A computer-implemented method comprising: receiving, by an access control server via a directory server from an authentication requestor, an authentication process message associated with an authentication request, the authentication process message comprising an account identifier, and information regarding a prior authentication method on the account identifier and a current authentication method for the account identifier associated with a transaction; performing, by the access control server , a risk analysis for the transaction based at least in part on the information and a threshold; authenticating, by the access control server , a user of the account identifier using the information, the account identifier, and a result of the risk analysis; modifying, by the access control server , an authentication response to include an authentication indicator; and transmitting, by the access control server , the authentication response to the authentication requestor, wherein the information regarding the prior authentication method on the account identifier and the current authentication method for the account identifier are represented by one or more values that are appended to the authentication process message, wherein a first value of the one or more values for the prior authentication method is a transaction reference value indicating the transaction associated with the prior authentication method such that the access control server can verify the one or more values in real-time or can be cross-referenced with their home system during reporting or during disputes, and a second value of the one or more values for the prior authentication method is a small data value representing a unique type of authentication provided by a processing network. receiving, by an access control server via a directory server from an authentication requestor, an authentication process message associated with an authentication request, the authentication process message comprising an account identifier, and information regarding a prior authentication method on the account identifier and a current authentication method for the account identifier associated with a transaction; performing, by the access control server , a risk analysis for the transaction based at least in part on the information and a threshold; authenticating, by the access control server , a user of the account identifier using the information, the account identifier, and a result of the risk analysis; modifying, by the access control server , an authentication response to include an authentication indicator; and transmitting, by the access control server , the authentication response to the authentication requestor, wherein the information regarding the prior authentication method on the account identifier and the current authentication method for the account identifier are represented by one or more values that are appended to the authentication process message, wherein a first value of the one or more values for the prior authentication method is a transaction reference value indicating the transaction associated with the prior authentication method such that the access control server can verify the one or more values in real-time or can be cross-referenced with their home system during reporting or during disputes, and a second value of the one or more values for the prior authentication method is a small data value representing a unique type of authentication provided by a processing network. <EOS>