3DS Server SaaS vs License: When Does Owning Pay Off?
A side-by-side comparison of managed and licensed 3DS Server models: pricing, three-year TCO, compliance responsibilities, deployment and mobile integration for PSPs, acquirers and payment orchestrators.
What is the difference between a managed and a licensed 3DS Server?
A managed 3DS Server (3DS Server as a Service) is hosted and operated by the vendor. Your team integrates its API and, for native in-app 3DS, an approved mobile SDK. The service provider typically owns the hosting, scheme connections and day-to-day platform operations; charges are commonly based on authentication volume.
A licensed 3DS Server runs in infrastructure you control, such as your data centre or private cloud. You pay a software licence and support fees, then manage, or commission an operator to manage, the infrastructure, security controls, scheme onboarding and upgrades. Fixed software charges can become attractive as transaction volumes grow, but only after all operating costs are included.
There is no universal volume at which a licence becomes cheaper. Use 500,000 authentications per month as a prompt to run a total-cost comparison, not as a guaranteed break-even point. Data-residency or operational requirements may change the decision at any volume.
| Decision factor | Managed 3DS Server (SaaS) | Licensed 3DS Server |
|---|---|---|
| Deployment | Vendor-hosted, accessed by API | On-premises or private cloud under customer control |
| Typical pricing | Per authentication, tiered usage and/or minimum fees | One-time or term licence, maintenance and operating costs |
| Production scheme connections | Usually vendor-operated on an existing scheme-connected instance | Instance-specific testing and onboarding to be agreed with each scheme |
| Security assessment | Vendor’s hosted 3DS environment; review evidence and contract scope | Your deployment and the responsible operating entity, subject to scheme rules |
| Time to launch | Often shorter when the vendor’s platform is already scheme-ready | Adds hosting, security, integration and scheme-readiness work |
| Main advantage | Speed and reduced operations burden | Infrastructure control and potential savings at sustained scale |
How to compare 3DS Server pricing: start with three-year TCO
The procurement mistake is comparing a SaaS rate with the licence fee alone. The fair comparison uses the same expected authentication traffic, schemes, channels, geography, service levels and time horizon.
Costs to include in each model
| Cost | Managed (SaaS) | Licensed |
|---|---|---|
| Supplier charges | Per-authentication charges, minimums, setup and support extras | Licence fee, maintenance, version upgrades and support |
| Infrastructure | Usually bundled, subject to contracted limits | Compute, storage, availability, monitoring |
| Security and audit | Review provider evidence and customer integration scope | PCI 3DS Core validation where required, controls, assessments and remediation |
| Scheme work | Confirm what is live, included or billed separately | Instance-specific testing, connectivity and onboarding costs |
| Operations | Vendor runs the platform; your integration team remains accountable | Internal or outsourced 24/7 support, incident response and release management |
| Change and exit | Migration terms, data export, volume growth and price changes | Migration, re-onboarding and upgrade entitlements |
Ask whether the quote bills initiated authentications, completed authentications, or another event. Clarify 3RI and recurring flows, retries, test traffic, multi-scheme usage and any minimum monthly commitment. Those definitions can materially change the effective unit price.
Three-year SaaS TCO = setup + monthly platform charges + chargeable authentications × contracted rate + excluded service charges.
Three-year licensed TCO = licence + deployment and onboarding + three years of maintenance, infrastructure, assessments and incremental operations + expected upgrades or migration costs.
Count shared costs only once; include cost differences whenever the models change them. Treat card-scheme authentication fees as separate pass-throughs unless the proposals show a deployment-related difference.
Illustrative calculation—not a market price or FinOn quotation
Assume a tiered SaaS charge of $0.015 per billable authentication for the first 1,000,000 authentications a month and $0.005 for each authentication above that, with a $500 monthly minimum and no setup charge, and a licensed option with a $50,000 upfront licence, $12,000 annual support and $24,000 per year for incremental infrastructure, security and operations. Hold transaction volume constant for 36 months. Under these simplified assumptions, licensed TCO is $158,000.
| Monthly authentications | SaaS: 3 years | Licence: 3 years | Lower model in this example |
|---|---|---|---|
| 100,000 | $54,000 | $158,000 | SaaS |
| 500,000 | $270,000 | $158,000 | Licence |
| 1,000,000 | $540,000 | $158,000 | Licence |
| 2,000,000 | $720,000 | $158,000 | Licence |
Example break-even: about 293,000 authentications per month over three years. Change the SaaS unit price, annual operating expense, setup fees or volume trajectory and the crossover moves. The example excludes taxes, discounting and any separate scheme-onboarding charge; a real RFP needs those items when applicable.
Why 500,000 authentications is a review point, not a rule
At around 500,000 authentications a month, sustained over several months, a PSP should ask for comparable SaaS and licence quotes. That is a useful budgeting trigger, not a verified industry break-even threshold. The more consequential questions are how fast volume is growing, whether you already operate an assessed payments environment, and how much additional operations capacity the server requires.
Compare SaaS and licence on your own numbers
Send your monthly authentication volumes, growth forecast and target schemes. FinOn will model both deployment options on the same assumptions, so you see your real crossover point instead of a rule of thumb.
Who owns EMVCo approval, scheme onboarding and PCI?
“3DS certification” can mean different things. Keep product approval, production scheme readiness and security validation separate. The responsibility split changes with the commercial model and the exact contracting entity.
| Requirement | What to verify |
|---|---|
| EMVCo Letter of Approval (LOA) | The product name, exact server/SDK build, supported specification, tested extensions and current listing. Product approval does not certify your particular hosting setup or prove live scheme access. |
| Card-scheme onboarding | Which Visa, Mastercard and regional Directory Server routes are production-ready, and who performs any new instance testing. |
| PCI 3DS Core | Evidence for the environment and entity performing 3DS Server functions, as required by relevant payment-brand programs. |
| PCI DSS | A separate assessment based on where cardholder account data is stored, processed or transmitted; it does not automatically apply to every 3DS deployment. |
For SaaS, request the vendor’s relevant security evidence and a written responsibility matrix. For a licensed deployment, confirm who will operate the assessed 3DS environment, who owns certificate/key lifecycle tasks and what each scheme requires from that deployment. PCI 3DS Core and PCI DSS are independent standards: a licensed server does not automatically expand PCI DSS scope unless the implementation brings relevant account-data handling into scope.
Security requirements for 3DS environments are set out in the PCI 3DS Core Security Standard.
Data residency alone does not necessarily require a software licence. If a vendor can offer a contracted, assessed in-country hosting arrangement that meets the client’s legal and security requirements, managed deployment may remain viable. Verify the location of processing, logs, backups, support access and encryption keys, not just the data-centre region.
How long does 3DS Server deployment take?
A managed 3DS Server can move faster because its infrastructure and card-scheme connections may already be live. A licensed deployment adds infrastructure provisioning, security validation and separate scheme-readiness work. Neither model has a reliable industry-wide go-live duration: the schedule depends on the schemes, acquirers, browser and app scope, security review and the customer’s integration capacity.
Five milestones to put in your implementation plan
- Confirm scope and ownersPayment brands, merchant/acquirer identifiers, target markets, transaction channels and acceptance criteria.
- Issue documentation and sandbox accessAPI documentation and sandbox access; plan the mobile SDK integration where native in-app 3DS is required.
- Complete sandbox casesFrictionless, challenge, timeout, cancellation, failures and multi-merchant routing.
- Complete production readinessScheme onboarding as applicable, credentials, key management, monitoring, escalation and rollback.
- Release controlled live trafficReconcile authentication results with downstream authorisation reporting.
What buyers should require from the mobile SDK and sandbox
iOS and Android 3DS SDKs
For a native EMV 3DS app flow, the merchant app generally needs a compatible 3DS SDK, either embedded directly or supplied inside an acquiring/PSP SDK. It collects device information and supports the native challenge exchange with the issuer ACS. The ACS makes the authentication decision; the 3DS Server does not approve or decline payments.
Check EMVCo approval for the SDK separately from the server. The SDK and server can have different approved protocol versions when the relevant message flows are interoperable. Also check the supported mobile operating systems, SDK release cycle, challenge handling, security-validation evidence and ownership of upgrades.
A 3DS sandbox that reproduces failure, not just success
Request a 3DS sandbox with a simulated Directory Server and issuer ACS, and test both browser and native-app flows. At a minimum, it should cover:
- Frictionless result
- Challenge start and completion
- Issuer rejection and attempted outcomes
- App background and resume
- Timeout and network recovery
- Correct merchant and acquirer identifiers
A sandbox can catch mapping and control-flow defects. It cannot substitute for production Directory Server connectivity, live certificates, scheme approval or operational readiness.
Plan your 3DS integration with the FinOn team
Tell us your schemes, channels and acquiring setup. We will map the integration steps, test scenarios and acceptance criteria for your project.
Verify the exact EMV 3DS product you are buying
Ask for the EMVCo LOA reference and check the official approved-products database. Confirm the server’s product name, approved version, operating environment, approval expiry, extensions and restrictions. Then ask which 3DS message versions are actually supported on the target scheme routes and issuer side; a product-level 2.3.1 approval is not a guarantee that every transaction can use that protocol version.
FinOn’s published LOA, for example, identifies “3DSS FINON” version 2.3.1 (approval 3DS_LOA_SER_FITC_020301_01050), an EMV 3DS 2.3.1 approved 3DS Server. It covers EMV 3DS specifications 2.2.0 and 2.3.1.1, names Ubuntu 20.04 as the tested environment and carries a stated expiry of 28 May 2027, subject to the approval remaining on EMVCo’s public list. FinOn’s iOS and Android SDKs have separate 2.2.0 approvals. Always verify the supplied release and operating environment against the current LOA and scheme acceptance.
Any LOA can be checked against EMVCo’s list of approved 3DS products, including the FinOn 3DS Server LOA.
Which 3DS Server model is right for your business?
| Your situation | Commercial starting point |
|---|---|
| You are launching a new PSP or market without a 24/7 platform team | Ask for managed SaaS first; value the faster integration and smaller operational commitment. |
| You process sustained high authentication volume with predictable growth | Model three to five years of usage; test the crossover under real licence, support, audit and operating costs. |
| You require direct control of hosting, configuration and maintenance windows | Evaluate licensed deployment and the exact operational responsibilities. |
| You need in-country hosting or strict key control | Test whether managed in-region hosting meets the requirement before assuming on-premises is mandatory. |
The decision is not “cloud versus security”. It is where cost, operational accountability and control sit. Two functionally similar EMVCo-approved servers can produce very different costs and operational risks when deployed under different responsibility models. If you may switch later, secure API and SDK continuity, data portability, and a migration/onboarding plan in the contract.
Questions to ask both SaaS and licensed 3DS vendors
- What exact event is billable, and what are the price tiers, minimums, setup fees and overage rules?
- Which schemes, regional networks and protocol versions are live on the proposed instance?
- Who is responsible for PCI 3DS Core, PCI DSS where applicable, certificates and incident management?
- What does the three-year and five-year TCO look like at our base, downside and growth volumes?
- Which iOS/Android SDK releases and sandbox scenarios are included, and what evidence supports their approval?
- Can we switch from hosted to licensed using the same API and SDK? What re-onboarding is required?
- What are the acceptance tests, operational SLAs, exit rights and upgrade commitments?
The full supplier checklist is covered in How to Choose a 3DS Server Provider: 8 Questions for PSPs and Acquirers.
Managed vs licensed 3DS Server: FAQ
Is a licensed 3DS Server always cheaper at high volumes?
No. It can have lower marginal software cost, but the answer depends on licence terms, support, infrastructure, PCI 3DS Core requirements and staffing. Compare identical three-year or five-year operating assumptions.
What is the difference between managed 3DS Server and 3DS Server as a Service?
They usually describe the same operating model: the provider hosts and operates the 3DS Server, while customers access it through APIs and, where applicable, a mobile SDK.
Is 500,000 authentications a month the 3DS Server break-even point?
No. It is a useful point to start a cost review, not an industry price boundary. A lower-volume PSP may need a licence for control; a much larger PSP may still prefer SaaS because of operating costs or supplier pricing.
Does EMVCo approval cover scheme onboarding and PCI security?
No. EMVCo approves specific 3DS products and versions. Live Directory Server onboarding is a separate scheme process, and PCI 3DS Core addresses the security of environments performing the functions.
Does a licensed 3DS Server automatically require PCI DSS certification?
No. PCI DSS and PCI 3DS Core are separate standards. PCI DSS applicability depends on account-data processing and the payment-brand/acquirer requirements for the implementation.
Can I use an EMV 3DS 2.2.0 mobile SDK with a 2.3.1 server?
Potentially, yes. SDKs and servers have separate product approvals, and compatible version combinations are possible. Check the specific approved builds, supported flows and scheme requirements.
How long does implementation take?
Managed deployment is often quicker because scheme connections and hosting may be available. Exact timing depends on integrations, schemes, acquirers, testing, security approval and readiness to process live traffic.
Compare both FinOn 3DS deployment models on your actual numbers
FinOn provides a licensed 3DS Server for on-premises or private-cloud deployment and a managed 3DS Server as a Service. Both options can be evaluated against the same acquiring routes, authentication volumes, SDK requirements and implementation scope.
Choosing a 3DS Server? Talk to the FinOn team
Share your target schemes, expected volumes, acquiring routes and preferred deployment model. We will walk through the integration, evidence and acceptance tests that fit your setup.
