Visa Business News
E-Commerce & Authentication

5 October 2023

Changes to the Digital Authentication Framework and Visa DelegatedAuthentication Program in Europe
Europe | Acquirers, Issuers, Processors, Agents
Visa Network; V PAY; Europe Processing

Overview: Visa will introduce new implementation requirements for Digital Authentication Framework
participation in Europe. Visa is also announcing the closure of the Visa Delegated Authentication Program tonew entrants.
As announced in AI11384 in the 16 September 2021 edition of the Visa BusinessNews (not available to agents), Visa introduced the Digital Authentication
Framework (DAF) in Europe, which was effective from 23 April 2022. The DAF
established a set of clear criteria and requirements through which transactions may
qualify as fully authenticated. Fully authenticated transactions under the DAF
benefit from lower fraud and higher approval rates, as well as merchant fraud
liability protection under the Visa Rules.
Effective as of 1 October 2023, the DAF has been expanded in Europe to include
advanced authentication data provided according to Visa’s requirements of the Fast
Identity Online (FIDO™) standard. Effective 1 April 2024, use of FIDO™ data will
become required for DAF participation in Europe.
The introduction of the FIDO™ standard significantly enhances issuers’ capability toaccurately authenticate their cardholders, and the expansion of DAF-qualified
transactions to include FIDO™ data is aimed at helping to satisfy current and futureissuer regulatory requirements. Note: The responsibility for regulatory complianceunder the Payment Services Directive rests with the issuer.

Mark Your Calendar:
1 April 2024
• FIDO™ data required for
DAF transactions in Europe• Europe issuersautomatically activated forfree trial of FIDO™ onbehalf-of (OBO) service
1 October 2024
• Europe issuers will begin
being charged for FIDO™
on-behalf-of (OBO)
service unless they opt
out before the end of thefree trial

In conjunction with the inclusion of FIDO™ data in the DAF, Visa will close the Visa Delegated Authentication
Program (VDAP) to new entrants effective immediately.

Effective Immediately: VDAP Closed to New Entrants
VDAP allows payment service providers to delegate authentication to eligible third parties. (Program details areavailable in the Visa Delegated Authentication section of the Payment Services Directive 2 Solutions page at Visa Online.)
Effective immediately, VDAP is closed to new entrants. There is no current impact to existing users; existing
VDAP users will be able to continue participating in the program, but they should be aware that VDAP will beArticle ID: AI13373

sunset over time. Details about the eventual retirement of VDAP will be communicated in future editions of theVisa Business News.
Organizations that were considering VDAP are encouraged to refer to the information and guidelines for DAFparticipation in Europe. Details are available on the Digital Authentication Framework page at Visa Online.

Effective 1 October 2023: FIDO™ Data Included in DAF
Effective as of 1 October 2023, Visa has expanded the DAF in Europe to include FIDO™ data. With this expansion,
Visa will strongly encourage the use of FIDO™ data for Europe DAF-participating transactions made with Visa
Secure and Visa Token Service (VTS) / the Cloud Token Framework (CTF).

Effective 1 April 2024: FIDO™ Data Required for DAF Participation
Effective 1 April 2024, merchants, acquirers and token requestors (TRs) in Europe wishing to benefit from thefraud liability protection of DAF-qualified transactions must utilize the FIDO™ standard as an authentication
technology and send resulting FIDO™ data to issuers on each DAF-qualifying transaction. While FIDO™ data will
be required for DAF qualification of e-commerce / credential-on-file (COF) token transactions, FIDO™ data will beoptional for DAF qualification of device token transactions (made with secure element [SE] / host card emulation[HCE] / embedded secure element [eSE] tokens). Note: This requirement includes transactions using Strong
Customer Authentication (SCA) exemption indicators.
The existing DAF performance program requirements for Europe and certain Visa Supplemental Requirements
documentation (Visa Secure Program Guide, PSD2 Strong Customer Authentication for Remote Electronic Commerce
Transactions—European Economic Area and United Kingdom and Visa Digital Solutions API Reference Guide)1 will
be updated to include Visa FIDO™ requirements.
The Visa Digital Solutions API Reference Guide will be updated in April 2024. The updated Visa Secure Program Guide and PSD2 Strong Customer
Authentication for Remote Electronic Commerce Transactions—European Economic Area and United Kingdom will be updated in October 2023 and will
be available on the Visa Supplemental Requirements page at Visa Online.
1Processing Requirements for Merchants, Acquirers and TRs
Merchants, acquirers and TRs can utilize either Visa Secure or VTS / CTF to achieve the fraud liability protection
benefits of DAF qualification with FIDO™ data.
Effective as of 1 October 2023, merchants, acquirers and TRs participating in the DAF in Europe are able, andhighly encouraged, to utilize the FIDO™ standard as an authentication technology and send resulting FIDO™ datato issuers for each DAF-qualifying transaction.
Effective 1 April 2024, FIDO™ data will become mandatory for the DAF in Europe. At that time, in order toparticipate in the DAF in Europe using Visa Secure or VTS / CTF, merchants, acquirers and TRs must support thegeneration and processing of data based on the Visa FIDO™ Implementation Guide. This guide will be available at
Visa Online by November 2023; details will be communicated in a future edition of the Visa Business News.

Processing Requirements for Issuers
Regardless of the processing option used by merchants / acquirers / TRs, issuers will be able to receive FIDO™
authentication data through Visa Secure.

Article ID: AI13373

Effective immediately, issuers are strongly encouraged to utilize the FIDO™ data being provided in DAF
transactions. Specifically, issuers are advised to:•Register FIDO™ public keys received within the FIDO™ data•

Introduce processes to validate the signed data received from merchants, acquirers and TRs on each DAFqualifying transaction•Adjust their processing and authentication methods to make full use of new FIDO™ data provided, and update
their authorization decision and risk management practices to account for it

Further information is available in the DAF-related implementation guides, available in the Additional Resources
section below, and the Visa FIDO™ Implementation Guide, the availability of which will be announced in a future
edition of the Visa Business News.

FIDO™ Issuer Services for Europe DAF Transactions
Issuers have the following two options for validating FIDO™ data before it arrives to them through the Visa Secure
Directory Server (DS). All FIDO™ data passes through the Visa Secure DS, regardless of whether it is sent via VTS orVisa Secure, so these options are available to issuers for all Europe DAF transactions.
•Pass-Through: The default service where the Visa Secure DS will perform standard field-level validation
checks, but no further verification / validation of FIDO™ data is performed by Visa. The transaction is thenpassed to the issuer for final decisioning. All issuers are enrolled in this service and there is no need for issuers
to perform any further actions in order to receive FIDO™ data. There are no additional fees associated withthis service.

•On-Behalf-Of (OBO): An enhanced, optional service where the Visa Secure DS performs comprehensive
validation and data enrichments, which are then passed to the issuer via an EMV® 3-D Secure (3DS) extension
to make the final decision. This service has been developed to support issuers and access control servers thatwant to utilize the FIDO™ data with minimal development impact (i.e., without needing to register public keys
or validate signed data). The OBO service will be chargeable beginning 1 October 2024.

Effective 1 April 2024, Visa will activate all Europe issuers for a six-month free introductory trial of the FIDO™
OBO service. On 1 October 2024, issuers will begin being charged unless they opt out before the end of the trial
period and revert to the default pass-through service. Details about how to opt out of the OBO service will be
provided in a future edition of the Visa Business News.
EMV® is a registered trademark in the U.S. and other countries and an unregistered trademark elsewhere. The EMV trademark is owned by EMVCo, LLC.

Additional Resources
Documents & PublicationsAI13104 - “Visa Click to Pay with FIDO Authentication Will Be Introduced in Europe,” Visa Business News, 22 June 2023
(available to clients only)
AI11384 - “Launch of Digital Authentication Framework in Europe,” Visa Business News, 16 September 2021
(available to clients and processors only)
AI11315 - “E-Commerce Transactions Authenticated With a Device-Based Secure Element Token Will Be
Article ID: AI13373

Classified as ECI 05 in Europe,” Visa Business News, 5 August 2021 (available to clients and processors only)
AI10779 - “Visa Token Service Cloud Token Framework Functionality Enhancements for Issuers,” Visa Business
News, 25 February 2021 (available to clients and processors only)
AI10361 - “Visa Secure Rules Will Be Updated to Support Authentication for Non-Payment Transactions,”
Visa Business News, 10 September 2020
AI08801 - “Leading the Next Generation of Innovations for Strong Customer Authentication,” Visa Business
News, 3 April 2019 (available to clients and processors only)
Online Resources
Refer to the following documents in the Visa Secure for EMV® 3DS Documents section of the Visa Secure
Documentation page at Visa Online:•Visa Secure – Issuer Implementation Guide for EMV 3-D Secure•

Visa Secure – Merchant / Acquirer Implementation for EMV 3-D Secure

Refer to the following documents in the Tokenization Implementation Guides section of the Visa Token ServiceResources page at Visa Online:•

Visa Token Service Implementation Guide for Issuer / I-TSP Participation in VDEP Solutions•

Visa Token Service Implementation Guide for Acquirers

The following documents are available on the Visa Supplemental Requirements page at Visa Online:•Visa Secure Program Guide (under 3-D Secure and Visa Secure; will be updated in October 2023)•PSD2 Strong Customer Authentication for Remote Electronic Commerce Transactions—European Economic
Area and United Kingdom (under Products and Services; will be updated in October 2023)•Visa Digital Solutions API Reference Guide (under Products and Services; will be updated in April 2024)

Note: For Visa Online resources, you will be prompted to log in.

For More Information
Contact Visa customer support on your country-specific number, or email CustomerSupport@visa.com.
Merchants and third party agents: Contact your acquirer, issuer, processor or Visa representative.

Notice: The information, materials and any recommendations contained or referenced herein (collectively,“Information”) is furnished to you solely in your capacity as a customer of Visa Inc. (through its operatingcompanies of Visa U.S.A Inc., Visa International Service Association, Visa Worldwide Pte. Ltd, Visa Europe Ltd., Visa
International Servicios de Pago España, S.R.L.U. and Visa Canada Corporation) (collectively, “Visa”) or its authorized
agent, or as a participant in the Visa payments system. By accepting the Information, you acknowledge that theArticle ID: AI13373

Information is confidential and subject to the confidentiality restrictions contained in the Visa Core Rules andProduct and Service Rules and/or other applicable confidentiality terms between you and Visa (“ConfidentialityRestrictions”), which limit your use and disclosure of the Information and address feedback and patents. You agreeto keep the Information confidential and not to use the Information for any purpose other than in your capacity asa customer of Visa Inc. or as a participant in the Visa payments system in accordance with Confidentiality
Restrictions. You may disseminate the Information to a merchant participating in the Visa payments system only if:(i) you serve the role of “acquirer” within the Visa payments system; (ii) you have a direct relationship with suchmerchant that includes an obligation to keep the Information confidential; and (iii) the Information is designatedas “affects merchants” demonstrated by display of the storefront icon on the communication. You must ensurethat a merchant receiving such Information maintains the confidentiality of such Information and discloses anduses it on a “need to know” basis and only in their capacity as a participant in the Visa payments system. Except asotherwise provided herein or pursuant to applicable Confidentiality Restrictions, the Information may only bedisseminated within your organization on a need-to-know basis to enable your participation in the Visa payments
system. Visa is not responsible for errors in or omissions from this publication. The Information is provided “AS-IS”
and intended for informational purposes only and should not be relied upon for operational, marketing, legal,technical, tax, financial or other advice. Visa neither makes any warranty or representation as to the completenessor accuracy of the Information, nor assumes any liability or responsibility that may result from reliance on or useof such information. Please be advised that the Information may constitute material non-public information underU.S. federal securities laws and that purchasing or selling securities of Visa while being aware of material nonpublic information would constitute a violation of applicable U.S. federal securities laws. Participation in services issubject to Visa’s terms and conditions in program participation agreements and associated documentation.
Benefits are illustrative only and depend on business factors and implementation details. The trademarks, logos,
trade names and service marks, whether registered or unregistered (collectively the “Trademarks”) are Trademarks
owned by Visa. All other Trademarks not attributed to Visa are the property of their respective owners, are used
for illustrative purposes only and do not imply product endorsement or affiliation with Visa unless the Information
indicates otherwise. Capitalized terms not otherwise defined herein have the meanings given to them in the Visa
Core Rules and Visa Product and Service Rules.
© 2023 Visa. All Rights Reserved.

Article ID: AI13373