifying someone in person

The footprint underneath: 14,000+ document types in 48+ languages, 1,000+ data sources, and 200+ fraud signals on every session. The Didit infrastructure dynamically learns from every session and gets better every day.

Strong Customer Authentication (SCA) is a rule from the EU's payment-services regulation that says: when a customer logs in to their account or initiates a payment, you must verify them using at least two of three independent factor categories.

The three categories:

• Knowledge, something only the user knows (password, PIN, secret answer)
• Possession, something only the user has (phone, hardware key, SIM-bound device)
• Inherence, something only the user is (fingerprint, face, behavioural pattern)

The two factors must come from different categories, a password plus a security question is not SCA, because both are knowledge. A password plus a fingerprint is, because they cross categories.

A third requirement, dynamic linking, says the second factor for a payment must be tied uniquely to the transaction amount and payee, so a stolen code cannot be replayed against a different transaction.

PSD3, short for Payment Services Directive 3, is the EU's 2026 rewrite of the rulebook PSD2 introduced in 2018. Alongside it sits the Payment Services Regulation (PSR) which is directly applicable across member states without national transposition.

Key changes over PSD2:

• Fewer exemptions, the corporate-payments and trusted-beneficiary exemptions are tightened
• Phishing-resistant SCA mandated, SMS one-time-password is being phased out as the sole second factor; FIDO2, device-bound biometrics, or app-based push become the new default
• Open-banking access strengthened, banks must offer a clean, unified API; permissioned third-party providers get better technical terms
• Fraud-liability clarified, payment service providers (PSPs) carry more of the fraud loss when their SCA was weak
• Wider scope, wallet providers, electronic-money institutions (EMIs), and some crypto providers come into the regime

Transition is rolling, most SCA changes are expected to take effect 18 to 24 months after final adoption.

The full flow normally takes under 30 seconds end-to-end, pick up the ID, snap the document, snap the selfie, done. That is the fastest in the market. Legacy KYC providers usually take more than 90 seconds for the same flow.

On the back end, Didit returns the result in under two seconds at p99, measured from the moment the user finishes the selfie to the moment your webhook fires. Mobile capture is tuned for slow phones and slow networks: progressive image compression, lazy software development kit load, and a one-tap hand-off from desktop to phone via QR code if the user starts on web.

Need SCA by default:

• Customer login to a payment account
• Initiating an electronic payment
• Any action that could be exploited to commit payment fraud

Exempt (PSD3 keeps most PSD2 exemptions but tightens the thresholds):

• Low-value remote transactions, under €30 single, with cumulative caps per customer
• Contactless point-of-sale payments, under €50 single, with cumulative caps
• Recurring transactions of identical amount and payee, SCA on first, exempt after
• Trusted beneficiaries, user explicitly whitelists, but PSD3 tightens approval flow
• Transaction Risk Analysis (TRA), under thresholds linked to your overall fraud rate (1, 5, 10, 25 basis points)
• Corporate dedicated channels, when both ends are corporate users on a closed system

Getting the exemption math right is the highest-leverage SCA optimisation work most teams do, applied well it drops auth friction without raising fraud.

Every session lands on one of seven clear statuses, so your code always knows what to do:

• Approved, every check passed. Move the user forward.
• Declined, one or more checks failed. You can allow the user to resubmit the specific failed step (for example, re-take the selfie) without re-running the whole flow.
• In Review, flagged for compliance review. Open the case in the console, see every signal, decide approve or decline.
• In Progress, user is mid-flow.
• Not Started, link sent, user has not opened it yet. Send a reminder if it sits too long.
• Abandoned, user opened the link but did not finish in time. Re-engage or expire.
• Expired, the session link aged out. Create a new session.

A signed webhook fires on every status change, so your database always stays in sync. Abandoned and declined sessions are free.

Production data is processed and stored in the European Union by default, on Amazon Web Services. Enterprise contracts can request alternative regions for jurisdictions whose regulators require it.

Encryption everywhere. AES-256 at rest across every database, object store, and backup. Transport Layer Security 1.3 in transit on every API call, webhook, and Business Console session. Biometric data is encrypted under a separate Customer Master Key.

Retention is yours to control. Default retention is indefinite (unlimited) unless you configure shorter, between 30 days and 10 years per application, and you can delete any individual session at any time from the dashboard or the API.

Certifications: SOC 2 Type 1 (Type 2 audit in progress), ISO/IEC 27001:2022, iBeta Level 1 PAD, and a public attestation from Spain''s Tesoro / SEPBLAC / CNMV that Didit''s remote identity verification is safer than verifying someone in person. Full report at /security-compliance.

Didit ships compliant by default for the regulators that matter to identity infrastructure:

• GDPR + UK GDPR, controller / processor split, full Data Processing Agreement published, lead supervisory authority named (Spain''s AEPD).
• AMLD6 + EU AML Single Rulebook, 1,300+ sanctions, politically exposed person, and adverse-media lists screened in real time.
• eIDAS 2.0, EU Digital Identity Wallet aligned; reusable-identity ready.
• MiCA (Markets in Crypto-Assets), ready for crypto on-ramps, exchanges, and custodians.
• DORA, Digital Operational Resilience Act, EU financial-services operational resilience.
• BIPA, CUBI, Washington HB 1493, CCPA / CPRA, US biometric privacy (Illinois, Texas, Washington) and California consumer privacy.
• UK Online Safety Act, age-gating and child-safety obligations.
• FATF Travel Rule, originator and beneficiary data on crypto transfers, IVMS-101 interoperable.

Detailed memo, every certificate, every regulator letter: /security-compliance.

• 60 seconds to a sandbox account at business.didit.me, no credit card.
• 5 minutes to a working verification through Claude Code, Cursor, or any coding agent via our Model Context Protocol (MCP) server.
• A weekend to a production-ready integration with signed-webhook verification, retries, and a remediation flow when a user is declined.

Three integration paths, pick whichever fits your stack:

• Embed natively with our Web, iOS, Android, React Native, or Flutter SDK.
• Redirect the user to the hosted verification page, zero SDK.
• Send a link by email, SMS, WhatsApp, or any channel, zero front-end work.

Same dashboard, same billing, same pay-per-success price for all three. Step-by-step guide at docs.didit.me/integration/integration-prompt.

Same POST /v3/session/ API on every surface, the user-facing capture differs:

• Web (desktop browser), Didit launches the auth flow in a popup; the user's phone receives a push notification, completes the biometric on the phone, and the popup closes with the approved verdict. Universal-link handoff if the user is on mobile web.
• Native iOS / Android, drop in the Didit iOS or Android SDK, call the auth method, the OS-native biometric prompt appears (Face ID, Touch ID, fingerprint) backed by the secure enclave
• React Native / Flutter / Cordova, official SDKs wrap the native modules; identical API surface
• MCP server, if the auth lives behind an AI agent, the agent calls the auth tool, the user receives a push on their phone, approves, and the verdict returns

The same biometric template the user enrolled at KYC time backs every auth, no re-enrolment, no separate flow.

Yes, the same auth bundle satisfies most equivalent global rules:

• United Kingdom, the FCA's Strong Customer Authentication rules mirror PSD2/PSD3 in substance; Didit's auth bundle qualifies
• United States, no nationwide SCA mandate, but bank regulators (OCC, Federal Reserve) and the Federal Financial Institutions Examination Council (FFIEC) recommend multi-factor authentication for high-value transactions; Didit drops in
• Singapore, Monetary Authority of Singapore (MAS) Notice 644 mandates SCA on Internet banking
• India, Reserve Bank of India two-factor authentication is mandatory on every domestic card transaction
• Brazil, Banco Central rules align with PSD2-style SCA on instant payments
• Australia, Japan, South Korea, equivalent multi-factor authentication requirements for banking and high-value e-commerce

One API, one auth bundle, every jurisdiction. The exemption math changes; the technical contract does not.

Every authentication produces a signed evidence record exportable from the Business Console:

• The auth challenge, timestamp, session ID, requested factors
• The biometric verdict, Passive Liveness pass/fail, Face Match similarity score (linked to the user's KYC reference selfie), iBeta Level 1 anti-spoof claim
• The device verdict, device fingerprint, IP geolocation, VPN/proxy/datacenter flags, 200+ fraud-signal score
• The dynamic-linking payload, amount, payee, timestamp, signed end-to-end
• The full audit trail, every step state-machined from Pending to Approved or Declined, with reviewer notes if escalated
• HMAC SHA-256 signature on the payload so chain-of-custody is provable

All records stored in the European Union (EU data centres), retained indefinitely while your subscription is active. Default record retention is 5 years per the EU AML and payments rules, extensible per your supervisor's guidance.