3DS Secure as a Service

FinOn 3D Secure as a Service is a fully managed, cloud-hosted EMV® 3-D Secure Server for the acquiring side. Acquirers, PSPs and gateways use it to initiate and manage the entire authentication flow — from request to result — between the merchant/payment gateway, the card-scheme Directory Servers (DS) and the issuer’s Access Control Server (ACS). FinOn hosts, certifies and operates the platform, so clients get 3DS authentication without building their own infrastructure.

FinOn 3DS ACS as a Service is a fully managed, cloud-based EMV® 3-D Secure Access Control Server (ACS) for the issuing side. It lets issuers authenticate their cardholders: it receives authentication requests via the Directory Server, applies risk-based decisioning, and returns a frictionless approval or a challenge outcome — delivering the mandatory 3DS security level without compromising user experience.

The 3DS Server sits on the acquirer side and initiates authentication (it sends the authentication request and manages the flow), while the ACS sits on the issuer side and actually authenticates the cardholder (it decides frictionless vs challenge and returns the result). FinOn 3D Secure as a Service provides the 3DS Server; FinOn 3DS ACS as a Service provides the ACS. Together they cover both sides of the EMV 3DS flow.

If you are an acquirer, payment gateway, PSP, payment facilitator, marketplace or fintech that needs to send transactions for authentication, choose 3D Secure as a Service (the 3DS Server). If you are an issuer, issuer-processor, BIN sponsor or card program that needs to authenticate your own cardholders, choose 3DS ACS as a Service (the ACS). Banks that do both issuing and acquiring often run both.

Both services support EMV 3DS 2.1, 2.2 and 2.3.1 (and 3DS 1.0.2 where applicable), including frictionless flows, challenge flows, decoupled authentication, OOB authentication, 3RI (3DS Requestor Initiated), and recurring and MIT transactions.

Both are delivered as a managed cloud service (SaaS): hosted and maintained by FinOn, with rapid onboarding, logically isolated shared infrastructure, managed upgrades and lower operational overhead. A licensed on-premise deployment is also available for organizations that need full infrastructure control, data-residency compliance, custom security policies and dedicated SLAs — with the same EMV 3DS functionality.

Yes. In the managed (SaaS) model the platform is typically pre-certified against scheme requirements, which reduces integration time. In license/on-premise mode, certification is completed per deployment. Certification scope depends on the card schemes involved.

Us-on-Us authentication is when the acquirer and issuer belong to the same financial institution or group. In that case authentication can be performed directly with the internal ACS, and the Directory Server step may be bypassed where permitted. This reduces latency, cuts scheme dependency and improves approval rates — a key advantage for banks that run both issuing and acquiring.

Yes. FinOn’s 3DS Server supports direct API integration with an internal ACS, conditional routing logic (Directory Server vs direct ACS), separate configuration for on-us and off-us transactions, and a dedicated authentication path for internal cards.

Routing decisions are based on BIN ranges, issuer identification, card-portfolio ownership, configured issuer mappings and real-time routing rules. If a transaction qualifies as Us-on-Us, it is routed directly to the internal ACS instead of going through the Directory Server.

Yes. Both services use rich 3DS data (100+ data elements) and device information to assess risk in real time. The 3DS Server maximizes frictionless flows and flags exemptions; the ACS applies risk-based decisioning and steps up to a challenge only when the risk profile requires it.

In a frictionless flow, the ACS approves authentication using risk data without any cardholder interaction. In a challenge flow, the cardholder is asked to verify (for example via OTP or biometrics). FinOn maximizes the frictionless rate and triggers a challenge only for higher-risk transactions, managing the full CReq/CRes session lifecycle.

Browser-based challenges, SDK-based mobile challenges, embedded challenge windows, decoupled authentication and OOB (out-of-band) authentication, such as approval in the issuer’s banking app.

Yes. They handle Strong Customer Authentication and exemption logic: flagging and requesting low-value and TRA (Transaction Risk Analysis) exemptions, processing SCA exemption requests, handling soft declines and triggering step-up when an exemption is rejected. On the acquiring side, exemption logic can integrate with gateway risk engines.

Visa, Mastercard, other scheme Directory Servers and regional schemes. Each scheme has independent configuration and certification, with support for multiple hosts and failover rules.

FinOn 3D Secure as a Service integrates directly with a payment gateway or runs as a standalone authentication layer, exposing REST APIs and returning results for authorization. FinOn 3DS ACS as a Service integrates with issuer, core-banking and card-management systems and connects to a 3DS Server via APIs. Both can operate within a full payment orchestration ecosystem.

They are built for high-TPS environments, with active-active clustering, horizontal scaling, load balancing, database replication and automatic failover for high availability.

Through TLS encryption, certificate management, message-integrity validation and audit logging, maintaining compliance with card-scheme security requirements.

Yes. Especially in SaaS mode, both support logical tenant isolation, separate scheme configurations, independent reporting, and dedicated merchant portfolios (3DS Server) or card portfolios and BINs (ACS) — so multi-tenant PSPs and issuer-processors can operate under a single infrastructure.

Reporting includes authentication success rates, frictionless-vs-challenge ratio, scheme-specific performance, exemption acceptance rates, latency metrics and Us-on-Us vs off-us distribution. The main benefits are higher approval rates, lower authentication latency, reduced scheme dependency, an optimized customer experience, faster time-to-market and lower operational overhead — with the flexibility to deploy as a managed service or on-premise.