3DS 1.0.2 Sunset FAQ
KA-04083
1134
10/06/2022 00:12 AM
1.0
Contents
3DS 1.0.2 sunset
What is the sunset of 3DS 1.0.2?
What are the benefits of EMV 3DS over 3DS 1.0.2?
Who is affected by the sunset?
What are the network 3DS 1.0.2 sunset dates?
What steps does a merchant need to take prior to sunset?
What steps do I need to take to be EMV 3DS ready?
What happens post 3DS 1.0.2 sunset?
What happens if my organization is unable to move to EMV 3DS before the deadline?
What will a merchant receive from Payer Authentication in the pa_enroll Response post sunset?
What happens to 3DS 1.0.2 Replays post sunset?
Merchants in countries with 3DS 1.0.2 sunset date extension
With 3DS 1.0.2 being extended in some countries, what response values could be returned for intra region versus cross-border transactions?
Effective October 2022, the Directory Server will no longer be able to support 3DS 1.0.2 transaction requests, and CardinalCommerce will sunset 3DS 1.0.2 and all its features (except in countries with network extensions). If you are sending any transactions down 3DS 1.0.2, you will receive an unauthenticated outcome and will not be able to continue with 3DS processing.
• Any merchant processing transactions down 3DS 1.0.2
• Any merchant processing a portion of their transactions down EMV 3DS but still sending transactions down 3DS 1.0.2
• EMV 3DS transactions downgraded, due to an error, to 3DS 1.0.2
• Transactions downgraded to 3DS 1.0.2 due to a rule
• Merchants participating in Replay to send transactions down 3DS 1.0.2
Since 1999, there have been five major networks that have supported 3DS 1.0.2. Each of these networks have announced their sunset dates: Visa Secure, Mastercard SecureCode, American Express SafeKey, Discover ProtectBuy, JCB J/Secure as shown in Table – 1
Table - 1
Visa will continue to support 3DS 1.0.2 transaction processing in India, Sri Lanka, Bangladesh, Nepal, Maldives, Bhutan, solely for domestic transactions until October 12, 2023.
American Express has extended support for India domestic transactions until October 2023.
Mastercard has extended support for India and Bangladesh until October 2023.
Important: The extension is for Intra region (domestic) transactions that are acquired and issued within the same country.
Acquirer/Processor steps:
1. Double check with your acquirer to ensure your acquirer BIN/MID has been added to the network directory server.
2. Double check that your gateway, and processor, can handle EMV 3DS to send EMV 3DS transactions into authorization.
Find out about processor readiness: https://support.cybersource.com/knowledgebase/knowledgearticle/?code=000003868
3. Update integration depending on the type of integration. Please refer to the migration steps in the following Cybersource support Knowledge base article
https://support.cybersource.com/knowledgebase/knowledgearticle/?code=000003864
If you need assistance, please contact Cybersource support: https://support.cybersource.com/knowledgebase/Knowledgearticle/?code=000002076
If an extension has been given, then intra region transactions can process through EMV 3DS and 3DS 1.0.2. Cross border transaction will only be allowed to process through EMV 3DS. In an event where cross border transactions are routed through 3DS 1.0.2, those transactions will result in an unauthenticated outcome (Enrolled = N or U on the pa_enroll Response depending on the network). For regions where an extension has been given, intra region 3DS 1.0.2 transactions will be go through normal 3DS 1.0.2 processing.
Intra region transactions are those transactions that are acquired and issued within the same country. If there is an extension, then those transactions must be acquired and issued within the country that has the extension.
Here are a few examples:
Visa Secure:
Cross-border transaction (for countries not supporting 3DS 1.0.2 extensions): If you are processing an Indian acquired transaction on 3DS 1.0.2, but the consumer is using a US issued card, then the transaction will result in an unauthenticated outcome. You will receive Enrolled = N or U on the pa_enroll Response depending on the network.
Cross-border transaction (w/ 3DS 1.0.2 extension): If you are processing an Indian acquired transaction on 3DS 1.0.2, but the consumer is using a Sri Lanka issued card (or a card from another country that has extension), then the transaction will go through normal 3DS 1.0.2 processing.
Intra-region* transaction (3DS 1.0.2 extended till October 2023): If you are processing an Indian acquired transaction on 3DS 1.0.2, and the consumer is using an Indian issued card, then the transaction will go through normal 3DS 1.0.2 processing.
American Express:
Cross-border transaction (for countries not supporting 3DS 1.0.2 extensions): If you are processing an Indian acquired transaction on 3DS 1.0.2, but the consumer is using a US issued card, then the transaction will result in an unauthenticated outcome, and you will receive Enrolled = N or U on the pa_enroll Response depending on the network.
Intra-region* transaction (3DS 1.0.2 extended till October 2023): If you are processing an Indian acquired transaction on 3DS 1.0.2, and the consumer is using an Indian issued card, then the transaction will go through normal 3DS 1.0.2 processing.
Table – 2
3DS 1.0.2 sunset
What is the sunset of 3DS 1.0.2?
What are the benefits of EMV 3DS over 3DS 1.0.2?
Who is affected by the sunset?
What are the network 3DS 1.0.2 sunset dates?
What steps does a merchant need to take prior to sunset?
What steps do I need to take to be EMV 3DS ready?
What happens post 3DS 1.0.2 sunset?
What happens if my organization is unable to move to EMV 3DS before the deadline?
What will a merchant receive from Payer Authentication in the pa_enroll Response post sunset?
What happens to 3DS 1.0.2 Replays post sunset?
Merchants in countries with 3DS 1.0.2 sunset date extension
With 3DS 1.0.2 being extended in some countries, what response values could be returned for intra region versus cross-border transactions?
3DS 1.0.2 sunset
What is the sunset of 3DS 1.0.2?
Effective October 2022, the Directory Server will no longer be able to support 3DS 1.0.2 transaction requests, and CardinalCommerce will sunset 3DS 1.0.2 and all its features (except in countries with network extensions). If you are sending any transactions down 3DS 1.0.2, you will receive an unauthenticated outcome and will not be able to continue with 3DS processing.
What are the benefits of EMV 3DS over 3DS 1.0.2?
Who is affected by the sunset?
• Any merchant processing transactions down 3DS 1.0.2
• Any merchant processing a portion of their transactions down EMV 3DS but still sending transactions down 3DS 1.0.2
• EMV 3DS transactions downgraded, due to an error, to 3DS 1.0.2
• Transactions downgraded to 3DS 1.0.2 due to a rule
• Merchants participating in Replay to send transactions down 3DS 1.0.2
What are the network 3DS 1.0.2 sunset dates?
Since 1999, there have been five major networks that have supported 3DS 1.0.2. Each of these networks have announced their sunset dates: Visa Secure, Mastercard SecureCode, American Express SafeKey, Discover ProtectBuy, JCB J/Secure as shown in Table – 1
| Network | Date | Countries with Extension |
| Visa Secure | 15th Oct 22 | India, Sri Lanka, Bangladesh, Nepal, Maldives, and Bhutan (Oct 12, 2023) |
| Mastercard SecureCode | 18th Oct 22 | India and Bangladesh (Oct 3, 2023) |
| JCB J/Secure | 18th Oct 22 | |
| American Express SafeKey* | 14th Oct'22 | India (Oct 3, 2023) |
| Discover ProtectBuy | 14th Oct'22 |
Visa will continue to support 3DS 1.0.2 transaction processing in India, Sri Lanka, Bangladesh, Nepal, Maldives, Bhutan, solely for domestic transactions until October 12, 2023.
American Express has extended support for India domestic transactions until October 2023.
Mastercard has extended support for India and Bangladesh until October 2023.
Important: The extension is for Intra region (domestic) transactions that are acquired and issued within the same country.
What steps does a merchant need to take prior to sunset?
What steps do I need to take to be EMV 3DS ready?
Acquirer/Processor steps:
1. Double check with your acquirer to ensure your acquirer BIN/MID has been added to the network directory server.
2. Double check that your gateway, and processor, can handle EMV 3DS to send EMV 3DS transactions into authorization.
Find out about processor readiness: https://support.cybersource.com/knowledgebase/knowledgearticle/?code=000003868
3. Update integration depending on the type of integration. Please refer to the migration steps in the following Cybersource support Knowledge base article
https://support.cybersource.com/knowledgebase/knowledgearticle/?code=000003864
If you need assistance, please contact Cybersource support: https://support.cybersource.com/knowledgebase/Knowledgearticle/?code=000002076
What happens post 3DS 1.0.2 sunset?
What happens if my organization is unable to move to EMV 3DS before the deadline?
Transactions will have an unauthenticated outcome, except for those countries that have been granted a network extension. This means that those transactions will not be PSD2 compliant, and the merchant will not receive liability protection. Additionally, you will lose out on the benefits of 3DS authentication in general.What will a merchant receive from Payer Authentication in the pa_enroll Response post sunset?
If the transaction is acquired and issued within a country that has been sunset, then you will receive an unauthenticated (Enrolled = N or U on the pa_enroll response depending on the network) outcome in the pa_enroll response.What happens to 3DS 1.0.2 Replays post sunset?
3DS 1.0.2 Replay will be deactivated in alignment with the network sunset dates. The only exception to this is India intra-regional transactions, where the Replay functionality will still be supported until 3DS 1.0.2 is sunset in India. Post-sunset, non-EMV 3DS transactions will result in an unauthenticated outcome.Merchants in countries with 3DS 1.0.2 sunset date extension
With 3DS 1.0.2 being extended in some countries, what response values could be returned for intra region versus cross-border transactions?
If an extension has been given, then intra region transactions can process through EMV 3DS and 3DS 1.0.2. Cross border transaction will only be allowed to process through EMV 3DS. In an event where cross border transactions are routed through 3DS 1.0.2, those transactions will result in an unauthenticated outcome (Enrolled = N or U on the pa_enroll Response depending on the network). For regions where an extension has been given, intra region 3DS 1.0.2 transactions will be go through normal 3DS 1.0.2 processing.
Intra region transactions are those transactions that are acquired and issued within the same country. If there is an extension, then those transactions must be acquired and issued within the country that has the extension.
Here are a few examples:
Visa Secure:
Cross-border transaction (for countries not supporting 3DS 1.0.2 extensions): If you are processing an Indian acquired transaction on 3DS 1.0.2, but the consumer is using a US issued card, then the transaction will result in an unauthenticated outcome. You will receive Enrolled = N or U on the pa_enroll Response depending on the network.
Cross-border transaction (w/ 3DS 1.0.2 extension): If you are processing an Indian acquired transaction on 3DS 1.0.2, but the consumer is using a Sri Lanka issued card (or a card from another country that has extension), then the transaction will go through normal 3DS 1.0.2 processing.
Intra-region* transaction (3DS 1.0.2 extended till October 2023): If you are processing an Indian acquired transaction on 3DS 1.0.2, and the consumer is using an Indian issued card, then the transaction will go through normal 3DS 1.0.2 processing.
American Express:
Cross-border transaction (for countries not supporting 3DS 1.0.2 extensions): If you are processing an Indian acquired transaction on 3DS 1.0.2, but the consumer is using a US issued card, then the transaction will result in an unauthenticated outcome, and you will receive Enrolled = N or U on the pa_enroll Response depending on the network.
Intra-region* transaction (3DS 1.0.2 extended till October 2023): If you are processing an Indian acquired transaction on 3DS 1.0.2, and the consumer is using an Indian issued card, then the transaction will go through normal 3DS 1.0.2 processing.
| Scenario | Acquirer Country | Issuer Country | Visa Secure Outcome | American Express outcome |
| Cross-border transaction (for countries not supporting 3DS 1.0.2 extensions) | India | USA | Non-authenticated 3DS 1.0.2 | Non-authenticated 3DS 1.0.2 |
| Cross-border transaction (w/ 3DS 1.0.2 extension) | India | Sri Lanka (or countries that have received extension) | 3DS 1.0.2 available | Not Applicable |
| Intra-region* transaction (3DS 1.0.2 extended until Oct’23) | India | India | 3DS 1.0.2 available | 3DS 1.0.2 available |
Was this article helpful?
Articles Recommended for You