Mastercard's 2026 3DS Authentication Fee Changes in Europe: What Merchants Should Know

From 29 July 2026, Mastercard restructured its EMV 3DS Authentication Fee for merchants across Europe. This is a card scheme fee - set by Mastercard, not by your processor - charged on card-not-present transactions that go through 3D Secure authentication. Acquirers and processors have no discretion over it; they're contractually required to pass it through, and every merchant using Mastercard in the affected countries will see the updated rate on their next statement whether or not anyone told them it was coming.

This is what changed, what it actually costs at different transaction sizes, and - more usefully - how Strong Customer Authentication (SCA) exemptions reduce how often you pay it at all.

What the EMV 3DS Authentication Fee Actually Is

Every time a card-not-present transaction is authenticated through 3D Secure - the redirect or challenge step that confirms Strong Customer Authentication - Mastercard charges a small scheme fee for that authentication event. It's separate from interchange (paid to the issuing bank) and separate from your processor's own margin. It exists specifically because 3DS authentication involves Mastercard's network infrastructure verifying the cardholder with the issuer in real time.

Because it's a scheme fee, it's identical in structure no matter which processor or acquirer you use - Stripe, Adyen, Checkout.com, or a traditional acquirer all pass through the same Mastercard-set rate. What differs between providers is only how clearly and how far in advance they tell you about a change like this one.

What Changed on 29 July 2026

The previous fee schedule didn't distinguish between recurring and non-recurring transactions, and used a single fee cap regardless of whether the transaction was ultimately approved or declined. The updated structure introduces both distinctions. One acquirer's disclosed schedule (rates and caps vary slightly by acquirer contract, but the structure below reflects the new Mastercard framework):

Previous rates:

Updated rates (effective 29 July 2026):

*The approved-transaction cap applies to transactions above €10,000. **The declined-transaction cap applies to transactions above €1,000. Fixed fees are charged per transaction; percentage fees apply to the transaction value. Affected merchants are those based in the EEA, UK, Switzerland, Norway, Iceland, and Liechtenstein.

Two structural changes matter more than the headline percentages. First, recurring transactions now carry a materially lower rate than non-recurring ones - roughly a third of the cost - which reflects Mastercard pricing repeat, tokenised, low-fraud transactions differently from one-off checkouts. Second, the fee now has separate, much lower caps for declined transactions, so a failed authentication no longer costs nearly as much as a successful one. Both changes reward merchants who structure their checkout and billing correctly rather than treating every transaction the same way.

Why This Is a Good Time to Look at SCA Exemptions

This fee only applies to transactions that actually go through 3DS authentication. A transaction processed under a valid SCA exemption - meaning the issuer accepts the risk and skips the full authentication challenge - doesn't trigger this specific charge. As the per-authentication cost rises, the financial case for using exemptions properly gets stronger, on top of the conversion benefits they already provide by removing checkout friction.

Two exemptions are worth checking against your own transaction mix:

• Transaction Risk Analysis (TRA) exemption - available to acquirers and issuers with a low enough fraud rate, and applicable up to higher transaction values than the low-value exemption. If your provider qualifies and your fraud rate is clean, this is usually the highest-leverage exemption to pursue.
• Low Value Transaction (LVT) exemption - lets transactions under a set threshold (currently €30 in most of Europe, with a rolling cumulative cap) skip SCA entirely. If you run a lot of small-ticket transactions, this is the more straightforward exemption to configure.

Both exemptions are requested by the merchant's acquirer at the point of authorisation - the issuer can still decline the exemption and force a full challenge if their own risk model disagrees, which is why exemption approval rates vary by issuer and shouldn't be assumed at 100%. Recurring, tokenised transactions (subscriptions, saved cards) are also generally exempt from a full SCA challenge after the first authentication, which is part of why the new recurring rate in the table above is priced so much lower - Mastercard is pricing in the fact that these transactions carry less authentication overhead in the first place.

What to Actually Do About This

1. Ask your processor or acquirer for the exact updated fee schedule that applies to your account - the table above illustrates the structure, but confirm your own contracted rate and caps directly.
2. Check what proportion of your transactions currently go through a full 3DS challenge versus an exemption. Most dashboards (Stripe Radar, Adyen, Checkout.com) report this directly.
3. If your fraud rate is low and your provider supports it, ask specifically about TRA exemption eligibility - it's usually not applied automatically.
4. For subscription or recurring-billing businesses, confirm your provider is correctly flagging renewal transactions as recurring/MIT rather than running them through full non-recurring authentication each time - that flag is what determines which rate in the table above applies.
5. Factor scheme fee movements like this one into your effective rate calculations going forward - they happen periodically and are outside any processor's control, but they compound with everything else on your statement. See our breakdown of hidden payment processor fees for the full picture of what else shows up on a statement beyond the headline rate.

Scheme fee changes like this one are a useful reminder that a payment processor's headline rate is only part of the cost structure - Visa and Mastercard set fees like this one independently, and no processor can absorb or negotiate them away. Understanding how scheme rules actually work explains why these changes land on your statement with little warning, and why the businesses that manage cost proactively are the ones tracking exemption eligibility and authentication rates, not just the advertised processing percentage.

Frequently Asked Questions