3RI Explained: How Merchant-Initiated 3DS Authentication Protects Recurring Revenue

Most recurring transactions areexempt from Strong Customer Authentication under PSD2, once the original chargewas authenticated. But exempt doesn't mean approved: issuers can still declinean unauthenticated renewal, and several everyday triggers, an aged-outauthentication record, a shifted risk score, a variable final amount, force thequestion back open. 3RI, the Requestor-Initiated mode in EMV 3DS 2.2, letsmerchants authenticate those off-session charges by referencing the originalcardholder session, without pulling the subscriber back through checkout.

Under Article 14 of the PSD2Regulatory Technical Standards, a merchant-initiated transaction that followsan authenticated first payment doesn't need SCA. The renewal, the top-up, theauto-charge on file: all exempt, once the original cardholder-initiatedtransaction cleared with strong authentication. So why does a subscriptionbusiness processing thousands of renewals a month still watch a meaningfulshare of them come back declined?

Because “out of SCA scope” and“guaranteed approval” aren't the same thing. Skip authentication entirely andthe fraud liability sits with the merchant, not the issuer. Push a transactionthe issuer considers genuinely risky through unauthenticated, and it candecline it anyway, exemption or not. And a handful of situations still forcethe question back open: an authentication record that's aged out, a risk scorethat moved since sign-up, an amount the customer never confirmed upfront. Whenone of those hits, the issuer wants fresh proof before it approves anything.

3RI, the Requestor-Initiatedauthentication mode in EMV 3DS 2.2, is built for exactly that gap. It lets amerchant authenticate an off-session, cardholder-absent transaction byreferencing an earlier authenticated session, without routing the subscriber backthrough a checkout page they never asked to see again.

What the SCA exemption actually covers, and where it stops

The European BankingAuthority's guidance on merchant-initiated transactions sets out threeconditions for the exemption to apply: the cardholder gave the merchant amandate to initiate a transaction or series of transactions, that mandate sitsinside an agreement for goods or services, and the merchant can trigger thecharge without the cardholder doing anything at the time. Meet all three, andthe renewal doesn't need SCA.

What that guidance doesn't sayis that issuers have to approve every unauthenticated MIT that shows up. Cardschemes still reserve the right to ask for authentication data on transactionsthey flag as higher risk, and an issuer that sees a recurring charge with noauthentication history behind it has every reason to be cautious. Treating“exempt” as “risk-free” is where a lot of recurring billing programs quietlylose approval rate they didn't need to lose.

How 3RI authenticates a transaction with nobody there to authenticate

A 3RI request runs through thesame EMV 3DS message set as a normal authentication, with the device channelset to Requestor Initiated instead of browser or app. Rather than starting fromzero, it carries forward the DS Transaction ID and prior authentication detailsfrom the original cardholder-present session: the one where the subscriberactually entered their card and, in most cases, completed a challenge.

The 3DS Requestor tags therequest with an indicator describing why it's being sent, recurringtransaction, split shipment, and so on. The issuer's ACS checks the requestagainst the stored record of that original authentication and returns a result:no OTP, no biometric prompt, no redirect. In the rare case the issuer insistson a fresh check, it can trigger a decoupled challenge instead, handledentirely on the issuer's side (a banking app push, an SMS) with up to sevendays for the cardholder to respond, per the EMV 3DS specification.

Three recurring-revenue moments where 3RI earns its place

Re-authentication triggers: Authenticationrecords don't stay valid forever, and risk profiles change between billingcycles. When an issuer wants proof before approving month fourteen of asubscription it approved without question in month one, a 3RI request suppliesit. The alternative is rebuilding a checkout flow around a customer who thoughtthey were done checking out a year ago.

Variable and usage-basedbilling: Metered SaaS, infrastructure billing, anything where the finalcharge isn't known at sign-up, doesn't fit a standard authenticated checkout.The cardholder authenticated a plan, not a number. 3RI lets the merchantauthenticate the actual charge once it's known, using the original session asthe anchor.

Mid-cycle changes: Planupgrades, add-ons, proration adjustments: all variations on the same originalagreement, all candidates for a fresh 3RI request rather than a fullre-checkout.

What happens if you skip it

Most recurring billing setupshandle a decline the same way: retry, dunning email, maybe a card updater run,then try again. That workflow assumes the problem is a stale card number or atemporary hold. It does nothing for an issuer that specifically wantedauthentication data and never got it. Retrying an unauthenticated chargeagainst an issuer that's already said no on those grounds just produces thesame decline again.

That's how a fixable declineturns into involuntary churn: a customer who wanted to keep paying, on atransaction that never actually had a shot at clearing. 3RI doesn't fix everydecline. But for the subset that come back because the issuer wanted proof ofauthentication, it's the one channel built to supply it.

FAQ

Does 3RI require StrongCustomer Authentication?

No. Most recurringmerchant-initiated transactions are already exempt from SCA under PSD2. 3RI isa way to authenticate those transactions anyway, when an issuer wants proof orthe merchant wants the fraud liability shift that comes with it.

How is 3RI different from anormal 3DS checkout flow?

A standard 3DS flow happenswith the cardholder present in a browser or app. 3RI happens off-session,referencing an earlier authenticated transaction instead of prompting thecardholder again.

Can 3RI be used for somethingother than subscriptions?

Yes. Split shipments,variable-amount charges like car rental extras, and mid-order adjustments alluse the same mechanism, tagged with a different indicator.

What happens if an issuerdeclines a 3RI request?

The merchant falls back to astandard authorization attempt without the liability shift, or triggers a freshcardholder-present authentication if the relationship allows it.

Does the original card needto be stored somewhere to use 3RI?

Yes. 3RI reuses the originalauthentication and the underlying card credential, so it depends on the cardbeing held in a compliant vault rather than re-collected each cycle.

‍