Unless a transaction is out of scope or an exemption applies, providers must apply SCA when a customer: accesses their payment account online; initiates an electronic payment transaction; or carries out any action through a remote channel which may imply a risk of payment fraud or other abuses