EMV 3-D Secure (3DS) - Payment Authentication Protocol 3.2: 3.2 Out-of-band challenge flow exceptions

In an out-of-band challenge the ACS recognises at the decision step that an OOB interaction is required, initiates it with the cardholder between the first CRes and the cardholder's response instead of interacting through the SDK (for example a push message to the cardholder's banking app, which authenticates and returns the result), the CRes carries only directions for carrying out the OOB step, the ACS is told only that the cardholder may have finished it, and the ACS takes the success result from the OOB interaction rather than the CReq, having it before results messaging; the OOB channel and method are outside the specification.