EMV 3‑D Secure (3DS) - Payment Authentication Protocol
EMVCo EMV 3-D Secure (3DS), the messaging protocol that enables consumer authentication for card-not-present e-commerce transactions (the basis of Visa Secure, Mastercard Identity Check, etc.). 3DS uses a three-domain model (Acquirer, Issuer, Interoperability domains) and the roles 3DS Requestor, 3DS Server, Directory Server (DS), Access Control Server (ACS) and 3DS SDK, exchanging Authentication (AReq/ARes), Challenge (CReq/CRes) and Results (RReq/RRes) messages to support frictionless (risk-based) and challenge (step-up) authentication across browser and app channels. The full EMV 3DS Protocol and Core Functions Specification and SDK Specification are copyrighted EMVCo material available under EMVCo registration/licence; this node represents the publicly documented protocol architecture, not the gated normative text.
EMV 3‑D Secure (3DS) - Payment Authentication Protocol is a compliance framework from International (EMVCo - standards consortium) with 6 domains and 22 controls that map to 3 other frameworks. The largest domains are EMV 3DS - Three-Domain Model and Roles (6 controls), EMV 3DS - Authentication Flows (4 controls), EMV 3DS - Authentication Messages (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
EMV 3DS - Authentication Flows
EMV 3DS - Authentication Messages
| Code | Title |
|---|---|
| EMV3DS-07 | Authentication Request and Response (AReq/ARes) |
| EMV3DS-08 | Challenge Request and Response (CReq/CRes) |
| EMV3DS-09 | Results Request and Response (RReq/RRes) |
| EMV3DS-10 | Message integrity and protocol versioning |
EMV 3DS - Channels and Device Data
EMV 3DS - Risk-Based Authentication and SCA
EMV 3DS - Security and Conformance
EMV 3DS - Three-Domain Model and Roles
| Code | Title |
|---|---|
| EMV3DS-01 | Three-domain model |
| EMV3DS-02 | 3DS Requestor and 3DS Client |
| EMV3DS-03 | 3DS Server (Acquirer Domain) |
| EMV3DS-04 | Directory Server (Interoperability Domain) |
| EMV3DS-05 | Access Control Server (Issuer Domain) |
| EMV3DS-06 | 3DS SDK |
Your Compliance Coverage
If you comply with EMV 3‑D Secure (3DS) - Payment Authentication Protocol, you already cover:
Maps to 3 other frameworks
What is EMV 3‑D Secure (3DS) - Payment Authentication Protocol and who does it apply to?
EMV 3‑D Secure (3DS) - Payment Authentication Protocol is a compliance framework from International (EMVCo - standards consortium) with 6 domains and 22 controls. EMVCo EMV 3-D Secure (3DS), the messaging protocol that enables consumer authentication for card-not-present e-commerce transactions (the basis of Visa Secure, Mastercard Identity Check, etc.). 3DS uses a three-domain model (Acquirer, Issuer, Interoperability domains) and the roles 3DS Requestor, 3DS Server, Directory Server (DS), Access Control Server (ACS) and 3DS SDK, exchanging Authentication (AReq/ARes), Challenge (CReq/CRes) and Results (RReq/RRes) messages to support frictionless (risk-based) and challenge (step-up) authentication across browser and app channels. The full EMV 3DS Protocol and Core Functions Specification and SDK Specification are copyrighted EMVCo material available under EMVCo registration/licence; this node represents the publicly documented protocol architecture, not the gated normative text. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does EMV 3‑D Secure (3DS) - Payment Authentication Protocol actually require?
EMV 3‑D Secure (3DS) - Payment Authentication Protocol has 22 controls organised across 6 domains. The largest domains are EMV 3DS - Three-Domain Model and Roles (6 controls), EMV 3DS - Authentication Flows (4 controls), EMV 3DS - Authentication Messages (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of EMV 3‑D Secure (3DS) - Payment Authentication Protocol do I already cover?
EMV 3‑D Secure (3DS) - Payment Authentication Protocol maps to 3 other compliance frameworks. The top mapping partners are PSD2 SCA (18% coverage), GDPR (14% coverage), NIST SP 800-63 Digital Identity Guidelines (14% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement EMV 3‑D Secure (3DS) - Payment Authentication Protocol?
Start your EMV 3‑D Secure (3DS) - Payment Authentication Protocol compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about EMV 3‑D Secure (3DS) - Payment Authentication Protocol requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 22 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.
Get Started Free →Free forever — no credit card required